Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-7294ldapauth-fork before 2.3.3 allows remote attackers to perform LDAP injection attacks via a crafted username.npm · ldapauth, ldapauth-fork · fixed in 2.3.3
- CVE-2014-6393The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 lenpm · express · fixed in 3.11.0, 4.5.0
- CVE-2017-12581GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability.npm · electron · fixed in 1.6.8
- CVE-2015-8013s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass anpm · openpgp · fixed in 1.3.0
- CVE-2017-1000006Plotly, Inc.npm · plotly.js · fixed in 1.16.0
- CVE-2017-1000042Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenanpm · mapbox.js · fixed in 1.6.5, 2.1.7
- CVE-2017-1000043Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenanpm · mapbox.js · fixed in 1.6.6, 2.2.4
- CVE-2017-1000048the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS.npm · qs · fixed in 6.0.4, 6.1.2, 6.2.3 and more
- CVE-2017-7474It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.npm · keycloak-connect, keycloak-js · fixed in 3.1.0
- CVE-2016-6799Product: Apache Cordova Android 5.2.2 and earlier.npm · cordova-android · fixed in 6.0.0
- CVE-2016-5682Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.npm · swagger-ui · fixed in 2.2.1
- CVE-2016-7103Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via npm · jquery-ui · fixed in 1.12.0
- CVE-2017-6589EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration.npm · epiceditor
- CVE-2016-4947Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.npm · gethue
- CVE-2017-5954An issue was discovered in the serialize-to-js package 0.5.0 for Node.js.npm · serialize-to-js · fixed in 1.0.0
- CVE-2017-5858An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includnpm · converse.js · fixed in 1.0.7, 2.0.5
- CVE-2017-5941An issue was discovered in the node-serialize package 0.0.4 for Node.js.npm · node-serialize
- CVE-2013-7451The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.npm · validator · fixed in 1.1.0
- CVE-2013-7452The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascrinpm · validator · fixed in 1.1.0
- CVE-2013-7453The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related tonpm · validator · fixed in 1.1.0
- CVE-2013-7454The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via nested forbidden snpm · validator · fixed in 1.1.0
- CVE-2014-9772The validator package before 2.0.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via hex-encoded charanpm · validator · fixed in 2.0.0
- CVE-2015-8315The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "renpm · ms · fixed in 0.7.1
- CVE-2015-8854The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trinpm · marked · fixed in 0.3.4
- CVE-2015-8855The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka anpm · semver · fixed in 4.3.2
- CVE-2015-8856Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary webnpm · serve-index · fixed in 1.6.3
- CVE-2015-8857The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which mnpm · uglify-js · fixed in 2.4.24
- CVE-2015-8858The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse npm · uglify-js · fixed in 2.6.0
- CVE-2015-8859The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.npm · send · fixed in 0.11.1
- CVE-2015-8860The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.npm · tar · fixed in 2.0.0