Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10550sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server inpm · sequelize · fixed in 3.17.0
- CVE-2016-10552igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.npm · igniteui
- CVE-2016-10553sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server inpm · sequelize · fixed in 3.0.0
- CVE-2016-10554sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server inpm · sequelize · fixed in 1.7.0
- CVE-2016-10555Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent tnpm · jwt-simple · fixed in 0.3.1
- CVE-2016-10557appium-chromedriver is a Node.js wrapper around Chromedriver.npm · appium-chromedriver · fixed in 2.9.4
- CVE-2016-10560galenframework-cli is the node wrapper for the Galen Framework.npm · galenframework-cli · fixed in 2.3.1
- CVE-2016-10561Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`.npm · bitty
- CVE-2016-10562iedriver is an NPM wrapper for Selenium IEDriver.npm · iedriver · fixed in 3.0.0
- CVE-2016-10563During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP.npm · go-ipfs-dep · fixed in 0.4.4
- CVE-2016-10564apk-parser is a tool to extract Android Manifest info from an APK file.npm · apk-parser · fixed in 0.1.6
- CVE-2016-10565operadriver is a Opera Driver for Selenium.npm · operadriver · fixed in 0.2.3
- CVE-2016-10569embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags.npm · embedza · fixed in 1.2.4
- CVE-2016-10571bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP, whinpm · bkjs-wand · fixed in 0.3.2
- CVE-2016-10572mongodb-instance before 0.0.3 installs mongodb locally.npm · mongodb-instance · fixed in 0.0.3
- CVE-2014-10067paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the productionpm · paypal-ipn · fixed in 3.0.0
- CVE-2014-10068The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`npm · inert · fixed in 1.1.1
- CVE-2015-9235In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetnpm · jsonwebtoken · fixed in 4.2.2
- CVE-2015-9240Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matchednpm · keystone · fixed in 0.3.16
- CVE-2015-9241Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised.npm · hapi · fixed in 11.1.3
- CVE-2015-9242Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception.npm · ecstatic · fixed in 1.4.0
- CVE-2015-9243When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher levenpm · hapi · fixed in 11.1.4
- CVE-2015-9244Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.npm · mysql · fixed in 2.0.0-alpha8
- CVE-2016-10525When attempting to allow authentication mode `try` in hapi, hapi-auth-jwt2 version 5.1.1 introduced an issue whereby people could bypass autnpm · hapi-auth-jwt2 · fixed in 5.1.2
- CVE-2016-10551waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `containpm · waterline-sequel · fixed in 0.5.1
- CVE-2016-10556sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server inpm · sequelize · fixed in 3.20.0
- CVE-2016-10558aerospike is an Aerospike add-on module for Node.js.npm · aerospike · fixed in 2.4.2
- CVE-2016-10559selenium-download downloads the latest versions of the selenium standalone server and the chromedriver.npm · selenium-download · fixed in 2.0.7
- CVE-2016-10566install-nw is a module which quickly and robustly installs and caches NW.js.npm · install-nw · fixed in 1.1.5
- CVE-2016-10567product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information aboutnpm · product-monitor · fixed in 2.2.5