Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-0860A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.8
- CVE-2019-0861A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.8
- CVE-2019-0829A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.8
- CVE-2019-0806A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.8
- CVE-2019-0810A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.8
- CVE-2019-0812A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.8
- CVE-2019-0771A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinNuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-0773A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinNuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-0769A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'ScriptinNuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-0746An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'NuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-0639A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-0611A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-0609A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingNuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-0592A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'CNuGet · microsoft.chakracore · fixed in 1.11.7
- CVE-2019-9648An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674.NuGet · coreftp
- CVE-2018-14486DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.NuGet · dotnetnuke.core
- CVE-2019-0648An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker NuGet · microsoft.chakracore · fixed in 1.11.6
- CVE-2019-0649A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileged Vulnerability'.NuGet · microsoft.chakracore · fixed in 1.11.6
- CVE-2019-0657A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio NuGet · microsoft.netcore.app, system.private.uri · fixed in 2.2.2, 2.1.8, 4.3.2
- CVE-2019-8331In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.NuGet · bootstrap, bootstrap.less +1 · fixed in 4.3.1, 3.4.1
- CVE-2016-10735In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability thanNuGet · bootstrap, bootstrap.sass · fixed in 3.4.0, 4.0.0-beta.2
- CVE-2018-20676In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.NuGet · bootstrap · fixed in 3.4.0
- CVE-2018-20677In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.NuGet · bootstrap · fixed in 3.4.0
- CVE-2019-0539A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.5
- CVE-2019-0545An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) cNuGet · microsoft.netcore.app · fixed in 2.1.7, 2.2.1
- CVE-2019-0564A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service VulnerabilitNuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.app +4 · fixed in 2.2.1, 2.1.7, 4.5.3
- CVE-2019-0567A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.5
- CVE-2019-0568A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.5
- CVE-2018-8583A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8617A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3