Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-8659Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the ChakNuGet · microsoft.chakracore · fixed in 1.6.1
- CVE-2017-9785Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF CoNuGet · nancy · fixed in 1.4.4, 2.0.0
- CVE-2017-9822DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN siteNuGet · dotnetnuke.core · fixed in 9.1.1
- CVE-2017-8585Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resultinNuGet · microsoft.netcore.app · fixed in 1.0.7, 1.1.4
- CVE-2017-9246New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during usNuGet · newrelic.agent · fixed in 6.3.123.0
- CVE-2017-0223A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory.NuGet · microsoft.chakracore · fixed in 1.4.4
- CVE-2017-0252A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory.NuGet · microsoft.chakracore · fixed in 1.4.4
- CVE-2017-0224A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka "ScNuGet · microsoft.chakracore · fixed in 1.4.4
- CVE-2017-0234A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects inNuGet · microsoft.chakracore · fixed in 1.4.4
- CVE-2017-0235A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects inNuGet · microsoft.chakracore · fixed in 1.4.4
- CVE-2017-0236A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects inNuGet · microsoft.chakracore · fixed in 1.4.4
- CVE-2017-0247A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests.NuGet · microsoft.aspnetcore.mvc, microsoft.aspnetcore.mvc.abstractions +17 · fixed in 1.0.4, 1.1.3, 4.1.2 and more
- CVE-2017-0248Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings whenNuGet · microsoft.aspnetcore.mvc, microsoft.aspnetcore.mvc.abstractions +17 · fixed in 1.0.4, 1.1.3, 4.1.2 and more
- CVE-2017-0249An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.NuGet · discatsharp, microsoft.aspnetcore.mvc +18 · fixed in 1.0.4, 1.1.3, 4.1.2 and more
- CVE-2017-0256A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.NuGet · microsoft.aspnetcore.mvc, microsoft.aspnetcore.mvc.abstractions +17 · fixed in 1.0.4, 1.1.3, 4.1.2 and more
- CVE-2017-0208An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memoryNuGet · microsoft.chakracore · fixed in 1.4.3
- CVE-2016-7103Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via NuGet · jquery.ui.combined · fixed in 1.12.0
- CVE-2015-8813The Page_Load function in Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs in Umbraco before 7.4.0 allows remote attackeNuGet · umbraco.cms · fixed in 7.4.0
- CVE-2015-8814Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks NuGet · umbraco.cms · fixed in 7.4.0
- CVE-2015-2794The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via NuGet · dotnetnuke.core · fixed in 7.4.1
- CVE-2016-7200The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-7201The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-7202The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cauNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-7203The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-7208The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-7240The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-7242The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-7243The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memNuGet · microsoft.chakracore · fixed in 1.2.2
- CVE-2016-3382The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cauNuGet · microsoft.chakracore · fixed in 1.2.1
- CVE-2016-3386The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupNuGet · microsoft.chakracore · fixed in 1.2.1