Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2009-2902Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-direMaven · org.apache.tomcat:tomcat · fixed in 5.5.29, 6.0.24
- CVE-2009-4611Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attaMaven · org.mortbay.jetty:jetty · fixed in 6.1.23, 7.0.2
- CVE-2009-3555The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in thMaven · org.apache.tomcat:tomcat · fixed in 7.0.10, 6.0.32, 5.5.33
- CVE-2009-2625XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 Maven · xerces:xercesimpl · fixed in 2.10.0
- CVE-2009-0217The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle SecuMaven · org.apache.santuario:xmlsec · fixed in 1.4.3
- CVE-2008-5515Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathnameMaven · org.apache.tomcat:tomcat · fixed in 4.1.40, 5.5.28, 6.0.20
- CVE-2009-0033Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing arMaven · org.apache.tomcat:tomcat
- CVE-2009-0580Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackerMaven · org.apache.tomcat:tomcat · fixed in 4.1.40, 5.5.28, 6.0.19
- CVE-2009-0783Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used foMaven · org.apache.tomcat:tomcat · fixed in 6.0.20
- CVE-2009-1595The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to changeMaven · org.igniterealtime.openfire:parent · fixed in 3.6.4
- CVE-2009-1523Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attMaven · org.mortbay.jetty:jetty · fixed in 6.1.17, 7.0.0.M2
- CVE-2009-1190Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used wMaven · org.springframework:spring-core · fixed in 3.0.0.RELEASE
- CVE-2008-5518Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on WiMaven · org.apache.geronimo.plugins:console · fixed in 2.1.4
- CVE-2009-0038Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.Maven · org.apache.geronimo.plugins:console · fixed in 2.1.4
- CVE-2009-0039Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 throuMaven · org.apache.geronimo.plugins:console · fixed in 2.1.4
- CVE-2007-6726Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attacMaven · org.apache.struts:struts2-dojo-plugin · fixed in 0.4.3
- CVE-2008-2025Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSMaven · struts:struts · fixed in 1.2.9-162.31.1
- CVE-2008-6682Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to Maven · org.apache.struts:struts2-core · fixed in 2.0.11.1, 2.1.1
- CVE-2009-1275Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain Maven · org.apache.tiles:tiles-core · fixed in 2.1.2
- CVE-2007-6721The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impacMaven · bouncycastle:bcprov-jdk14, bouncycastle:bcprov-jdk15 +1 · fixed in 1.38
- CVE-2008-6504ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does notMaven · com.opensymphony:xwork · fixed in 2.0.6, 2.1.2
- CVE-2008-6505Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbiMaven · org.apache.struts:struts2-core · fixed in 2.0.12, 2.1.3
- CVE-2009-0781Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.Maven · org.apache.tomcat:tomcat · fixed in 6.0.20
- CVE-2008-4308The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error conMaven · org.apache.tomcat:tomcat · fixed in 4.1.35, 5.5.21
- CVE-2009-0026Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script Maven · org.apache.jackrabbit:jackrabbit · fixed in 1.5.2
- CVE-2008-5720Cross-site scripting (XSS) vulnerability in Mayaa before 1.1.23 allows remote attackers to inject arbitrary web script or HTML via unspecifiMaven · com.github.seasarorg.mayaa:mayaa · fixed in 1.1.23
- CVE-2008-2938Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking aMaven · org.apache.tomcat:tomcat · fixed in 4.1.39, 5.5.27, 6.0.18
- CVE-2008-1232Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remoteMaven · org.apache.tomcat:tomcat · fixed in 4.1.38, 5.5.27, 6.0.17
- CVE-2008-2370Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalizMaven · org.apache.tomcat:tomcat · fixed in 4.1.38, 5.5.27, 6.0.18
- CVE-2008-1947Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arMaven · org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat · fixed in 5.5.27, 6.0.18