Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-1469A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service VulnerabiNuGet · bond.core.csharp · fixed in 9.0.1
- CVE-2020-1147A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check theNuGet · microsoft.netcore.app, microsoft.netcore.app.runtime.linux-arm +10 · fixed in 2.1.20, 3.1.6
- CVE-2020-15015The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.NuGet · gleamtech.fileultimate
- CVE-2020-1073A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.20
- CVE-2020-1161ASP.NET Core Denial of Service VulnerabilityNuGet · microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +7 · fixed in 3.1.4
- CVE-2020-1108.NET Core & .NET Framework Denial of Service VulnerabilityNuGet · microsoft.netcore.app, microsoft.netcore.app.runtime.linux-arm +10 · fixed in 2.1.18, 3.1.4
- CVE-2020-1065Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.19
- CVE-2020-1037Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.19
- CVE-2020-7656jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.NuGet · jquery · fixed in 1.9.0
- CVE-2018-1285Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.NuGet · log4net · fixed in 2.0.10
- CVE-2020-11022jQuery has a potential XSS vulnerabilityNuGet · jquery · fixed in 3.5.0
- CVE-2020-11023Potential XSS vulnerability in jQueryNuGet · jquery · fixed in 3.5.0
- CVE-2020-8867This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET StandNuGet · opcfoundation.netstandard.opc.ua · fixed in 1.4.359.31
- CVE-2020-5268Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NETNuGet · sustainsys.saml2 · fixed in 1.0.2, 2.7.0
- CVE-2020-0969A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-bNuGet · microsoft.chakracore · fixed in 1.11.18
- CVE-2020-0970A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.18
- CVE-2020-11005Internal NCryptDecrypt method could be used externally from WindowsHello library.NuGet · haemmerelectronics.sepppenner.windowshello · fixed in 1.0.4
- CVE-2020-5261Missing Token Replay DetectionNuGet · sustainsys.saml2 · fixed in 2.5.0
- CVE-2019-20627AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.NuGet · autoupdater.net.official · fixed in 1.5.8
- CVE-2020-9472Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.NuGet · umbracocms · fixed in 8.5.4
- CVE-2020-9471Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.NuGet · umbracocms.core
- CVE-2020-0848A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0832A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0833A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0830A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0831A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0828A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0829A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0826A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0827A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17