Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-15657In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.npm · eslint-utils · fixed in 1.4.1
- CVE-2019-15658connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.npm · connect-pg-simple · fixed in 6.0.1
- CVE-2019-15479Status Board 1.1.81 has reflected XSS via dashboard.ts.npm · status-board · fixed in 1.1.82
- CVE-2019-15532CyberChef before 8.31.2 allows XSS in core/operations/TextEncodingBruteForce.mjs.npm · cyberchef · fixed in 8.31.3
- CVE-2019-15478Status Board 1.1.81 has reflected XSS via logic.ts.npm · status-board · fixed in 1.1.82
- CVE-2019-10750deeply is vulnerable to Prototype Pollution in versions before 3.1.0.npm · deeply · fixed in 3.1.0
- CVE-2019-10747set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1.npm · set-value · fixed in 2.0.1, 3.0.1
- CVE-2019-10746mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0.npm · mixin-deep · fixed in 1.3.2, 2.0.1
- CVE-2019-15482selectize-plugin-a11y before 1.1.0 has XSS via the msg field.npm · selectize-plugin-a11y · fixed in 1.1.0
- CVE-2019-9155A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryptionpm · openpgp · fixed in 4.3.0
- CVE-2019-9154Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.npm · openpgp · fixed in 4.2.0
- CVE-2019-9153Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatnpm · openpgp · fixed in 4.2.0
- CVE-2019-10745assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0.npm · assign-deep · fixed in 0.4.8, 1.0.1
- CVE-2019-14939An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js.npm · mysql · fixed in 2.18.0
- CVE-2019-14772verdaccio before 3.12.0 allows XSS.npm · verdaccio · fixed in 3.12.0
- CVE-2019-14653pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.npm · editor.md
- CVE-2019-14517pandao Editor.md 1.5.0 allows XSS via the Javascript: string.npm · editor.md
- CVE-2019-5457Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execunpm · min-http-server
- CVE-2019-5458Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execnpm · http-file-server
- CVE-2019-5448Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication datnpm · yarn · fixed in 1.17.3
- CVE-2019-1020013parse-server before 3.6.0 allows account enumeration.npm · parse-server · fixed in 3.6.0
- CVE-2019-1020012parse-server before 3.4.1 allows DoS after any POST to a volatile class.npm · parse-server · fixed in 3.4.1
- CVE-2019-10744Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.npm · lodash, lodash-amd +2 · fixed in 4.17.12, 4.17.13, 4.17.14 and more
- CVE-2019-13483Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing.npm · passport-sharepoint · fixed in 0.4.0
- CVE-2019-13970In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/databasenpm · antsword · fixed in 2.1.0
- CVE-2019-1010266lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption.npm · lodash, lodash-amd +1 · fixed in 4.17.11
- CVE-2019-1010091tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation.npm · tinymce · fixed in 4.9.10, 5.2.2
- CVE-2019-5447A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.npm · http-file-server
- CVE-2019-13506@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.npm · @nuxt/devalue · fixed in 1.2.3
- CVE-2019-5444Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder.npm · serve-here.js · fixed in 1.2.0