Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-28282Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code enpm · getobject · fixed in 1.0.0
- CVE-2020-28281Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and maynpm · set-object-value · fixed in 0.0.6
- CVE-2020-28276Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to renpm · deep-set
- CVE-2020-28277Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remotenpm · dset · fixed in 2.0.1
- CVE-2020-26289Regular expression Denial of Service in date-and-timenpm · date-and-time · fixed in 0.14.2
- CVE-2020-28448Prototype Pollutionnpm · multi-ini · fixed in 2.1.1
- CVE-2020-28460Prototype Pollutionnpm · multi-ini · fixed in 2.1.2
- CVE-2020-26274Command Injection Vulnerability in systeminformationnpm · systeminformation · fixed in 4.31.1
- CVE-2020-7781Command Injectionnpm · connection-tester · fixed in 0.2.1
- CVE-2020-28458Prototype Pollutionnpm · datatables.net · fixed in 1.10.22
- CVE-2020-28442Prototype Pollutionnpm · js-data · fixed in 3.0.10
- CVE-2020-35149lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., __proto__) can be copied during a merge or cnpm · mquery · fixed in 3.2.3
- CVE-2020-28439Command Injectionnpm · corenlp-js-prefab
- CVE-2020-28440Command Injectionnpm · corenlp-js-interface
- CVE-2020-7793Regular Expression Denial of Service (ReDoS)npm · ua-parser-js · fixed in 0.7.23
- CVE-2020-7792Prototype Pollutionnpm · mout · fixed in 1.2.3
- CVE-2020-7788Prototype Pollutionnpm · ini · fixed in 1.3.6
- CVE-2020-7789Command Injectionnpm · node-notifier · fixed in 8.0.1
- CVE-2020-7787Improper Authenticationnpm · react-adal · fixed in 0.5.1
- CVE-2020-26256Denial of service in fast-csvnpm · @fast-csv/parse, fast-csv · fixed in 4.3.6
- CVE-2020-28274Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remnpm · deepref
- CVE-2018-21270Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized bnpm · stringstream · fixed in 0.0.6
- CVE-2020-28273Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remonpm · set-in · fixed in 2.0.1
- CVE-2020-28272Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remonpm · keyget · fixed in 2.3.0
- CVE-2020-26245Prototype Pollution leading to Command Injection in systeminformationnpm · systeminformation · fixed in 4.30.5
- CVE-2020-7778Prototype Pollutionnpm · systeminformation · fixed in 4.30.2
- CVE-2020-7779Regular Expression Denial of Service (ReDoS)npm · djvalidator
- CVE-2020-26237Prototype Pollution in highlight.jsnpm · highlight.js · fixed in 9.18.2, 10.1.2
- CVE-2020-28360Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF.npm · private-ip · fixed in 2.0.0
- CVE-2020-7777Arbitrary Code Executionnpm · jsen