Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-6342react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editonpm · react-dev-utils · fixed in 1.0.4, 2.0.2, 3.1.2 and more
- CVE-2017-18352Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.npm · rendertron · fixed in 1.1.0
- CVE-2017-18353Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users.npm · rendertron · fixed in 1.1.0
- CVE-2017-18354Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can bnpm · rendertron · fixed in 1.1.0
- CVE-2017-18355Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examinnpm · rendertron · fixed in 1.1.0
- CVE-2018-16478A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.npm · simplehttpserver
- CVE-2018-9207Arbitrary file upload in jQuery Upload File <= 4.0.2npm · jquery-file-upload · fixed in 4.0.5
- CVE-2018-19289An issue was discovered in Valine v1.3.3.npm · valine · fixed in 1.3.4
- CVE-2018-17960CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.npm · ckeditor · fixed in 4.11.0
- CVE-2018-19183ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" npm · ethereumjs-vm
- CVE-2018-19056pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.npm · editor.md
- CVE-2018-19057SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandlenpm · simplemde
- CVE-2018-16473A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.npm · takeapeek
- CVE-2018-16474A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.npm · tianma-static
- CVE-2018-16475A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.npm · knightjs
- CVE-2018-16472A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are npm · cached-path-relative · fixed in 1.0.2
- CVE-2018-16461A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the rannpm · libnmap · fixed in 0.4.16
- CVE-2018-16462A command injection vulnerability in the apex-publish-static-files npm module version <2.0.1 which allows arbitrary shell command execution npm · apex-publish-static-files · fixed in 2.0.1
- CVE-2018-16469The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype.npm · merge · fixed in 1.2.1
- CVE-2018-18282Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.npm · next · fixed in 7.0.2
- CVE-2018-9206Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0npm · blueimp-file-upload · fixed in 9.22.1
- CVE-2018-17574An issue was discovered in YMFE YApi 1.3.23.npm · yapi-vendor · fixed in 1.3.23
- CVE-2018-14730An issue was discovered in Browserify-HMR.npm · browserify-hmr · fixed in 0.4.0
- CVE-2018-14731An issue was discovered in HMRServer.js in Parcel parcel-bundler.npm · parcel-bundler · fixed in 1.10.0
- CVE-2018-14732An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6.npm · webpack-dev-server · fixed in 3.1.11
- CVE-2018-16982Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in Binpm · opencc · fixed in 1.1.2
- CVE-2018-16460A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.npm · ps · fixed in 1.0.0
- CVE-2018-16459An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.npm · exceljs · fixed in 1.6.0
- CVE-2016-1000232NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result npm · tough-cookie · fixed in 2.3.0
- CVE-2018-16330Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.npm · editor.md