Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7691Cross-site Scripting (XSS)npm · jspdf · fixed in 2.0.0
- CVE-2020-8176A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shopnpm · @shopify/koa-shopify-auth · fixed in 3.1.63
- CVE-2020-15500An issue was discovered in server.js in TileServer GL through 3.0.0.npm · tileserver-gl · fixed in 3.1.0
- CVE-2020-13619php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.npm · locutus
- CVE-2020-7688Command Injectionnpm · mversion · fixed in 2.0.1
- CVE-2020-7689Insecure Encryptionnpm · bcrypt · fixed in 5.0.0
- CVE-2020-15084Authorization bypass in express-jwtnpm · express-jwt · fixed in 6.0.0
- CVE-2020-15362wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executablenpm · wifiscanner
- CVE-2020-4072Log Forging in generator-jhipster-kotlinnpm · generator-jhipster-kotlin · fixed in 1.7.0
- CVE-2018-21268The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter.npm · traceroute
- CVE-2020-4066Command Injection in Limdu trainBatch functionnpm · limdu · fixed in 0.9.5
- CVE-2020-14966An issue was discovered in the jsrsasign package through 8.0.18 for Node.js.npm · jsrsasign · fixed in 8.0.19
- CVE-2020-14968An issue was discovered in the jsrsasign package before 8.0.17 for Node.js.npm · jsrsasign · fixed in 8.0.17
- CVE-2020-14967An issue was discovered in the jsrsasign package before 8.0.18 for Node.js.npm · jsrsasign · fixed in 8.0.18
- CVE-2020-13961Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global varnpm · strapi · fixed in 3.0.2
- CVE-2020-7679Prototype Pollutionnpm · casperjs
- CVE-2020-4059Command Injection in mversionnpm · mversion · fixed in 2.0.0
- CVE-2020-12827MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.npm · mjml · fixed in 4.6.3
- CVE-2017-18869A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintendednpm · chownr · fixed in 1.1.0
- CVE-2020-4051XSS in Dijit Editor's LinkDialog pluginnpm · dijit · fixed in 1.11.11, 1.12.9, 1.13.8 and more
- CVE-2020-4045Information disclosure in SSB-DBnpm · ssb-db · fixed in 20.0.1
- CVE-2020-7672mosc through 1.0.0 is vulnerable to Arbitrary Code Execution.npm · mosc
- CVE-2020-7673node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution.npm · node-extend
- CVE-2020-7674access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution.npm · access-policy
- CVE-2020-7675cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution.npm · cd-messenger
- CVE-2020-4038Reflected XSS in GraphQL Playgroundnpm · graphql-playground-html · fixed in 1.6.22
- CVE-2020-7676angular.js prior to 1.8.0 allows cross site scripting.npm · angular · fixed in 1.8.0
- CVE-2020-7661all versions of url-regex are vulnerable to Regular Expression Denial of Service.npm · url-regex
- CVE-2020-13822The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflnpm · elliptic · fixed in 6.5.3
- CVE-2020-4035DoS or local data modification via malicious record IDs in WatermelonDBnpm · @nozbe/watermelondb · fixed in 0.15.1, 0.16.2