Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-0825A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0823A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0812A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-bNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0813An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker NuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0811A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-bNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-0768A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingNuGet · microsoft.chakracore · fixed in 1.11.17
- CVE-2020-5186DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).NuGet · dotnetnuke.core
- CVE-2020-5187DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).NuGet · dotnetnuke.core · fixed in 9.5.0
- CVE-2020-5188DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.NuGet · dotnetnuke.core
- CVE-2020-0767A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.16
- CVE-2020-0712A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.16
- CVE-2020-0713A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.16
- CVE-2020-0710A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.16
- CVE-2020-0711A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.16
- CVE-2020-5234Untrusted data can lead to DoS attack in MessagePack for C# and UnityNuGet · messagepack, messagepack.immutablecollection +3 · fixed in 1.9.11, 2.1.90
- CVE-2014-4172A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client beNuGet · dotnetcasclient · fixed in 1.0.2
- CVE-2020-7210Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.NuGet · umbracocms.core · fixed in 8.5.0
- CVE-2020-0606A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who sNuGet · microsoft.windowsdesktop.app.ref, microsoft.windowsdesktop.app.runtime.win-x64 +1 · fixed in 3.0.2, 3.1.1, 3.1.11
- CVE-2020-0603A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who suNuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.app +10 · fixed in 2.1.15, 3.1.1, 3.0.1 and more
- CVE-2020-0602A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service VulnerabilitNuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.app +9 · fixed in 2.1.15, 3.1.1, 3.0.1 and more
- CVE-2019-1366A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.14
- CVE-2019-1335A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.14
- CVE-2019-1307A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.14
- CVE-2019-1308A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.14
- CVE-2019-16929Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tNuGet · auth0.authenticationapi · fixed in 6.5.4
- CVE-2019-12562Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into thNuGet · dotnetnuke.core · fixed in 9.4.0
- CVE-2019-1298A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.13
- CVE-2019-1300A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.13
- CVE-2019-1301A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Service Vulnerability'.NuGet · system.management.automation · fixed in 6.2.3, 6.1.6
- CVE-2019-1302An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to proNuGet · microsoft.aspnetcore.spaservices · fixed in 2.2.7, 2.1.13