Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10612dalek-browser-ie-canary is Internet Explorer bindings for DalekJS.npm · dalek-browser-ie-canary
- CVE-2016-10613bionode-sra is a Node.js wrapper for SRA Toolkit.npm · bionode-sra
- CVE-2016-10614httpsync is a port of libcurl to node.js.npm · httpsync
- CVE-2016-10615curses is bindings for the native curses library, a full featured console IO library.npm · curses
- CVE-2016-10616openframe-image is an Openframe extension which adds support for images via fbi.npm · openframe-image
- CVE-2016-10617box2d-native downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.npm · box2d-native
- CVE-2016-10618node-browser is a wrapper webdriver by nodejs.npm · node-browser
- CVE-2016-10619pennyworth is a natural language templating engine.npm · pennyworth
- CVE-2016-10620atom-node-module-installer installs node modules for atom-shell applications.npm · atom-node-module-installer
- CVE-2016-10621fibjs is a runtime for javascript applictions built on google v8 JS.npm · fibjs
- CVE-2016-10622nodeschnaps is a NodeJS compatibility layer for Java (Rhino).npm · nodeschnaps · fixed in 1.0.3
- CVE-2016-10623macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver.npm · macaca-chromedriver-zxa
- CVE-2016-10624selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary renpm · selenium-chromedriver
- CVE-2016-10625headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies.npm · headless-browser-lite · fixed in 2015.4.18-a
- CVE-2016-10626mystem3 is a NodeJS wrapper for the Yandex MyStem 3.npm · mystem3 · fixed in 1.0.8
- CVE-2016-10628selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver.npm · selenium-wrapper
- CVE-2016-10629nw-with-arm is a NW Installer including ARM-Build.npm · nw-with-arm
- CVE-2016-10630install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · install-g-test
- CVE-2016-10631jvminstall is a module for downloading and unpacking jvm to local system.npm · jvminstall
- CVE-2016-10632apk-parser2 is a module which extracts Android Manifest info from an APK file.npm · apk-parser2
- CVE-2016-10633dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG.npm · dwebp-bin
- CVE-2016-10634scala-standalone-bin is a Binary wrapper for ScalaJS.npm · scalajs-standalone-bin
- CVE-2018-3743Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.npm · hekto · fixed in 0.2.4
- CVE-2018-3746The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on thnpm · pdfinfojs · fixed in 0.4.1
- CVE-2018-3755XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element unpm · sexstatic
- CVE-2014-10064The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nenpm · qs · fixed in 1.0.0
- CVE-2014-10065Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing fornpm · remarkable · fixed in 1.4.1
- CVE-2014-10066Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal.npm · fancy-server · fixed in 0.1.4
- CVE-2015-9236Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at wnpm · hapi · fixed in 11.0.0
- CVE-2015-9238secure-compare 3.0.0 and below do not actually compare two strings properly.npm · secure-compare · fixed in 3.0.1