Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16153gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.npm · gaoxuyan
- CVE-2018-3733crud-file-server node module before 0.9.0 suffers from a Path Traversal vulnerability due to incorrect validation of url, which allows a malnpm · crud-file-server · fixed in 0.9.0
- CVE-2018-3734stattic node module suffers from a Path Traversal vulnerability due to lack of validation of path, which allows a malicious user to read connpm · stattic · fixed in 0.3.0
- CVE-2018-3744The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.npm · html-pages
- CVE-2018-3745atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.npm · atob · fixed in 2.1.0
- CVE-2018-11093Cross-site scripting (XSS) vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web scnpm · @ckeditor/ckeditor5-link · fixed in 10.0.1
- CVE-2018-9861Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in npm · ckeditor-dev · fixed in 4.9.2
- CVE-2018-1000160RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js thnpm · @risingstack/protect
- CVE-2018-6874CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.npm · auth0-js · fixed in 9.0.0
- CVE-2018-3728hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' npm · hoek · fixed in 5.0.3, 4.2.1
- CVE-2018-1000136Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webnpm · electron · fixed in 1.7.13, 1.8.4, 2.0.0-beta.5
- CVE-2018-1000086NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateTonpm · pym.js · fixed in 1.3.2
- CVE-2018-1000096brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL cnpm · tiny-json-http · fixed in 7.0.0
- CVE-2018-1000118Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in npm · electron · fixed in 1.8.2-beta5
- CVE-2018-7307The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.npm · auth0-js · fixed in 9.3.0
- CVE-2017-18214The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnernpm · moment · fixed in 2.19.3
- CVE-2018-7560index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issuenpm · aws-lambda-multipart-parser · fixed in 0.1.2
- CVE-2018-7651index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionpm · ssri · fixed in 5.2.2
- CVE-2017-18197In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External npm · mxgraph · fixed in 3.7.6
- CVE-2018-7408An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgnpm · npm · fixed in 5.7.1
- CVE-2018-6591Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whethnpm · converse.js · fixed in 3.3.3
- CVE-2018-1000023Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpointnpm · insight-api
- CVE-2018-6835node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restnpm · ep_etherpad-lite · fixed in 1.6.3
- CVE-2018-6561dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.npm · dijit · fixed in 1.13.1
- CVE-2018-6464Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.npm · simditor
- CVE-2017-18077index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expandnpm · brace-expansion · fixed in 1.1.7
- CVE-2018-1000006GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specinpm · electron · fixed in 1.7.11, 1.6.16, 1.8.2-beta.4
- CVE-2018-6184ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.npm · next · fixed in 4.2.3
- CVE-2012-6708jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.npm · jquery · fixed in 1.9.0
- CVE-2015-9251jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType onpm · jquery · fixed in 1.12.2, 3.0.0