Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2005-4836The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allMaven · org.apache.tomcat:tomcat
- CVE-2006-7195Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remotMaven · org.apache.tomcat:tomcat · fixed in 5.5.18
- CVE-2006-7196Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0Maven · org.apache.tomcat:tomcat · fixed in 4.0.7, 4.1.32, 5.0.31 and more
- CVE-2007-1358Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remMaven · org.apache.tomcat:tomcat
- CVE-2007-2353Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installatiMaven · org.apache.axis:axis · fixed in 1.2
- CVE-2006-7197The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callbacMaven · org.apache.tomcat:tomcat
- CVE-2007-0450Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modulesMaven · org.apache.tomcat:tomcat · fixed in 5.5.22, 6.0.10
- CVE-2006-6969Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.utilMaven · org.eclipse.jetty:jetty-server · fixed in 4.2.27, 5.1.12, 6.0.2 and more
- CVE-2007-0184Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that Maven · org.directwebremoting:dwr · fixed in 1.1.4
- CVE-2007-0185Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unkMaven · org.directwebremoting:dwr · fixed in 1.1.4
- CVE-2006-3933Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script orMaven · org.opencms:opencms-core · fixed in 6.2.2
- CVE-2006-3934Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download aMaven · org.opencms:opencms-core · fixed in 6.2.2
- CVE-2006-3935system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allowMaven · org.opencms:opencms-core · fixed in 6.2.2
- CVE-2006-3936system/workplace/editors/editor.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to read the source code of arbitrary JMaven · org.opencms:opencms-core · fixed in 6.2.2
- CVE-2006-3835Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, Maven · org.apache.tomcat:tomcat · fixed in 5.5.17
- CVE-2006-2758Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ..Maven · org.mortbay.jetty:jetty
- CVE-2006-2759jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probablyMaven · org.mortbay.jetty:jetty · fixed in 6.0.0
- CVE-2006-2571Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitraMaven · org.opencms:opencms-core · fixed in 6.0.4
- CVE-2006-1546Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taMaven · struts:struts · fixed in 1.2.9
- CVE-2006-1547ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service vMaven · struts:struts · fixed in 1.2.9
- CVE-2006-1548Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache SoftMaven · struts:struts · fixed in 1.2.9
- CVE-2005-4703Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that containsMaven · org.apache.tomcat:tomcat
- CVE-2006-0254Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML viaMaven · geronimo:geronimo-console-standard · fixed in 1.1
- CVE-2005-4294Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via Maven · org.opencms:opencms-core · fixed in 6.0.3
- CVE-2004-2650Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error coMaven · org.apache.james:james-server · fixed in 2.2.0
- CVE-2005-3745Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary webMaven · org.apache.struts:struts-core
- CVE-2005-3747Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for Maven · org.mortbay.jetty:jetty · fixed in 5.1.6
- CVE-2005-3510Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requMaven · org.apache.tomcat:tomcat · fixed in 5.5.12
- CVE-2005-3164The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standaMaven · org.apache.tomcat:tomcat
- CVE-2004-2381HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) Maven · org.mortbay.jetty:jetty · fixed in 4.2.19