Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1000120A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of seNuGet · curl
- CVE-2018-0787ASP.NET Core 1.0.NuGet · microsoft.aspnetcore.httpoverrides, microsoft.aspnetcore.server.kestrel.core · fixed in 2.0.2
- CVE-2018-0872ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0873ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to hNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0874ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0875.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted reNuGet · microsoft.netcore.jit · fixed in 2.0.6, 1.1.7, 1.0.12
- CVE-2018-0925ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory NuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0930ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles objeNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0931ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the ChakrNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0933ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the ChakrNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0934ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the ChakrNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0936ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka NuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0937ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0939ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in mNuGet · microsoft.chakracore · fixed in 1.8.2
- CVE-2018-0834Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0835Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0836Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles obNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0837Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0838Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0856Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles obNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0857Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0858ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory NuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0859Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2018-0860Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, duNuGet · microsoft.chakracore · fixed in 1.8.1
- CVE-2012-6708jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.NuGet · jquery · fixed in 1.9.0
- CVE-2015-9251jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType oNuGet · jquery · fixed in 1.12.2, 3.0.0
- CVE-2016-10707jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.NuGet · jquery · fixed in 3.0.0
- CVE-2018-0764Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0.NuGet · system.security.cryptography.xml · fixed in 4.4.2
- CVE-2018-0786Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.NuGet · microsoft.netcore.universalwindowsplatform, system.private.servicemodel +5 · fixed in 5.2.4, 5.3.5, 5.4.2 and more
- CVE-2018-0818Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code oNuGet · microsoft.chakracore · fixed in 1.8.0