Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-19919Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.npm · handlebars · fixed in 4.3.0, 3.0.8
- CVE-2016-1000229swagger-ui has XSS in key namesnpm · swagger-ui · fixed in 2.2.1
- CVE-2019-15596A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within tnpm · statics-server
- CVE-2019-15597A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.npm · node-df
- CVE-2019-15598A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the cnpm · tree-kill · fixed in 1.2.2
- CVE-2019-15599A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the npm · tree-kill · fixed in 1.2.2
- CVE-2019-15600A Path traversal exists in http_server which allows an attacker to read arbitrary system files.npm · http_server
- CVE-2019-10773In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specianpm · yarn · fixed in 1.22.0
- CVE-2019-16777Arbitrary File Overwrite in npm CLInpm · npm · fixed in 6.13.4
- CVE-2019-16776Unauthorized File Access in npm CLI before before version 6.13.3npm · npm · fixed in 6.13.3
- CVE-2019-16775Unauthorized File Access in npm CLI before before version 6.13.3npm · npm · fixed in 6.13.3
- CVE-2019-19771The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name.npm · lodahs
- CVE-2019-19729An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js.npm · bson-objectid
- CVE-2013-7371node-connects before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370npm · connect · fixed in 2.8.2
- CVE-2013-7370node-connect before 2.8.1 has XSS in the Sencha Labs Connect middlewarenpm · connect · fixed in 2.8.1
- CVE-2019-16772regular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-jsnpm · serialize-to-js · fixed in 3.0.1
- CVE-2019-10769safer-eval is a npm package to sandbox the he evaluation of code used within the eval function.npm · safer-eval
- CVE-2019-19609The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admnpm · strapi · fixed in 3.0.0-beta.17.8
- CVE-2019-16769Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)npm · serialize-javascript · fixed in 2.1.1
- CVE-2019-19596GitBook through 2.6.9 allows XSS via a local .md file.npm · gitbook
- CVE-2019-19507In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten vianpm · jpv · fixed in 2.1.1
- CVE-2019-10771Characters in the GET url path are not properly escaped and can be reflected in the server response.npm · iobroker.web · fixed in 2.4.10
- CVE-2019-16763XSS in Pannellum from 2.5.0 through 2.5.4npm · pannellum · fixed in 2.5.5
- CVE-2019-10767An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "adminnpm · iobroker.js-controller · fixed in 2.0.25
- CVE-2019-10765iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.npm · iobroker.admin · fixed in 3.6.12
- CVE-2019-10768In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__protonpm · angular · fixed in 1.7.9
- CVE-2016-1000236Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.npm · cookie-signature · fixed in 1.0.4
- CVE-2019-16762Validator parsing discrepancy due to string encoding in NPM slpjsnpm · slpjs · fixed in 0.21.4
- CVE-2019-16761Validator parsing discrepancy due to string encoding in NPM slp-validate 1.0.0npm · slp-validate · fixed in 1.0.1
- CVE-2019-18954Pomelo v2.2.5 allows external control of critical state data.npm · pomelo · fixed in 2.2.7