Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-8618A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.4
- CVE-2018-8624A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.4
- CVE-2018-8629A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.4
- CVE-2018-17256Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the NuGet · umbraco
- CVE-2018-8416A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This afNuGet · microsoft.netcore.app · fixed in 2.1.7
- CVE-2018-8541A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8542A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8543A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8551A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8555A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8556A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8557A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8588A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.3
- CVE-2018-8292An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NENuGet · system.net.http · fixed in 4.3.4
- CVE-2018-8500A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.2
- CVE-2018-8503A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.2
- CVE-2018-8505A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.2
- CVE-2018-8510A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.2
- CVE-2018-8511A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.2
- CVE-2018-8513A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.2
- CVE-2018-17060Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the NuGet · telerikmvcextensions
- CVE-2018-12087Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over NuGet · opcfoundation.netstandard.opc.ua · fixed in 1.4.353.15
- CVE-2018-17107In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeNuGet · tgserviceinterface · fixed in 3.2.5.0
- CVE-2018-12086Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.NuGet · opcfoundation.netstandard.opc.ua · fixed in 1.4.353.15
- CVE-2018-8269A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." ThNuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.dataprotection.azurestorage +1 · fixed in 2.1.13, 2.2.7, 5.8.4
- CVE-2018-8315An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Microsoft Scripting EnNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8354A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "ScriptinNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8367A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8391A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8409A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." NuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.app +1 · fixed in 2.1.4, 4.5.1