Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-3714node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read connpm · node-srv · fixed in 2.1.1
- CVE-2018-3715glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a mnpm · glance · fixed in 3.0.4
- CVE-2018-3716simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.npm · simplehttpserver · fixed in 0.1.0
- CVE-2018-3717connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.jnpm · connect · fixed in 2.14.0
- CVE-2018-3718serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.npm · serve · fixed in 6.5.2
- CVE-2018-3719mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious usenpm · mixin-deep · fixed in 1.3.1
- CVE-2018-3720assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious usnpm · assign-deep · fixed in 0.4.7
- CVE-2018-3721lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mernpm · lodash · fixed in 4.17.5
- CVE-2018-3722merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious usenpm · merge-deep · fixed in 3.0.1
- CVE-2018-3723defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious npm · defaults-deep · fixed in 0.2.4
- CVE-2018-3724general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious npm · general-file-server
- CVE-2018-3725hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read contenpm · hekto · fixed in 0.2.3
- CVE-2018-3726crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.npm · crud-file-server · fixed in 0.8.0
- CVE-2018-3727626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read contentnpm · 626
- CVE-2018-3729localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to renpm · localhost-now · fixed in 1.0.2
- CVE-2018-3730mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to reanpm · mcstatic
- CVE-2018-3731public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read npm · public · fixed in 0.1.3
- CVE-2018-3732resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special chnpm · resolve-path · fixed in 1.4.0
- CVE-2018-3735bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in templatenpm · bracket-template
- CVE-2018-3737sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.npm · sshpk · fixed in 1.13.2
- CVE-2018-3738protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.npm · protobufjs · fixed in 6.8.6, 5.0.3
- CVE-2018-3739https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized npm · https-proxy-agent · fixed in 2.2.0
- CVE-2016-10695The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings.npm · npm-test-sqlite3-trunk
- CVE-2016-10696windows-latestchromedriver downloads the latest version of chromedriver.exe.npm · windows-latestchromedriver
- CVE-2016-10697react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native.npm · react-native-baidu-voice-synthesizer
- CVE-2017-0928html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variablenpm · html-janitor
- CVE-2017-0930augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read conpm · augustine
- CVE-2017-0931html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.npm · html-janitor · fixed in 2.0.3
- CVE-2017-16005Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme".npm · http-signature · fixed in 0.10.0
- CVE-2017-16006Remarkable is a markdown parser.npm · remarkable · fixed in 1.7.0