Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2011-3375Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving requeMaven · org.apache.tomcat:tomcat · fixed in 6.0.35, 7.0.22
- CVE-2012-0022Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which alloMaven · org.apache.tomcat:tomcat · fixed in 5.5.35, 6.0.34, 7.0.23
- CVE-2011-1184The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does notMaven · org.apache.tomcat:tomcat · fixed in 5.5.34, 6.0.33, 7.0.12
- CVE-2011-5062The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does notMaven · org.apache.tomcat:tomcat · fixed in 5.5.34, 6.0.33, 7.0.12
- CVE-2011-5063The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does notMaven · org.apache.tomcat:tomcat · fixed in 5.5.34, 6.0.33, 7.0.12
- CVE-2011-5064DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, anMaven · org.apache.tomcat:tomcat · fixed in 5.5.34, 6.0.33, 7.0.12
- CVE-2012-0391The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception haMaven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.2.3.1
- CVE-2012-0392The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to Maven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.2.3.1
- CVE-2012-0393The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attacMaven · org.apache.struts.xwork:xwork-core, org.apache.struts:struts2-core · fixed in 2.2.3.1, 2.3.1.1
- CVE-2012-0394The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrarMaven · org.apache.struts.xwork:xwork-core · fixed in 2.3.18
- CVE-2011-4858Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the abiliMaven · org.apache.tomcat:tomcat · fixed in 5.5.35, 6.0.35, 7.0.23
- CVE-2011-4905Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sMaven · org.apache.activemq:activemq-core · fixed in 5.6.0
- CVE-2011-4461Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably,Maven · org.eclipse.jetty:jetty-server · fixed in 8.1.0.RC4
- CVE-2011-5034Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predicMaven · org.apache.geronimo:geronimo · fixed in 2.2.1
- CVE-2011-5036Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trMaven · org.jruby:jruby-parent · fixed in 1.6.5.1
- CVE-2011-4344Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone contaMaven · org.jenkins-ci.main:jenkins-core · fixed in 1.409.3, 1.438
- CVE-2011-4457OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtainMaven · com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer · fixed in 88
- CVE-2011-2894Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize oMaven · org.springframework.security:spring-security-core, org.springframework:spring-core · fixed in 3.0.6, 2.0.7
- CVE-2011-1411Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bMaven · org.opensaml:opensaml · fixed in 2.4.3, 2.5.1
- CVE-2011-3190Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibMaven · org.apache.tomcat:tomcat · fixed in 7.0.21, 6.0.34, 5.5.34
- CVE-2011-2481Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local userMaven · org.apache.tomcat:tomcat · fixed in 7.0.17
- CVE-2011-2526Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connectorMaven · org.apache.tomcat:tomcat · fixed in 5.5.34, 6.0.33, 7.0.19
- CVE-2011-1498Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization heMaven · org.apache.httpcomponents:httpclient · fixed in 4.1.1
- CVE-2011-2204Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries contaiMaven · org.apache.tomcat:tomcat · fixed in 5.5.34, 6.0.33, 7.0.19
- CVE-2011-1582Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured thMaven · org.apache.tomcat:tomcat · fixed in 7.0.14
- CVE-2011-1772Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWoMaven · org.apache.struts:struts2-core · fixed in 2.2.3
- CVE-2011-2087Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts Maven · org.apache.struts:struts2-parent · fixed in 2.2.3
- CVE-2011-2088XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive Maven · org.apache.struts.xwork:xwork-core · fixed in 2.2.2
- CVE-2011-1571Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache TomcaMaven · com.liferay.portal:portal-service · fixed in 6.0.6-ga
- CVE-2011-1183Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypassMaven · org.apache.tomcat:tomcat · fixed in 7.0.12