Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7687Directory Traversalnpm · fast-http
- CVE-2020-7686Directory Traversalnpm · rollup-plugin-server
- CVE-2020-7681Directory Traversalnpm · marscode
- CVE-2020-7682Directory Traversalnpm · marked-tree
- CVE-2020-7683Directory Traversalnpm · rollup-plugin-server
- CVE-2020-8175Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a craftednpm · jpeg-js · fixed in 0.4.0
- CVE-2020-15126Information disclosure through Viewer query in parse-servernpm · parse-server · fixed in 4.3.0
- CVE-2020-6506Insufficient policy enforcement in WebView in Google Chrome on Android prior to 83.0.4103.106 allowed a remote attacker to bypass site isolanpm · react-native-webview · fixed in 11.0.0
- CVE-2018-21036Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hoonpm · sails-hook-sockets · fixed in 1.5.5
- CVE-2020-15123Command injection in codecov (npm package)npm · codecov · fixed in 3.7.1
- CVE-2020-7680docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS).npm · docsify · fixed in 4.11.4
- CVE-2020-8214A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.npm · servey · fixed in 3.3.2
- CVE-2020-8215A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it procnpm · canvas · fixed in 1.6.11
- CVE-2020-8205The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacnpm · @uppy/companion · fixed in 1.13.2, 2.0.0-alpha.5
- CVE-2020-7696Information Exposurenpm · react-native-fast-image · fixed in 8.3.0
- CVE-2020-7684Directory Traversalnpm · rollup-plugin-serve · fixed in 1.0.2
- CVE-2020-14000MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files wnpm · scratch-vm · fixed in 0.2.0-prerelease.20200714185213
- CVE-2020-15779A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js.npm · socket.io-file
- CVE-2020-15366An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2.npm · ajv · fixed in 6.12.3
- CVE-2020-8203Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.npm · lodash, lodash-es +5 · fixed in 4.17.19, 4.17.20
- CVE-2020-8186A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input tonpm · devcert · fixed in 1.1.2
- CVE-2020-15092Stored XSS in TimelineJS3npm · @knight-lab/timelinejs · fixed in 3.7.0
- CVE-2020-7693Denial of Service (DoS)npm · sockjs · fixed in 0.3.20
- CVE-2020-15095Sensitive information exposure through logs in npm clinpm · npm · fixed in 6.14.6
- CVE-2019-19935Froala Editor before 3.2.3 allows XSS.npm · froala-editor · fixed in 3.2.3
- CVE-2020-15096Context isolation bypass via Promise in Electronnpm · electron · fixed in 6.1.11, 7.2.4, 8.2.4
- CVE-2020-4075Arbitrary file read via window-open IPC in Electronnpm · electron · fixed in 7.2.4, 8.2.4
- CVE-2020-4076Context isolation bypass via leaked cross-context objects in Electronnpm · electron · fixed in 7.2.4, 8.2.4
- CVE-2020-4077Context isolation bypass via contextBridge in Electronnpm · electron · fixed in 7.2.4, 8.2.4
- CVE-2020-7690All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS).npm · jspdf · fixed in 2.0.0