Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-13173fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite.npm · fstream · fixed in 1.0.12
- CVE-2019-13127An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products.npm · mxgraph · fixed in 4.0.1
- CVE-2019-5786Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memorynpm · puppeteer · fixed in 1.13.0
- CVE-2019-10157It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backnpm · keycloak-connect · fixed in 4.8.3
- CVE-2019-12313XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.npm · shave · fixed in 2.5.3
- CVE-2018-19048Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.npm · simditor · fixed in 2.3.22
- CVE-2019-12043In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demnpm · remarkable · fixed in 1.7.2
- CVE-2019-12041lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.npm · remarkable · fixed in 1.7.2
- CVE-2019-5437Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to npm · harp · fixed in 0.40.2
- CVE-2019-5438Path traversal using symlink in npm harp module versions <= 0.29.0.npm · harp · fixed in 0.40.3
- CVE-2019-10742Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after npm · axios · fixed in 0.18.1
- CVE-2019-5432A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.npm · mqtt-packet · fixed in 3.5.1, 4.1.3, 5.6.1 and more
- CVE-2018-20835A vulnerability was found in tar-fs before 1.16.2.npm · tar-fs · fixed in 1.16.2
- CVE-2018-20834A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).npm · tar · fixed in 4.4.2, 2.2.2
- CVE-2015-9286Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.npm · nodebb · fixed in 0.8.2
- CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototypnpm · jquery · fixed in 3.4.0
- CVE-2017-11429Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalnpm · saml2-js · fixed in 1.12.4, 2.0.2
- CVE-2019-11069Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.npm · sequelize · fixed in 5.3.0
- CVE-2019-11004In Materialize through 1.0.0, XSS is possible via the Toast feature.npm · @materializecss/materialize, materialize-css · fixed in 1.1.0-alpha
- CVE-2019-11003In Materialize through 1.0.0, XSS is possible via the Autocomplete feature.npm · @materializecss/materialize, materialize-css · fixed in 1.1.0-alpha
- CVE-2019-11002In Materialize through 1.0.0, XSS is possible via the Tooltip feature.npm · @materializecss/materialize, materialize-css · fixed in 1.1.0-alpha
- CVE-2019-5423Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a rnpm · http-live-simulator · fixed in 1.0.6
- CVE-2019-5422XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitnpm · buttle
- CVE-2019-10260Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).npm · total.js · fixed in 3.3.0-13
- CVE-2016-10744In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS.npm · select2 · fixed in 4.0.6
- CVE-2019-10061utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection.npm · opencv · fixed in 6.1.0
- CVE-2019-5414If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of thnpm · kill-port · fixed in 1.3.2
- CVE-2019-5413An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.npm · morgan · fixed in 1.9.1
- CVE-2019-5416A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remnpm · localhost-now
- CVE-2019-5415A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the vnpm · serve · fixed in 7.0.0