Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-5417A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote servnpm · serve · fixed in 7.1.3
- CVE-2019-9844simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.npm · simple-markdown · fixed in 0.4.4
- CVE-2018-20801In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a dennpm · highcharts · fixed in 6.1.0
- CVE-2019-9737Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.npm · editor.md
- CVE-2019-9115In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage.npm · irisnet-crypto · fixed in 1.1.7
- CVE-2019-8331In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.npm · bootstrap, bootstrap-sass · fixed in 4.3.1, 3.4.1
- CVE-2019-8903index.js in Total.js Platform before 3.2.3 allows path traversal.npm · total.js · fixed in 3.2.3
- CVE-2018-20164An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0.npm · uap-core · fixed in 0.6.0
- CVE-2016-1000282Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files.npm · haraka · fixed in 2.8.9
- CVE-2018-16479Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes npm · http-live-simulator · fixed in 1.0.7
- CVE-2018-16480A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sannpm · public · fixed in 0.1.4
- CVE-2018-16481A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absnpm · html-pages
- CVE-2018-16482A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive informanpm · mcstatic
- CVE-2018-16483A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrnpm · express-cart · fixed in 1.1.6
- CVE-2018-16484A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escnpm · m-server · fixed in 1.4.2
- CVE-2018-16485Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory trenpm · m-server · fixed in 1.4.1
- CVE-2018-16486A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prnpm · defaults-deep
- CVE-2018-16487A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into npm · lodash · fixed in 4.17.11
- CVE-2018-16489A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through itnpm · just-extend · fixed in 4.0.0
- CVE-2018-16490A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.protnpm · mpath · fixed in 0.5.1
- CVE-2018-16491A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Objnpm · node.extend · fixed in 1.1.7, 2.0.1
- CVE-2018-16492A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Onpm · extend · fixed in 3.0.2, 2.0.2
- CVE-2018-16493A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the servnpm · static-resource-server
- CVE-2018-16202Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-bnpm · cordova-plugin-ionic-webview · fixed in 2.2.0
- CVE-2019-0542A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution npm · xterm · fixed in 3.8.1, 3.9.2, 3.10.1
- CVE-2016-10735In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability thannpm · bootstrap, bootstrap-sass · fixed in 3.4.0, 4.0.0-beta.2
- CVE-2018-20676In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.npm · bootstrap, bootstrap-sass · fixed in 3.4.0
- CVE-2018-20677In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.npm · bootstrap, bootstrap-sass · fixed in 3.4.0
- CVE-2018-6333The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering.npm · nuclide · fixed in 0.290.0
- CVE-2018-6341React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time.npm · react-dom · fixed in 16.0.1, 16.1.2, 16.2.1 and more