Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7715Prototype Pollutionnpm · deep-get-set · fixed in 1.1.1
- CVE-2020-7716Prototype Pollutionnpm · deeps
- CVE-2020-7713Prototype Pollutionnpm · arr-flatten-unflatten
- CVE-2020-8244A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even tynpm · bl · fixed in 1.2.3, 2.2.1, 3.0.1 and more
- CVE-2020-7712Command Injectionnpm · json · fixed in 10.0.0
- CVE-2020-15156XSS due to lack of CSRF validation for replying/publishingnpm · nodebb-plugin-blog-comments · fixed in 0.7.0
- CVE-2020-13410An issue was discovered in MoscaJS Aedes 0.42.0.npm · aedes · fixed in 0.42.1
- CVE-2020-24653secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICnpm · expo · fixed in 9.1.0
- CVE-2020-7710Sandbox Escapenpm · safe-eval
- CVE-2020-15119DOM-based XSS in auth0-locknpm · auth0-lock · fixed in 11.26.3
- CVE-2020-7708Prototype Pollutionnpm · @irrelon/path, irrelon-path · fixed in 4.7.0
- CVE-2020-7707Prototype Pollutionnpm · property-expr · fixed in 2.0.3
- CVE-2020-7706Prototype Pollutionnpm · connie-lang · fixed in 0.1.1
- CVE-2020-15152Server-Side Request Forgery in ftp-srvnpm · ftp-srv · fixed in 2.19.6, 3.1.2, 4.3.4
- CVE-2020-7704Prototype Pollutionnpm · linux-cmdline · fixed in 1.0.1
- CVE-2020-7703Prototype Pollutionnpm · nis-utils
- CVE-2020-7702Prototype Pollutionnpm · templ8
- CVE-2020-7701Prototype Pollutionnpm · madlib-object-utils · fixed in 0.1.7
- CVE-2020-7700Prototype Pollutionnpm · phpjs
- CVE-2020-12648A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configurnpm · tinymce · fixed in 4.9.11, 5.4.1
- CVE-2020-17480TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboardnpm · tinymce · fixed in 4.9.7, 5.1.4
- CVE-2020-17479jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.npm · jpv · fixed in 2.2.2
- CVE-2020-15138Cross-Site Scripting in Prismnpm · prismjs · fixed in 1.21.0
- CVE-2020-15135CSRF vulnerability in save-servernpm · save-server · fixed in 1.0.7
- CVE-2020-15130False-positive validity for NFT1 genesis transactions in SLPJSnpm · slpjs · fixed in 0.27.4
- CVE-2020-15131False-positive validity for NFT1 genesis transactions in SLP Validatenpm · slp-validate · fixed in 1.2.2
- CVE-2020-8192A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (whenpm · fastify · fixed in 2.15.1
- CVE-2020-7699Prototype Pollutionnpm · express-fileupload · fixed in 1.1.9
- CVE-2020-15125Authorization header is not sanitized in an error object in auth0npm · auth0 · fixed in 2.27.1
- CVE-2020-7697Command Injectionnpm · mock2easy