Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-29508Insecure deserialization in WireNuGet · wire
- CVE-2021-26701.NET Core Remote Code Execution VulnerabilityNuGet · system.text.encodings.web · fixed in 4.5.1, 4.7.2, 5.0.1
- CVE-2021-24112.NET Core Remote Code Execution VulnerabilityNuGet · system.drawing.common · fixed in 4.7.2, 5.0.3
- CVE-2021-1721.NET Core and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.netcore.app, microsoft.netcore.app.host.linux-arm +43 · fixed in 2.1.25, 3.1.12, 5.0.3
- CVE-2020-29457A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connectiNuGet · opcfoundation.netstandard.opc.ua.core · fixed in 1.4.365.10
- CVE-2021-21252Regular expression denial of service in jquery-validationNuGet · jquery.validation · fixed in 1.19.3
- CVE-2021-1723ASP.NET Core and Visual Studio Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +10 · fixed in 3.1.11, 5.0.2, 2.1.25
- CVE-2020-16017Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process NuGet · cefsharp.common, cefsharp.winforms +2 · fixed in 86.0.241
- CVE-2020-16013Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption NuGet · cefsharp.common, cefsharp.winforms +2 · fixed in 86.0.241
- CVE-2020-26293Possible XSS bypass if style tag is allowedNuGet · htmlsanitizer · fixed in 5.0.372
- CVE-2020-5809A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.NuGet · umbracocms.core
- CVE-2020-5811An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in aNuGet · umbracocms · fixed in 8.9.2
- CVE-2020-20136QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration oNuGet · quantconnect.common
- CVE-2020-7791Denial of Service (DoS)NuGet · i18n · fixed in 2.1.15
- CVE-2020-17131Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.24
- CVE-2020-29454Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings NuGet · umbracocms · fixed in 8.10.0
- CVE-2020-17054Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.23
- CVE-2020-17048Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.23
- CVE-2020-16009Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption NuGet · cefsharp.common, cefsharp.winforms +2 · fixed in 86.0.241
- CVE-2020-15999Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viNuGet · cefsharp.common, cefsharp.winforms +2 · fixed in 85.3.130
- CVE-2020-28042ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes aNuGet · servicestack · fixed in 5.9.2
- CVE-2020-27998An issue was discovered in FastReport before 2020.4.0.NuGet · fastreport.opensource · fixed in 2020.4.0
- CVE-2019-20921bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS).NuGet · bootstrap-select · fixed in 1.13.6
- CVE-2020-8927Buffer overflow in Brotli libraryNuGet · microsoft.netcore.app.runtime.aot.linux-x64.cross.android-arm, microsoft.netcore.app.runtime.aot.linux-x64.cross.android-arm64 +114 · fixed in 6.0.3, 5.0.15, 3.1.23
- CVE-2020-1180Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.22
- CVE-2020-1172Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.22
- CVE-2020-1057Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.22
- CVE-2020-1045Microsoft ASP.NET Core Security Feature Bypass VulnerabilityNuGet · microsoft.aspnetcore.app, microsoft.aspnetcore.app.runtime.linux-arm +11 · fixed in 2.1.22, 3.1.8, 4.1.1
- CVE-2020-1597ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.app +10 · fixed in 2.1.21, 3.1.7
- CVE-2020-7685Insecure DefaultsNuGet · umbracoforms