Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-3757Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.npm · pdf-image · fixed in 2.0.0
- CVE-2018-3809Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be inpm · serve · fixed in 7.0.0
- CVE-2016-10574apk-parser3 is a module to extract Android Manifest info from an APK file.npm · apk-parser3 · fixed in 0.1.3
- CVE-2016-10575Kindlegen is a simple Node.js wrapper of the official kindlegen program.npm · kindlegen · fixed in 1.1.0
- CVE-2016-10576Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP, which leaves it vulnerable to MITM attnpm · fuseki · fixed in 1.0.1
- CVE-2016-10579Chromedriver is an NPM wrapper for selenium ChromeDriver.npm · chromedriver · fixed in 2.25.2
- CVE-2016-10580nodewebkit is an installer for node-webkit.npm · nodewebkit
- CVE-2016-10581Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity.npm · steroids
- CVE-2016-10582closurecompiler is a Closure Compiler for node.js.npm · closurecompiler
- CVE-2016-10583closure-utils is Utilities for Closure Library based projects.npm · closure-util
- CVE-2016-10585libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets.npm · libxl
- CVE-2016-10587wasdk is a toolkit for creating WebAssembly modules.npm · wasdk
- CVE-2016-10588nw is an installer for nw.js.npm · nw · fixed in 0.23.6-1
- CVE-2016-10592jser-stat is a JSer.info stat library.npm · jser-stat
- CVE-2016-10594ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net.npm · ipip
- CVE-2016-10595jdf-sass is a fork from node-sass, jdf use only.npm · jdf-sass
- CVE-2016-10596imageoptim is a Node.js wrapper for some images compression algorithms.npm · imageoptim
- CVE-2016-10597cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · cobalt-cli
- CVE-2016-10598arrayfire-js is a module for ArrayFire for the Node.js platform.npm · arrayfire-js
- CVE-2016-10599sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing.npm · sauce-connect
- CVE-2016-10600webrtc-native uses WebRTC from chromium project.npm · webrtc-native
- CVE-2016-10602haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks.npm · haxe · fixed in 5.0.10
- CVE-2016-10603air-sdk is a NPM wrapper for the Adobe AIR SDK.npm · air-sdk
- CVE-2016-10604dalek-browser-chrome is Google Chrome bindings for DalekJS.npm · dalek-browser-chrome
- CVE-2016-10605dalek-browser-ie is Internet Explorer bindings for DalekJS.npm · dalek-browser-ie
- CVE-2016-10606grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, whinpm · grunt-webdriver-qunit
- CVE-2016-10607openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer.npm · openframe-glslviewer
- CVE-2016-10608robot-js is a module for native system automation for node.js.npm · robot-js
- CVE-2016-10609chromedriver126 is chromedriver version 1.26 for linux OS.npm · chromedriver126
- CVE-2016-10610unicode-json is a unicode lookup table.npm · unicode-json · fixed in 2.0.0