Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10787im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument.npm · im-resize
- CVE-2019-10788im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument.npm · im-metadata
- CVE-2020-8116Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbinpm · dot-prop · fixed in 4.2.1, 5.1.1
- CVE-2020-8123A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbnpm · strapi-admin · fixed in 3.0.0-beta.18.4
- CVE-2020-8124Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypasnpm · url-parse · fixed in 1.4.5
- CVE-2020-8125Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code npm · klona · fixed in 1.1.1
- CVE-2019-20174Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.npm · auth0-lock · fixed in 11.21.0
- CVE-2020-5232Ethereum Name Service - Malicious takeover of previously owned ENS namesnpm · @ensdomains/ens · fixed in 0.4.0
- CVE-2015-8851node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impactnpm · node-uuid · fixed in 1.4.4
- CVE-2019-10783All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection.npm · lsof
- CVE-2019-15607A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Thnpm · node-red · fixed in 0.20.8
- CVE-2020-7596Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.npm · codecov · fixed in 3.6.2
- CVE-2020-5219Remote Code Execution in Angular Expressionsnpm · angular-expressions · fixed in 1.0.1
- CVE-2016-1000237sanitize-html before 1.4.3 has XSS.npm · sanitize-html · fixed in 1.4.3
- CVE-2019-10781In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used witnpm · schema-inspector · fixed in 1.6.9
- CVE-2019-0219A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specianpm · cordova-plugin-inappbrowser · fixed in 3.1.0
- CVE-2020-6948A remote code execution issue was discovered in HashBrown CMS through 1.3.3.npm · hashbrown-cms · fixed in 1.3.4
- CVE-2020-6836grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection.npm · hot-formula-parser · fixed in 3.0.1
- CVE-2019-10777In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function winpm · aws-lambda · fixed in 1.0.5
- CVE-2019-10778devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function.npm · devcert-sanscache · fixed in 0.4.7
- CVE-2019-10776In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl.npm · git-diff-apply · fixed in 0.22.2
- CVE-2014-3743Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrarynpm · marked · fixed in 0.3.1
- CVE-2020-5840An issue was discovered in HashBrown CMS before 1.3.2.npm · hashbrown-cms · fixed in 1.3.2
- CVE-2019-15602The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability innpm · fileview
- CVE-2019-15603The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directorynpm · seeftl
- CVE-2019-10775ecstatic have a denial of service vulnerability.npm · ecstatic · fixed in 4.1.3
- CVE-2019-14863There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web applinpm · angular · fixed in 1.5.0-beta.1
- CVE-2019-14862There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web applicationnpm · knockout · fixed in 3.5.0
- CVE-2019-20149ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonsnpm · kind-of · fixed in 6.0.3
- CVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.npm · mongo-express · fixed in 0.54.0