Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-3750The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when thnpm · deep-extend · fixed in 0.5.1
- CVE-2018-3751The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object whenpm · merge-recursive
- CVE-2018-3752The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when npm · merge-options · fixed in 1.0.1
- CVE-2018-3753The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when npm · merge-object
- CVE-2018-3754Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of usernpm · query-mysql
- CVE-2018-1000534Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow npm · joplin · fixed in 1.0.90
- CVE-2018-11537Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of thnpm · angular-jwt · fixed in 0.1.10
- CVE-2018-11647index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.npm · oauth2orize-fprm · fixed in 0.2.1
- CVE-2018-12457expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.npm · express-cart · fixed in 1.1.6
- CVE-2018-5158The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a craftenpm · pdfjs-dist · fixed in 2.0.550, 1.10.100
- CVE-2018-3758Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.npm · express-cart · fixed in 1.1.7
- CVE-2017-16056mssql.js was a malicious module published with the intent to hijack environment variables.npm · mssql.js
- CVE-2017-16057nodemssql was a malicious module published with the intent to hijack environment variables.npm · nodemssql
- CVE-2017-16058gruntcli was a malicious module published with the intent to hijack environment variables.npm · gruntcli
- CVE-2017-16059mssql-node was a malicious module published with the intent to hijack environment variables.npm · mssql-node
- CVE-2017-16060babelcli was a malicious module published with the intent to hijack environment variables.npm · babelcli
- CVE-2017-16063node-opensl was a malicious module published with the intent to hijack environment variables.npm · node-opensl
- CVE-2017-16064node-openssl was a malicious module published with the intent to hijack environment variables.npm · node-openssl
- CVE-2017-16065openssl.js was a malicious module published with the intent to hijack environment variables.npm · openssl.js
- CVE-2017-16066opencv.js was a malicious module published with the intent to hijack environment variables.npm · opencv.js
- CVE-2017-16067node-opencv was a malicious module published with the intent to hijack environment variables.npm · node-opencv
- CVE-2017-16068ffmepg was a malicious module published with the intent to hijack environment variables.npm · ffmepg
- CVE-2017-16069nodeffmpeg was a malicious module published with the intent to hijack environment variables.npm · nodeffmpeg
- CVE-2017-16070nodecaffe was a malicious module published with the intent to hijack environment variables.npm · nodecaffe
- CVE-2017-16071nodemailer-js was a malicious module published with the intent to hijack environment variables.npm · nodemailer-js
- CVE-2017-16072nodemailer.js was a malicious module published with the intent to hijack environment variables.npm · nodemailer.js
- CVE-2017-16073noderequest was a malicious module published with the intent to hijack environment variables.npm · noderequest
- CVE-2017-16074crossenv was a malicious module published with the intent to hijack environment variables.npm · crossenv
- CVE-2017-16075http-proxy.js was a malicious module published with the intent to hijack environment variables.npm · http-proxy.js
- CVE-2017-16076proxy.js was a malicious module published with the intent to hijack environment variables.npm · proxy.js