Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-1217A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.13
- CVE-2019-1237A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.13
- CVE-2019-1138A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.13
- CVE-2019-15151AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h.NuGet · adplug · fixed in 2.3.3
- CVE-2019-1258Azure Active Directory Authentication Library Elevation of Privilege VulnerabilityNuGet · microsoft.identitymodel.clients.activedirectory · fixed in 5.2.0
- CVE-2019-1196Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.12
- CVE-2019-1197Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.12
- CVE-2019-1195Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.12
- CVE-2019-1131Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.12
- CVE-2019-1139Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.12
- CVE-2019-1140Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.12
- CVE-2019-1141Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.12
- CVE-2019-1107A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.11
- CVE-2019-1106A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.11
- CVE-2019-1103A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.11
- CVE-2019-14262MetadataExtractor 2.1.0 allows stack consumption.NuGet · metadataextractor · fixed in 2.2.0
- CVE-2019-1010199ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS).NuGet · servicestack · fixed in 5.2.0
- CVE-2019-1010113Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS).NuGet · cleditor
- CVE-2019-1167A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC eNuGet · system.management.automation · fixed in 6.2.2, 6.1.5
- CVE-2019-1092A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.11
- CVE-2019-1062A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.11
- CVE-2019-1075A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.NuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.app +2 · fixed in 2.2.6, 2.1.12
- CVE-2018-14550An issue has been found in third-party PNM decoding associated with libpng 1.6.35.NuGet · libpng · fixed in 1.6.37
- CVE-2018-18326DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy.NuGet · dotnetnuke.core · fixed in 9.3.0
- CVE-2018-18325DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters.NuGet · dotnetnuke.core · fixed in 9.3.0
- CVE-2018-15812DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.NuGet · dotnetnuke.core · fixed in 9.2.2
- CVE-2018-15811DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.NuGet · dotnetnuke.core · fixed in 9.2.2
- CVE-2019-1051Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-1052Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-1024Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10