Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-8861The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a templanpm · handlebars · fixed in 4.0.0
- CVE-2015-8862mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template witnpm · mustache · fixed in 2.2.1
- CVE-2016-4055The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption)npm · moment · fixed in 2.11.2
- CVE-2016-7191The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recnpm · passport-azure-ad · fixed in 1.4.6, 2.0.1
- CVE-2016-3956The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 beforenpm · npm · fixed in 2.15.1, 3.8.3
- CVE-2016-4567Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, npm · mediaelement · fixed in 2.11.1
- CVE-2016-1202Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module inpm · electron · fixed in 0.33.5
- CVE-2016-2515Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1npm · hawk · fixed in 4.1.1, 3.1.3
- CVE-2016-2537The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attanpm · is-my-json-valid · fixed in 2.12.4
- CVE-2015-5654Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspenpm · dojo · fixed in 1.9.1
- CVE-2015-6584Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary npm · datatables · fixed in 1.10.10
- CVE-2015-5688Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files vianpm · geddy · fixed in 13.0.8
- CVE-2014-9682The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in thnpm · dns-sync · fixed in 0.1.1
- CVE-2015-1369SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the ordenpm · sequelize · fixed in 2.0.0-rc8
- CVE-2015-1370Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attnpm · marked · fixed in 0.3.3
- CVE-2015-1164Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirenpm · serve-static · fixed in 1.7.2
- CVE-2014-7193The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled,npm · crumb · fixed in 3.0.0
- CVE-2014-7192Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Denpm · syntax-error · fixed in 1.1.1
- CVE-2012-6662Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.1npm · jquery-ui · fixed in 1.10.0
- CVE-2010-5312Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inpm · jquery-ui · fixed in 1.10.0
- CVE-2014-7191The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of npm · qs · fixed in 1.0.0
- CVE-2014-6394visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allnpm · send · fixed in 0.8.4
- CVE-2014-7205Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framenpm · bassmaster · fixed in 1.5.2
- CVE-2014-4671Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.npm · hapi · fixed in 6.1.0
- CVE-2013-7379The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a string, which allows npm · tomato · fixed in 0.0.6
- CVE-2014-3742The hapi server framework 2.0.x and 2.1.x before 2.2.0 for Node.js allows remote attackers to cause a denial of service (file descriptor connpm · hapi · fixed in 2.2.0
- CVE-2013-4116lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary filnpm · npm · fixed in 1.3.3
- CVE-2013-6393The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to causnpm · libyaml · fixed in 0.2.3
- CVE-2013-2022Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.npm · jplayer · fixed in 2.3.0
- CVE-2013-4939Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through npm · yui · fixed in 3.10.3