Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10707jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.npm · jquery · fixed in 3.0.0
- CVE-2018-0114A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens unpm · node-jose · fixed in 0.11.0
- CVE-2017-1000491Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.npm · shiba · fixed in 1.1.1
- CVE-2017-1000427marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.npm · marked · fixed in 0.3.7
- CVE-2017-1000424Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loadinpm · electron · fixed in 1.7.6
- CVE-2017-1000451fs-git is a file system like api for git repository.npm · fs-git · fixed in 1.0.2
- CVE-2017-1000452An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers tonpm · samlify · fixed in 2.4.0-rc5
- CVE-2017-10910MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.npm · mqtt · fixed in 2.15.0
- CVE-2017-16897A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5.npm · passport-wsfed-saml2 · fixed in 3.0.5
- CVE-2016-10703A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, alnpm · ecstatic · fixed in 2.0.0
- CVE-2017-17068A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12.npm · auth0-js · fixed in 8.12.0
- CVE-2017-1001002math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine.npm · mathjs · fixed in 3.17.0
- CVE-2017-1001003math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creatinnpm · mathjs · fixed in 3.17.0
- CVE-2017-1001004typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine.npm · typed-function · fixed in 0.10.6
- CVE-2017-1000170jqueryFileTree 2.1.5 and older Directory Traversalnpm · jqueryfiletree
- CVE-2017-16877ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive infnpm · next · fixed in 2.4.1
- CVE-2017-1000188nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injectionnpm · ejs · fixed in 2.5.5
- CVE-2017-1000189nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()npm · ejs · fixed in 2.5.5
- CVE-2017-1000228nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() functionnpm · ejs · fixed in 2.5.5
- CVE-2017-1000220soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command executionnpm · pidusage · fixed in 1.1.5
- CVE-2017-1000219npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js usernpm · windows-cpu · fixed in 0.1.5
- CVE-2017-16570KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number Snpm · keystone · fixed in 4.0.0-beta.7
- CVE-2017-15881Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web scrinpm · keystone · fixed in 4.0.0-beta7
- CVE-2017-15878A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contactnpm · keystone · fixed in 4.0.0
- CVE-2017-15879CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in Keystonenpm · keystone · fixed in 4.0.0-beta7
- CVE-2013-7377The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POnpm · codem-transcode · fixed in 0.5.0
- CVE-2014-3741The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitnpm · printer · fixed in 0.0.2
- CVE-2014-3744Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (ennpm · st · fixed in 0.2.5
- CVE-2017-15010A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js.npm · tough-cookie · fixed in 2.3.3
- CVE-2015-3296Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vnpm · nodebb, nodebb-plugin-markdown · fixed in 0.70, 5.1.1