Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-8452An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8456A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8459A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8465A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8466A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-8467A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.11.1
- CVE-2018-15121An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin.NuGet · auth0-aspnet, auth0-aspnet-owin
- CVE-2018-8266A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8355A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8359A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8371A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripNuGet · microsoft.chakracore · fixed in 1.10.1
- CVE-2018-8372A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8380A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8381A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8384A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8385A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-8390A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginNuGet · microsoft.chakracore · fixed in 1.10.2
- CVE-2018-1002205DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slaNuGet · dotnetzip · fixed in 1.11.0
- CVE-2018-1002206SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) iNuGet · sharpcompress · fixed in 0.21.0
- CVE-2018-1002208SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) inNuGet · sharpziplib · fixed in 1.0.0-rc1
- CVE-2018-1000210YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.DeserNuGet · yamldotnet, yamldotnet.signed · fixed in 5.0.0
- CVE-2018-14040In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.NuGet · bootstrap, bootstrap.sass · fixed in 3.4.0, 4.1.2
- CVE-2018-14041In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.NuGet · bootstrap, bootstrap.sass · fixed in 4.1.2
- CVE-2018-14042In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.NuGet · bootstrap, bootstrap.sass · fixed in 4.1.2, 3.4.0
- CVE-2018-8171A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET SecuritNuGet · microsoft.aspnetcore.identity · fixed in 1.0.6, 1.1.6, 2.0.4 and more
- CVE-2018-8276A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed,NuGet · microsoft.chakracore · fixed in 1.10.1
- CVE-2018-8280A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.10.1
- CVE-2018-8283A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginNuGet · microsoft.chakracore · fixed in 1.10.1
- CVE-2018-8286A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "CNuGet · microsoft.chakracore · fixed in 1.10.1
- CVE-2018-8287A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "ScriptingNuGet · microsoft.chakracore · fixed in 1.10.1