Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-0989Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-0991Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-0992Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-0993Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-1002Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-1003Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore · fixed in 1.11.10
- CVE-2019-12277Blogifier 2.3 before 2019-05-11 does not properly restrict APIs, as demonstrated by missing checks for ..NuGet · blogifier.core · fixed in 2.5.5
- CVE-2019-0976A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contentNuGet · nuget.commands · fixed in 5.0.2
- CVE-2019-0980A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core NuGet · system.private.uri · fixed in 4.3.2
- CVE-2019-0981A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core NuGet · system.private.uri · fixed in 4.3.2
- CVE-2019-0982A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service VulnerabilitNuGet · microsoft.aspnetcore.signalr.protocols.messagepack · fixed in 1.1.5, 1.0.11
- CVE-2019-0933A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0937A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0911A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0912A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0913A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0914A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0915A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0916A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0917A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0922A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0923A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0924A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0925A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0927A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.9
- CVE-2019-0820A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET CoNuGet · system.text.regularexpressions · fixed in 4.3.1
- CVE-2019-11401A issue was discovered in SiteServer CMS 6.9.0.NuGet · sscms · fixed in 6.12
- CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototypNuGet · jquery · fixed in 3.4.0
- CVE-2019-9845madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, NuGet · madskristensen.aspnetcore.miniblog
- CVE-2019-7644Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT sNuGet · auth0-wcf-service-jwt · fixed in 1.0.4