Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-1915An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attacnpm · hermes-engine · fixed in 0.7.2
- CVE-2020-7752Command Injectionnpm · systeminformation · fixed in 4.27.11
- CVE-2020-7751Prototype Pollutionnpm · pathval · fixed in 1.1.1
- CVE-2020-15270Improper session expiration in Parse Servernpm · parse-server · fixed in 4.4.0
- CVE-2020-27664admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.npm · strapi · fixed in 3.2.5
- CVE-2020-27665In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.npm · strapi-plugin-content-type-builder · fixed in 3.2.5
- CVE-2020-27666Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.npm · strapi-plugin-content-manager · fixed in 3.2.5
- CVE-2020-7750Cross-site Scripting (XSS)npm · scratch-svg-renderer · fixed in 0.2.0-prerelease.20201019174008
- CVE-2020-7749Server-side Request Forgery (SSRF)npm · osm-static-maps · fixed in 3.9.0
- CVE-2020-7748Prototype Pollutionnpm · @tsed/core · fixed in 5.65.7
- CVE-2020-7747Cross-site Scripting (XSS)npm · lightning-server
- CVE-2020-15256Prototype pollution in object-pathnpm · object-path · fixed in 0.11.5
- CVE-2020-15262Invalid integrity hashes in webpack-subresource-integritynpm · webpack-subresource-integrity · fixed in 1.5.1
- CVE-2020-7743Prototype Pollutionnpm · mathjs · fixed in 7.5.1
- CVE-2020-15242Open Redirect in Next.jsnpm · next · fixed in 9.5.4
- CVE-2020-1914A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fnpm · hermes-engine · fixed in 0.7.2
- CVE-2020-26870Cure53 DOMPurify before 2.0.17 allows mutation XSS.npm · dompurify · fixed in 2.0.17
- CVE-2020-7742Prototype Pollutionnpm · simpl-schema · fixed in 1.10.2
- CVE-2020-15215Context isolation bypass in Electronnpm · electron · fixed in 8.5.2, 9.3.1, 10.1.2 and more
- CVE-2020-15174Unpreventable top-level navigation in Electronnpm · electron · fixed in 8.5.1, 9.3.0, 10.0.1
- CVE-2020-24807The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execunpm · socket.io-file
- CVE-2020-7740Server-side Request Forgery (SSRF)npm · node-pdf-generator
- CVE-2020-7739Server-side Request Forgery (SSRF)npm · phantomjs-seo
- CVE-2020-7741Cross-site Scripting (XSS)npm · hellojs · fixed in 1.18.6
- CVE-2020-7709Prototype Pollutionnpm · json-pointer · fixed in 0.6.1
- CVE-2017-18924oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE.npm · oauth2-server
- CVE-2020-7738Arbitrary Code Executionnpm · shiba
- CVE-2020-7737Prototype Pollutionnpm · safetydance
- CVE-2020-7736Prototype Pollutionnpm · bmoor · fixed in 0.8.12
- CVE-2020-15228Environment Variable Injection in GitHub Actionsnpm · @actions/core · fixed in 1.2.6