Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-18841Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.npm · chartkick · fixed in 3.2.0
- CVE-2019-18818strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-pnpm · strapi · fixed in 3.0.0-beta.17.5
- CVE-2019-17221PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI.npm · phantomjs
- CVE-2019-10749sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Ponpm · sequelize · fixed in 3.35.1
- CVE-2019-18608Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting npm · cezerin
- CVE-2019-10748Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped npm · sequelize · fixed in 3.35.1, 4.44.3, 5.8.11
- CVE-2019-18413In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via npm · class-validator · fixed in 0.14.0
- CVE-2019-17606The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content ofnpm · hexo-admin
- CVE-2019-10752Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escapnpm · sequelize · fixed in 4.44.3, 5.15.1
- CVE-2019-17625There is a stored XSS in Rambox 0.6.9 that can lead to code execution.npm · rambox
- CVE-2019-10760safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution.npm · safer-eval · fixed in 1.3.2
- CVE-2019-10759safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution.npm · safer-eval · fixed in 1.3.4
- CVE-2019-17592The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service.npm · csv-parse · fixed in 4.4.6
- CVE-2019-17495A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPOnpm · swagger-ui · fixed in 3.23.11
- CVE-2019-17426Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontypenpm · mongoose · fixed in 5.7.5, 4.13.21
- CVE-2019-10757knex.js versions before 0.19.5 are vulnerable to SQL Injection attack.npm · knex · fixed in 0.19.5
- CVE-2019-10756It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting rawnpm · node-red-dashboard · fixed in 2.17.0
- CVE-2017-18635An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web pagenpm · @novnc/novnc · fixed in 0.6.2
- CVE-2019-16728DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome anpm · dompurify · fixed in 2.0.3
- CVE-2019-15138The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/npm · html-pdf · fixed in 3.0.1
- CVE-2019-16303A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of npm · generator-jhipster-kotlin · fixed in 1.2.0
- CVE-2019-5485NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability.npm · gitlabhook
- CVE-2019-5484Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackenpm · bower · fixed in 1.8.8
- CVE-2019-5483Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.npm · seneca · fixed in 3.9.0
- CVE-2019-15952An issue was discovered in Total.js CMS 12.0.0.npm · total4
- CVE-2019-15953An issue was discovered in Total.js CMS 12.0.0.npm · total4
- CVE-2019-15954An issue was discovered in Total.js CMS 12.0.0.npm · total4
- CVE-2019-5480A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders.npm · statichttpserver
- CVE-2019-5479An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).npm · larvitbase-api · fixed in 0.5.5
- CVE-2019-15782WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.npm · webtorrent · fixed in 0.107.6