Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-5263Information disclosure through error objectnpm · auth0-js · fixed in 9.13.2
- CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2020-11610An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2020-11611An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2015-9545An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2020-7618sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.protonpm · sds · fixed in 4.0.0
- CVE-2020-7614npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any npm · npm-programmatic
- CVE-2020-7613clamscan through 1.2.0 is vulnerable to Command Injection.npm · clamscan · fixed in 1.3.0
- CVE-2020-7616express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution.npm · express-mock-middleware
- CVE-2020-7615fsa through 0.5.1 is vulnerable to Command Injection.npm · fsa
- CVE-2020-7639eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying propertiesnpm · @eivifj/dot · fixed in 1.0.3
- CVE-2020-7638confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying propertnpm · confinit · fixed in 0.4.0
- CVE-2020-7637class-transformer before 0.3.1 allow attackers to perform Prototype Pollution.npm · class-transformer · fixed in 0.3.1
- CVE-2020-7636adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.npm · adb-driver
- CVE-2020-7635compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.npm · compass-compile
- CVE-2020-7634heroku-addonpool through 0.1.15 is vulnerable to Command Injection.npm · heroku-addonpool · fixed in 0.1.16
- CVE-2020-7633apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argumentnpm · apiconnect-cli-plugins
- CVE-2020-7632node-mpv through 1.4.3 is vulnerable to Command Injection.npm · node-mpv
- CVE-2020-7631diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.npm · diskusage-ng
- CVE-2020-8147Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remotnpm · utils-extend
- CVE-2020-7630git-add-remote through 1.0.0 is vulnerable to Command Injection.npm · git-add-remote
- CVE-2020-7629install-package through 0.4.0 is vulnerable to Command Injection.npm · install-package
- CVE-2020-7628umount through 1.1.6 is vulnerable to Command Injection.npm · umount
- CVE-2020-7627node-key-sender through 1.0.11 is vulnerable to Command Injection.npm · node-key-sender
- CVE-2020-7626karma-mojo through 1.0.1 is vulnerable to Command Injection.npm · karma-mojo
- CVE-2020-7625op-browser through 1.0.6 is vulnerable to Command Injection.npm · op-browser
- CVE-2020-7623jscover through 1.0.0 is vulnerable to Command Injection.npm · jscover
- CVE-2020-7621strong-nginx-controller through 1.0.2 is vulnerable to Command Injection.npm · strong-nginx-controller
- CVE-2020-7619get-git-data through 1.3.1 is vulnerable to Command Injection.npm · get-git-data
- CVE-2020-7620pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' paramsnpm · pomelo-monitor