Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2011-1475The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read Maven · org.apache.tomcat:tomcat · fixed in 7.0.12
- CVE-2011-1088Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restricMaven · org.apache.tomcat:tomcat · fixed in 7.0.10
- CVE-2011-1419Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote Maven · org.apache.tomcat:tomcat · fixed in 7.0.11
- CVE-2011-0013Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, andMaven · org.apache.tomcat:tomcat · fixed in 5.5.32, 6.0.30, 7.0.6
- CVE-2010-4476The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update Maven · org.apache.tomcat:tomcat · fixed in 7.0.7, 6.0.32, 5.5.33
- CVE-2011-0533Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 andMaven · org.apache.archiva:archiva, org.apache.continuum:continuum · fixed in 1.3.4, 1.3.7
- CVE-2010-3718Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-Maven · org.apache.tomcat:tomcat · fixed in 7.0.4, 6.0.30, 5.5.30
- CVE-2011-0534Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP Maven · org.apache.tomcat:tomcat · fixed in 6.0.32, 7.0.8
- CVE-2010-3708The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.Maven · org.drools:drools-core · fixed in 4.0.7
- CVE-2010-4408Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's Maven · org.apache.archiva:archiva · fixed in 1.3.2
- CVE-2010-4172Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.Maven · org.apache.tomcat:tomcat · fixed in 7.0.5
- CVE-2010-4312The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote aMaven · org.apache.tomcat:tomcat · fixed in 6.0.35
- CVE-2010-3863Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, whicMaven · org.apache.shiro:shiro-root · fixed in 1.1.0
- CVE-2010-3700VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Maven · org.acegisecurity:acegi-security, org.springframework.security:spring-security-core · fixed in 2.0.6, 3.0.4
- CVE-2010-2057shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State wiMaven · org.apache.myfaces.core:myfaces-impl, org.apache.myfaces.shared:myfaces-shared-core · fixed in 1.1.8, 1.2.9, 2.0.1
- CVE-2010-2076Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, AMaven · org.apache.cxf:cxf-rt-frontend-jaxrs · fixed in 2.0.13, 2.1.10, 2.2.9
- CVE-2010-1870The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and poMaven · org.apache.struts:struts2-core · fixed in 2.2.1
- CVE-2009-4269The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformatioMaven · org.apache.derby:derby · fixed in 10.6.1.0
- CVE-2010-2227Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, whichMaven · org.apache.tomcat:tomcat · fixed in 7.0.2, 5.5.30, 6.0.28
- CVE-2010-1632Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9Maven · org.apache.axis2.wso2:axis2 · fixed in 1.5.2
- CVE-2010-1622SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute aMaven · org.springframework:spring · fixed in 2.5.7, 3.0.3
- CVE-2010-2274Multiple open redirect vulnerabilities in Dojo 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x befMaven · org.dojotoolkit:dojo · fixed in 1.0.3, 1.1.2, 1.2.4 and more
- CVE-2010-2103Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.Maven · org.apache.axis2.wso2:axis2 · fixed in 1.6.0
- CVE-2010-2086Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted Maven · org.apache.myfaces.core:myfaces-core-module
- CVE-2010-1587The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a /Maven · org.apache.activemq:activemq-web-console · fixed in 5.3.2
- CVE-2010-1157Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by Maven · org.apache.tomcat:tomcat · fixed in 5.5.30, 6.0.28
- CVE-2010-0684Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inMaven · org.apache.activemq:activemq-parent · fixed in 5.3.1
- CVE-2010-1244Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijacMaven · org.apache.activemq:activemq-parent · fixed in 5.3.1
- CVE-2009-2693Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrMaven · org.apache.tomcat:tomcat · fixed in 5.5.29, 6.0.24
- CVE-2009-2901The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase filesMaven · org.apache.tomcat:tomcat · fixed in 5.5.29, 6.0.24