Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7662websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking.npm · websocket-extensions · fixed in 0.1.4
- CVE-2020-7660serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".npm · serialize-javascript · fixed in 3.1.0
- CVE-2020-7650All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read.npm · snyk-broker · fixed in 4.73.1
- CVE-2020-7654All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure.npm · snyk-broker · fixed in 4.73.1
- CVE-2020-7648All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read.npm · snyk-broker · fixed in 4.72.2
- CVE-2020-7651All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read.npm · snyk-broker · fixed in 4.79.0
- CVE-2020-7652All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read.npm · snyk-broker · fixed in 4.80.0
- CVE-2020-7653All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read.npm · snyk-broker · fixed in 4.80.0
- CVE-2020-11079command injection fix in node-dns-syncnpm · dns-sync · fixed in 0.2.1
- CVE-2020-11059Exposure of Sensitive Information to an Unauthorized Actor in AEgirnpm · aegir · fixed in 21.10.1
- CVE-2020-7656jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.npm · jquery · fixed in 1.9.0
- CVE-2020-13110The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs throunpm · kerberos · fixed in 1.0.0
- CVE-2020-8149Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.npm · logkitty · fixed in 0.7.1
- CVE-2020-11072False-negative validation results in MINT transactions with invalid batonnpm · slp-validate · fixed in 1.2.1
- CVE-2020-11071False-negative validation results in MINT transactions with invalid batonnpm · slpjs · fixed in 0.27.2
- CVE-2020-7646curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.npm · curlrequest
- CVE-2020-7645All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systnpm · chrome-launcher · fixed in 0.13.2
- CVE-2020-11021HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Clientnpm · @actions/http-client · fixed in 1.0.8
- CVE-2020-11022jQuery has a potential XSS vulnerabilitynpm · jquery · fixed in 3.5.0
- CVE-2020-11023Potential XSS vulnerability in jQuerynpm · jquery · fixed in 3.5.0
- CVE-2020-7644fun-map through 3.3.1 is vulnerable to Prototype Pollution.npm · fun-map
- CVE-2020-7640pixl-class prior to 1.0.3 allows execution of arbitrary commands.npm · pixl-class · fixed in 1.0.3
- CVE-2020-7609node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands.npm · node-rules · fixed in 5.0.0
- CVE-2020-12265The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, npm · decompress · fixed in 4.2.1
- CVE-2020-7643paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution.npm · paypal-adaptive
- CVE-2020-7642lazysizes through 5.2.0 allows execution of malicious JavaScript.npm · lazysizes · fixed in 5.2.1
- CVE-2020-11887svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.npm · svg2png
- CVE-2020-11883In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests leanpm · storefront-api, vue-storefront-api · fixed in 1.0.0-rc3, 1.12.0
- CVE-2020-1026A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’snpm · msrcrypto · fixed in 1.5.8
- CVE-2020-11003CSRF and DNS Rebinding in Oasisnpm · @fraction/oasis · fixed in 2.15.0