Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-3787Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.npm · simplehttpserver · fixed in 0.2.1
- CVE-2018-11615This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1.npm · mosca · fixed in 2.8.2
- CVE-2018-3786A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command linenpm · egg-scripts · fixed in 2.8.1
- CVE-2018-15685GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandnpm · electron · fixed in 1.7.16, 1.8.8, 2.0.8 and more
- CVE-2018-15494In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.npm · dojox · fixed in 1.14.0
- CVE-2018-3783A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.npm · flintcms · fixed in 1.1.10
- CVE-2018-3784A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.npm · cryo
- CVE-2018-3785A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.npm · git-dummy-commit
- CVE-2018-3774Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Autnpm · url-parse · fixed in 1.4.3
- CVE-2018-3778Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.npm · aedes · fixed in 0.35.1
- CVE-2018-3772Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands.npm · whereis · fixed in 0.4.1
- CVE-2018-3773There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <= 3.9.2.npm · metascraper · fixed in 5.2.0
- CVE-2018-1002203unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot snpm · unzipper · fixed in 0.8.13
- CVE-2018-1002204adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slanpm · adm-zip · fixed in 0.4.11
- CVE-2018-1999024MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentnpm · mathjax · fixed in 2.7.4
- CVE-2018-3770A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the locnpm · markdown-pdf · fixed in 9.0.0
- CVE-2018-3771An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browsenpm · statics-server
- CVE-2018-14040In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.npm · bootstrap · fixed in 4.1.2, 3.4.0
- CVE-2018-14041In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.npm · bootstrap · fixed in 4.1.2
- CVE-2018-14042In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.npm · bootstrap, bootstrap-sass · fixed in 4.1.2, 3.4.0
- CVE-2018-8319A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, anpm · msrcrypto · fixed in 1.4.1
- CVE-2018-13863The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denialnpm · bson · fixed in 1.0.5
- CVE-2018-13797The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an execnpm · macaddress · fixed in 0.2.9
- CVE-2018-1000620Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result npm · cryptiles · fixed in 4.1.2, 3.1.3
- CVE-2018-13339Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute ofnpm · angular-redactor
- CVE-2018-3766Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.npm · buttle
- CVE-2018-3767`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.npm · memjs
- CVE-2018-3747The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious Jnpm · public · fixed in 0.1.4
- CVE-2018-3748There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5.npm · glance · fixed in 3.0.8
- CVE-2018-3749The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacknpm · deap · fixed in 1.0.1