Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-20903The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScripnpm · @atlaskit/editor-core
- CVE-2019-20920Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution.npm · handlebars · fixed in 3.0.8, 4.5.3
- CVE-2019-20921bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS).npm · bootstrap-select · fixed in 1.13.6
- CVE-2019-20922Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching.npm · handlebars · fixed in 4.4.5
- CVE-2020-26149NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.npm · nats, nats.ws · fixed in 2.0.0-209, 1.0.0-111
- CVE-2020-7735Command Injectionnpm · ng-packagr · fixed in 10.1.1
- CVE-2020-15930An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.npm · joplin · fixed in 1.1.7
- CVE-2020-8237Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.npm · json-bigint · fixed in 1.0.0
- CVE-2020-8158Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further npm · typeorm · fixed in 0.2.25
- CVE-2020-7733Regular Expression Denial of Service (ReDoS)npm · ua-parser-js · fixed in 0.7.22
- CVE-2020-24660An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used.npm · lemonldap-ng-handler · fixed in 0.5.2
- CVE-2020-15168File size limit bypass in node-fetchnpm · node-fetch · fixed in 2.6.1, 3.0.0-beta.9
- CVE-2018-17145Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction npm · bcoin · fixed in 1.0.2
- CVE-2020-1913An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allowsnpm · hermes-engine · fixed in 0.5.2
- CVE-2020-1912An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835npm · hermes-engine · fixed in 0.5.2
- CVE-2020-7730Command Injectionnpm · bestzip · fixed in 2.1.7
- CVE-2020-1911A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prnpm · hermes-engine · fixed in 0.5.2
- CVE-2020-7729Arbitrary Code Executionnpm · grunt · fixed in 1.3.0
- CVE-2020-7725Prototype Pollutionnpm · worksmith
- CVE-2020-7726Prototype Pollutionnpm · safe-object2
- CVE-2020-7727Prototype Pollutionnpm · gedi
- CVE-2020-7723Prototype Pollutionnpm · promisehelpers
- CVE-2020-7724Prototype Pollutionnpm · tiny-conf
- CVE-2020-7721Prototype Pollutionnpm · node-oojs
- CVE-2020-7722Prototype Pollutionnpm · nodee-utils · fixed in 1.2.3
- CVE-2020-7720Prototype Pollutionnpm · node-forge · fixed in 0.10.0
- CVE-2020-7719Prototype Pollutionnpm · locutus · fixed in 2.0.12
- CVE-2020-7717Prototype Pollutionnpm · dot-notes
- CVE-2020-7718Prototype Pollutionnpm · gammautils
- CVE-2020-7714Prototype Pollutionnpm · confucious