Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2008-1753Cross-site scripting (XSS) vulnerability in system/workplace/admin/workplace/sessions.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers tMaven · org.opencms:opencms-core · fixed in 7.0.4
- CVE-2008-1728ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) Maven · org.igniterealtime.openfire:openfire, org.igniterealtime.openfire:parent · fixed in 3.5.0
- CVE-2008-1510Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers Maven · org.opencms:opencms-core · fixed in 7.0.4
- CVE-2008-1300Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewMaven · org.opencms:opencms-core · fixed in 7.0.5
- CVE-2008-1301Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7Maven · org.opencms:opencms-core · fixed in 7.0.5
- CVE-2008-1285Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web scMaven · com.sun.faces:jsf-api · fixed in 1.2.08
- CVE-2008-1045Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OMaven · org.opencms:opencms-core · fixed in 7.0.4
- CVE-2007-5333Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters Maven · org.apache.tomcat:tomcat · fixed in 6.0.15, 5.5.26, 4.1.37
- CVE-2007-6286Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty requeMaven · org.apache.tomcat:tomcat
- CVE-2008-0002Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter procesMaven · org.apache.tomcat:tomcat · fixed in 6.0.16
- CVE-2007-6672Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) Maven · org.mortbay.jetty:jetty · fixed in 6.1.7
- CVE-2007-5342The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict cMaven · org.apache.tomcat:tomcat-juli
- CVE-2007-6382The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute arbitrary Java code by using a robot to invoke the SwiMaven · net.sf.robocode:robocode.core · fixed in 1.5.1
- CVE-2007-5613Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web scMaven · org.mortbay.jetty:jetty · fixed in 6.1.6
- CVE-2007-5614Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers toMaven · org.mortbay.jetty:jetty · fixed in 6.1.6
- CVE-2007-5615CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP respMaven · org.mortbay.jetty:jetty · fixed in 6.1.6rc0
- CVE-2002-2272Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desMaven · org.apache.tomcat:tomcat
- CVE-2007-5461Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, unMaven · org.apache.tomcat:tomcat
- CVE-2006-7223PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, whicMaven · org.xwiki.platform:xwiki-platform-oldcore · fixed in 1.0B1
- CVE-2007-4724Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attacMaven · org.apache.tomcat:tomcat
- CVE-2007-4556Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all inpMaven · opensymphony:xwork · fixed in 1.2.3, 2.0.4
- CVE-2007-3382Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters Maven · org.apache.tomcat:tomcat
- CVE-2007-3385Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" characterMaven · org.apache.tomcat:tomcat
- CVE-2007-3384Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackMaven · org.apache.tomcat:tomcat
- CVE-2007-3383Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache TomcaMaven · org.apache.tomcat:tomcat
- CVE-2005-4849Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC commanMaven · org.apache.derby:derby · fixed in 10.1.2.1
- CVE-2006-7217Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authMaven · org.apache.derby:derby · fixed in 10.2.1.6
- CVE-2007-2449Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.Maven · org.apache.tomcat:tomcat
- CVE-2007-2450Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through Maven · org.apache.tomcat:tomcat · fixed in 4.1.37, 5.5.25, 6.0.14
- CVE-2007-1355Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.Maven · org.apache.tomcat:jsp-api, org.apache.tomcat:servlet-api · fixed in 4.1.37, 5.5.24, 6.0.11