Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2010-1330The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-Maven · org.jruby:jruby-core · fixed in 1.4.1
- CVE-2012-5885The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x beMaven · org.apache.tomcat:tomcat · fixed in 5.5.36, 6.0.36, 7.0.30
- CVE-2012-5886The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches iMaven · org.apache.tomcat:tomcat-catalina · fixed in 5.5.36, 6.0.36, 7.0.30
- CVE-2012-5887The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does notMaven · org.apache.tomcat:tomcat · fixed in 5.5.36, 6.0.36, 7.0.30
- CVE-2012-5783Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that Maven · commons-httpclient:commons-httpclient
- CVE-2012-5784Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message ServicMaven · axis:axis, org.apache.axis:axis
- CVE-2012-5785Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjMaven · org.apache.axis2:axis2, org.apache.axis2:axis2-transport-http · fixed in 1.8.0
- CVE-2012-5817Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostnMaven · org.codehaus.xfire:xfire-core
- CVE-2012-1154mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to Maven · org.jboss.mod_cluster:mod_cluster · fixed in 1.1.4
- CVE-2012-4418Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."Maven · org.apache.axis2:axis2 · fixed in 1.7.9
- CVE-2012-5351Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a Maven · org.apache.axis2:axis2 · fixed in 1.6.4
- CVE-2012-1618Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" optionMaven · org.postgresql:postgresql · fixed in 8.2
- CVE-2012-3451Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by Maven · org.apache.cxf:cxf · fixed in 2.4.9, 2.5.5, 2.6.2
- CVE-2012-4386The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which alloMaven · org.apache.struts:struts2-core · fixed in 2.3.4.1
- CVE-2012-4387Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which isMaven · org.apache.struts.xwork:xwork-core · fixed in 2.3.4.1
- CVE-2012-3467Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which alMaven · org.apache.qpid:qpid-parent · fixed in 0.17
- CVE-2012-2965Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has Maven · com.caucho:resin · fixed in 4.0.29
- CVE-2012-2966Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, wMaven · com.caucho:resin · fixed in 4.0.29
- CVE-2012-2967Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisonsMaven · com.caucho:resin · fixed in 4.0.29
- CVE-2012-0213The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to causeMaven · org.apache.poi:poi, org.apache.poi:poi-scratchpad · fixed in 3.10-beta1
- CVE-2012-3376DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out tMaven · org.apache.hadoop:hadoop-client · fixed in 2.0.1-alpha
- CVE-2012-2138The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attemMaven · org.apache.sling:org.apache.sling.servlets.post · fixed in 2.1.2
- CVE-2012-2098Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons CMaven · org.apache.commons:commons-compress · fixed in 1.4.1
- CVE-2012-1826dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.Maven · com.dotcms:dotcms · fixed in 1.9.5.1
- CVE-2012-1574The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, Maven · org.apache.hadoop:hadoop-main · fixed in 0.23.2, 1.0.2
- CVE-2012-0324Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.454, 1.424.5
- CVE-2012-0325Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.Maven · org.jenkins-ci.main:jenkins-core · fixed in 1.454, 1.424.5
- CVE-2012-0838Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attacMaven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.2.3.1
- CVE-2012-1006Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script Maven · org.apache.struts:struts2-parent · fixed in 2.1.2, 2.2.3.1
- CVE-2011-4314message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay FMaven · org.openid4java:openid4java · fixed in 0.9.6