Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-11889ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary coNuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11893ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in NuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11905ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in NuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11908ChakraCore and Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engNuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11909ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of theNuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11910ChakraCore and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context NuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11911ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of theNuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11914ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights NuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11916ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handlNuGet · microsoft.chakracore · fixed in 1.7.5
- CVE-2017-11770.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web applicatiNuGet · microsoft.netcore.app, system.security.cryptography.x509certificates · fixed in 2.0.3, 4.1.2
- CVE-2017-11862ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the curNuGet · microsoft.chakracore · fixed in 1.7.4
- CVE-2017-11870ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as NuGet · microsoft.chakracore · fixed in 1.7.4
- CVE-2017-11871ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as NuGet · microsoft.chakracore · fixed in 1.7.4
- CVE-2017-11879ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URLNuGet · microsoft.aspnetcore.all, microsoft.aspnetcore.mvc.core · fixed in 2.0.3, 2.0.1
- CVE-2017-11883.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web applicatiNuGet · microsoft.aspnetcore.server.httpsys, microsoft.aspnetcore.server.weblistener +1 · fixed in 2.0.2, 1.0.6, 1.1.4
- CVE-2017-8700ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricNuGet · microsoft.aspnetcore.mvc.core, microsoft.aspnetcore.mvc.cors · fixed in 1.0.6, 1.1.6
- CVE-2017-0907The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side RequesNuGet · recurly-api-client · fixed in 1.0.1, 1.1.10, 1.2.8 and more
- CVE-2017-11767ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles NuGet · microsoft.chakracore · fixed in 1.6.2
- CVE-2017-11792ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allow an attacker to execute arbitrary code in the context of the current user, dNuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-11796ChakraCore and Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to howNuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-11797ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handlNuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-11801ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handlNuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-11805ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, NuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-11806ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, NuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-11807ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, NuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-11821ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, NuGet · microsoft.chakracore · fixed in 1.7.3
- CVE-2017-15279Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the NuGet · umbracocms.web · fixed in 7.7.3
- CVE-2017-15280XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on theNuGet · umbracocms.web · fixed in 7.7.3
- CVE-2015-5237protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.NuGet · google.protobuf · fixed in 3.4.0
- CVE-2017-8658A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "ScriNuGet · microsoft.chakracore · fixed in 1.6.1