Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-3223Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.npm · node-red-dashboard · fixed in 2.26.2
- CVE-2020-28487Cross-site Scripting (XSS)npm · vis-timeline · fixed in 7.4.4
- CVE-2021-3190The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tnpm · async-git · fixed in 1.13.2
- CVE-2021-23326Command Injectionnpm · @graphql-tools/git-loader · fixed in 6.2.6
- CVE-2020-28482Cross-site Request Forgery (CSRF)npm · fastify-csrf · fixed in 3.0.0
- CVE-2020-28479Denial of Service (DoS)npm · jointjs · fixed in 3.3.0
- CVE-2020-28480Prototype Pollutionnpm · jointjs · fixed in 3.3.0
- CVE-2020-28481Insecure Defaultsnpm · socket.io · fixed in 2.4.0
- CVE-2020-28472Prototype Pollutionnpm · @aws-sdk/shared-ini-file-loader, aws-sdk · fixed in 1.0.0-rc.9, 2.814.0
- CVE-2020-28478Prototype Pollutionnpm · gsap · fixed in 3.6.0
- CVE-2020-28477Prototype Pollutionnpm · immer · fixed in 8.0.1
- CVE-2020-28470Cross-site Scripting (XSS)npm · @scullyio/ng-lib, @scullyio/scully · fixed in 1.0.1, 1.0.9
- CVE-2021-21252Regular expression denial of service in jquery-validationnpm · jquery-validation · fixed in 1.19.3
- CVE-2021-1725Bot Framework SDK Information Disclosure Vulnerabilitynpm · botframework-connector · fixed in 4.7.3, 4.8.1, 4.9.4 and more
- CVE-2020-24025Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative dnpm · node-sass · fixed in 7.0.0
- CVE-2020-23849Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.npm · jsoneditor · fixed in 9.0.2
- CVE-2020-7784command_injectionnpm · ts-process-promises
- CVE-2020-7794Command Injectionnpm · buns
- CVE-2020-36048Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transportnpm · engine.io · fixed in 3.6.0
- CVE-2020-36049socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation npm · socket.io-parser · fixed in 3.3.2, 3.4.1
- CVE-2020-26768Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied inpunpm · formstone · fixed in 1.4.17
- CVE-2020-28464Remote Code Execution (RCE)npm · djv · fixed in 2.1.4
- CVE-2020-7771Prototype Pollutionnpm · asciitable.js · fixed in 1.0.3
- CVE-2020-26291Hostname spoofing in URI.jsnpm · urijs · fixed in 1.19.4
- CVE-2020-26296XSS in Veganpm · vega · fixed in 5.17.3
- CVE-2020-26288Parse Server stores password in plain textnpm · parse-server · fixed in 4.5.0
- CVE-2020-28280Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead tnpm · predefine · fixed in 0.1.3
- CVE-2020-28279Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may leadnpm · flattenizer · fixed in 1.1.1
- CVE-2020-28278Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remnpm · shvl · fixed in 2.0.2
- CVE-2020-28283Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead tnpm · libnested