Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-3060The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive informatiMaven · org.apache.activemq:activemq-client · fixed in 5.8.0
- CVE-2013-1821lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption andMaven · org.jruby:jruby · fixed in 1.7.3
- CVE-2013-0327Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.502, 1.480.3
- CVE-2013-0328Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web scriMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.502
- CVE-2013-0329Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism viaMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.502, 1.480.3
- CVE-2013-0330Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.502, 1.480.3
- CVE-2013-0331Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted pMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.502, 1.480.3
- CVE-2013-0248The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploadMaven · commons-fileupload:commons-fileupload · fixed in 1.2.2
- CVE-2013-1814The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive informationMaven · org.apache.rave:rave-core, org.apache.rave:rave-portal-resources +1 · fixed in 0.20.1
- CVE-2012-5633The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasseMaven · org.apache.cxf:cxf · fixed in 2.5.8, 2.6.5, 2.7.2
- CVE-2013-0239Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows rMaven · org.apache.cxf:cxf-rt-frontend-jaxrs · fixed in 2.5.9, 2.6.6, 2.7.3
- CVE-2012-4446The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without cMaven · org.apache.qpid:qpid-client · fixed in 0.20
- CVE-2011-4969Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to injMaven · org.webjars.npm:jquery · fixed in 1.6.3
- CVE-2012-6072CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.491, 1.480.1
- CVE-2012-6073Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x bMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.480.1, 1.491
- CVE-2012-6074Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.491, 1.480.1
- CVE-2013-0158Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x bMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.498, 1.480.2
- CVE-2013-1624The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channeMaven · org.bouncycastle:bcprov-jdk15on · fixed in 1.48
- CVE-2012-2378Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicyMaven · org.apache.cxf:cxf · fixed in 2.4.8, 2.5.3, 2.6.1
- CVE-2012-2379Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 oMaven · org.apache.cxf:cxf · fixed in 2.4.8, 2.5.4, 2.6.1
- CVE-2012-3428The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a securMaven · org.jboss.ironjacamar:ironjacamar-jdbc · fixed in 1.0.12.Final
- CVE-2012-3546org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows Maven · org.apache.tomcat:tomcat · fixed in 6.0.36, 7.0.30
- CVE-2012-4431org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to byMaven · org.apache.tomcat:tomcat · fixed in 6.0.36, 7.0.32
- CVE-2011-2730VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EMaven · org.springframework:spring-core · fixed in 3.0.6, 2.5.6.SEC03, 2.5.7.SR023
- CVE-2011-2731Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the AuthenticMaven · org.springframework.security:spring-security-core · fixed in 2.0.7, 3.0.6
- CVE-2011-2732CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows rMaven · org.springframework.security:spring-security-core · fixed in 2.0.7, 3.0.6
- CVE-2012-5055DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check theMaven · org.springframework.security:spring-security-core · fixed in 2.0.8, 3.0.8, 3.1.3
- CVE-2012-5370JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent aMaven · org.jruby:jruby-parent · fixed in 1.7.1
- CVE-2011-5245The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an Maven · org.jboss.resteasy:resteasy-jaxb-provider · fixed in 2.3.2
- CVE-2012-0818RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML externaMaven · org.jboss.resteasy:resteasy-client · fixed in 2.3.1