Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7617Prototype Pollutionnpm · ini-parser
- CVE-2019-2391JS-bson may incorrectly serialise some requestsnpm · bson · fixed in 1.1.4
- CVE-2020-5284Directory Traversal in Next.js versions below 9.3.2npm · next · fixed in 9.3.2
- CVE-2020-7610All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data.npm · bson · fixed in 1.1.4
- CVE-2020-8910Auth Bypass in Google's Closure-Librarynpm · google-closure-library · fixed in 20200315.0.0
- CVE-2020-10800lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the npm · lix
- CVE-2020-8134Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise intnpm · ghost · fixed in 3.10.0
- CVE-2020-8137Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attackernpm · blamer · fixed in 1.0.1
- CVE-2020-8135The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or npm · @uppy/companion · fixed in 1.9.3
- CVE-2020-8136Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests bnpm · fastify-multipart · fixed in 1.0.5
- CVE-2020-7608yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.npm · yargs-parser · fixed in 13.1.2, 15.0.1, 18.1.1 and more
- CVE-2020-7603closure-compiler-stream through 0.1.15 allows execution of arbitrary commands.npm · closure-compiler-stream
- CVE-2020-7607gulp-styledocco through 0.0.3 allows execution of arbitrary commands.npm · gulp-styledocco
- CVE-2020-7605gulp-tape through 1.0.0 allows execution of arbitrary commands.npm · gulp-tape
- CVE-2020-7606docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands.npm · docker-compose-remote-api
- CVE-2020-7604pulverizr through 0.7.0 allows execution of arbitrary commands.npm · pulverizr
- CVE-2020-7602node-prompt-here through 1.0.1 allows execution of arbitrary commands.npm · node-prompt-here
- CVE-2020-7601gulp-scss-lint through 1.0.0 allows execution of arbitrary commands.npm · gulp-scss-lint
- CVE-2019-15608The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cacnpm · yarn · fixed in 1.19.0
- CVE-2020-8141The dot package v1.1.2 uses Function() to compile templates.npm · dot · fixed in 1.1.3
- CVE-2020-10544An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11.npm · primefaces · fixed in 8.0
- CVE-2020-7600querymen prior to 2.1.4 allows modification of object properties.npm · querymen · fixed in 2.1.4
- CVE-2019-10808utilitify prior to 1.0.3 allows modification of object properties.npm · utilitify · fixed in 1.0.3
- CVE-2020-7598minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.npm · minimist · fixed in 0.2.1, 1.2.3
- CVE-2019-10807Blamer versions prior to 1.0.1 allows execution of arbitrary commands.npm · blamer · fixed in 1.0.1
- CVE-2020-5258Prototype pollution in dojonpm · dojo · fixed in 1.11.10, 1.12.8, 1.13.7 and more
- CVE-2020-5259Prototype Pollution in Dojoxnpm · dojox · fixed in 1.11.10, 1.12.8, 1.13.7 and more
- CVE-2019-17636In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/minnpm · @theia/mini-browser · fixed in 0.16.0
- CVE-2019-10806vega-util prior to 1.13.1 allows manipulation of object prototype.npm · vega-util · fixed in 1.13.1
- CVE-2020-9281A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitranpm · ckeditor4 · fixed in 4.14.0