Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-5251Information disclosure in parse-servernpm · parse-server · fixed in 4.1.0
- CVE-2019-10801enpeem through 2.2.0 allows execution of arbitrary commands.npm · enpeem
- CVE-2019-10802giting version prior to 0.0.8 allows execution of arbritary commands.npm · giting
- CVE-2019-10803push-dir through 0.4.1 allows execution of arbritary commands.npm · push-dir
- CVE-2019-10804serial-number through 1.3.0 allows execution of arbritary commands.npm · serial-number
- CVE-2019-10805valib through 2.0.0 allows Internal Property Tampering.npm · valib
- CVE-2019-15609The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.npm · kill-port-process · fixed in 2.2.0
- CVE-2020-8127Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-npm · reveal.js · fixed in 3.9.2
- CVE-2020-8132Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructnpm · pdf-image
- CVE-2019-10799compile-sass prior to 1.0.5 allows execution of arbritary commands.npm · compile-sass · fixed in 1.0.5
- CVE-2019-10796rpi through 0.0.3 allows execution of arbritary commands.npm · rpi
- CVE-2019-10798rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution.npm · rdf-graph-array
- CVE-2020-8131Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead npm · yarn · fixed in 1.22.0
- CVE-2020-5243Denial of Service in uap-core when processing crafted User-Agent stringsnpm · uap-core · fixed in 0.7.3
- CVE-2019-10791promise-probe before 0.10.0 allows remote attackers to perform a command injection attack.npm · promise-probe · fixed in 0.1.10
- CVE-2019-10793dot-object before 2.1.3 is vulnerable to Prototype Pollution.npm · dot-object · fixed in 2.1.3
- CVE-2019-10792bodymen before 1.1.1 is vulnerable to Prototype Pollution.npm · bodymen · fixed in 1.1.1
- CVE-2019-10795undefsafe before 2.0.3 is vulnerable to Prototype Pollution.npm · undefsafe · fixed in 2.0.3
- CVE-2019-10794All versions of component-flatten are vulnerable to Prototype Pollution.npm · component-flatten
- CVE-2020-7597codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argumnpm · codecov · fixed in 3.6.5
- CVE-2020-9038Joplin through 1.0.184 allows Arbitrary File Read via XSS.npm · joplin · fixed in 1.2.1
- CVE-2019-10790taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-inpm · taffy, taffydb
- CVE-2020-8128An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitnpm · jsreport · fixed in 2.6.0
- CVE-2020-8129An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.npm · script-manager · fixed in 0.9.0
- CVE-2019-10785dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9.npm · dojox · fixed in 1.11.9, 1.12.7, 1.13.6 and more
- CVE-2013-7381libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.nnpm · libnotify · fixed in 1.0.4
- CVE-2013-7378scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.npm · hubot-scripts · fixed in 2.4.5
- CVE-2020-8823htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.npm · sockjs · fixed in 0.3.0
- CVE-2019-10789All versions of curling.js are vulnerable to Command Injection via the run function.npm · curling · fixed in 1.1.0
- CVE-2019-10786network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.npm · network-manager