Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16007node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based serversnpm · node-jose · fixed in 0.9.3
- CVE-2017-16008i18next is a language translation framework.npm · i18next · fixed in 1.10.3
- CVE-2017-16009ag-grid is an advanced data grid that is library agnostic.npm · ag-grid
- CVE-2017-16013hapi is a web and services application framework.npm · hapi · fixed in 16.1.1
- CVE-2017-16014Http-proxy is a proxying library.npm · http-proxy · fixed in 0.7.0
- CVE-2017-16015Forms is a library for easily creating HTML forms.npm · forms · fixed in 1.3.0
- CVE-2017-16016Sanitize-html is a library for scrubbing html input of malicious values.npm · sanitize-html · fixed in 1.11.4
- CVE-2017-16017sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.npm · sanitize-html · fixed in 1.2.3
- CVE-2017-16018Restify is a framework for building REST APIs.npm · restify · fixed in 4.1.0
- CVE-2017-16019GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc).npm · gitbook · fixed in 3.2.2
- CVE-2017-16020Summit is a node web framework.npm · summit
- CVE-2017-16021uri-js is a module that tries to fully implement RFC 3986.npm · uri-js · fixed in 3.0.0
- CVE-2017-16022Morris.js creates an svg graph, with labels that appear when hovering over a point.npm · morris.js
- CVE-2017-16023Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase.npm · decamelize · fixed in 1.1.2
- CVE-2017-16024The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9.npm · sync-exec
- CVE-2017-16025Nes is a websocket extension library for hapi.npm · nes · fixed in 6.4.1
- CVE-2017-16026Request is an http client.npm · request · fixed in 2.68.0
- CVE-2017-16028react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native.npm · randomatic · fixed in 3.0.0
- CVE-2017-16029hostr is a simple web server that serves up the contents of the current directory.npm · hostr · fixed in 2.3.6
- CVE-2017-16030Useragent is used to parse useragent headers.npm · useragent · fixed in 2.1.13
- CVE-2017-16031Socket.io is a realtime application framework that provides communication via websockets.npm · socket.io · fixed in 0.9.7
- CVE-2017-16035The hubl-server module is a wrapper for the HubL Development Server.npm · hubl-server
- CVE-2017-16036`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`.npm · badjs-sourcemap-server
- CVE-2017-16037`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in thnpm · gomeplus-h5-proxy
- CVE-2017-16038`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" npm · f2e-server · fixed in 1.12.12
- CVE-2017-16039`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plnpm · hftp
- CVE-2017-16040gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attanpm · gfe-sass
- CVE-2017-16041ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.npm · ikst · fixed in 1.1.2
- CVE-2017-16042Growl adds growl notification support to nodejs.npm · growl · fixed in 1.10.0
- CVE-2017-16043Shout is an IRC client.npm · shout · fixed in 0.50.0