Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10568geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup.npm · geoip-lite-country · fixed in 1.1.4
- CVE-2016-10570pngcrush-installer is an installer for Pngcrush.npm · pngcrush-installer · fixed in 1.8.10
- CVE-2016-10573baryton-saxophone is a module to install and launch Selenium Server for Mac, Linux and Windows.npm · baryton-saxophone · fixed in 3.0.1
- CVE-2016-10577ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix.npm · ibm_db · fixed in 1.0.2
- CVE-2016-10578unicode loads unicode data downloaded from unicode.org into nodejs.npm · unicode · fixed in 9.0.0
- CVE-2016-10584dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS.npm · dalek-browser-chrome-canary
- CVE-2016-10586macaca-chromedriver is a Node.js wrapper for the selenium chromedriver.npm · macaca-chromedriver · fixed in 1.0.29
- CVE-2016-10589selenium-binaries downloads Selenium related binaries for your OS.npm · selenium-binaries · fixed in 0.15.0
- CVE-2016-10590cue-sdk-node is a Corsair Cue SDK wrapper for node.js.npm · cue-sdk-node
- CVE-2016-10591Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI.npm · prince · fixed in 1.4.7
- CVE-2016-10593ibapi is an Interactive Brokers API addon for NodeJS.npm · ibapi
- CVE-2016-10601webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver.npm · webdrvr
- CVE-2016-10611strider-sauce is Sauce Labs / Selenium support for Strider.npm · strider-sauce
- CVE-2016-10627scala-bin is a binary wrapper for Scala.npm · scala-bin
- CVE-2016-10635broccoli-closure is a Closure compiler plugin for Broccoli.npm · broccoli-closure · fixed in 1.3.1
- CVE-2016-10650ntfserver is a Network Testing Framework Server.npm · ntfserver
- CVE-2016-10658native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITMnpm · native-opencv
- CVE-2016-10659poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks.npm · poco
- CVE-2016-10666tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to Mnpm · tomita-parser
- CVE-2016-10674limbus-buildgen is a "build anywhere" build system.npm · limbus-buildgen · fixed in 0.1.1
- CVE-2016-10679selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver.npm · selenium-standalone-painful
- CVE-2016-10680adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources onpm · adamvr-geoip-lite
- CVE-2016-10681roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTPnpm · roslib-socketio
- CVE-2016-10682massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · massif
- CVE-2016-10698mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leavnpm · mystem-fix
- CVE-2017-16003windows-build-tools is a module for installing C++ Build Tools for Windows using npm.npm · windows-build-tools · fixed in 1.0.0
- CVE-2017-16010i18next is a language translation framework.npm · i18next · fixed in 3.4.4
- CVE-2017-16047mysqljs was a malicious module published with the intent to hijack environment variables.npm · mysqljs
- CVE-2017-16061tkinter was a malicious module published with the intent to hijack environment variables.npm · tkinter
- CVE-2017-16062node-tkinter was a malicious module published with the intent to hijack environment variables.npm · node-tkinter · fixed in 1.0.3