Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-4097CRLF Injection in phpservermon/phpservermonPackagist · phpservermon/phpservermon
- CVE-2021-23663Prototype Pollutionnpm · sey
- CVE-2021-23700Prototype Pollutionnpm · merge-deep2
- CVE-2021-23561Prototype Pollutionnpm · comb
- CVE-2021-4050Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatPackagist · remdex/livehelperchat
- CVE-2021-4049Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchatPackagist · remdex/livehelperchat
- CVE-2021-44685Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step.npm · git-it-electron
- CVE-2021-44684naholyr github-todos 3.1.0 is vulnerable to command injection.npm · github-todos
- CVE-2021-36567ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.Packagist · topthink/framework
- CVE-2021-44278Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.Packagist · librenms/librenms
- CVE-2021-4000Open Redirect in star7th/showdocPackagist · showdoc/showdoc
- CVE-2021-44277Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.Packagist · librenms/librenms
- CVE-2021-44279Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.Packagist · librenms/librenms
- CVE-2021-43790Use After Free in lucetcrates.io · lucet-runtime
- CVE-2021-23654Improper Input ValidationPyPI · html-to-csv
- CVE-2021-23673Cross-site Scripting (XSS)npm · pekeupload
- CVE-2021-43668Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered.Go · github.com/ethereum/go-ethereum
- CVE-2021-3683Cross-Site Request Forgery (CSRF) in star7th/showdocPackagist · showdoc/showdoc
- CVE-2021-3775Cross-Site Request Forgery (CSRF) in star7th/showdocPackagist · showdoc/showdoc
- CVE-2021-3931Cross-Site Request Forgery (CSRF) in snipe/snipe-itPackagist · snipe/snipe-it
- CVE-2021-43578Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any Maven · org.jenkins-ci.plugins:squashtm-publisher-plugin
- CVE-2021-43576Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackersMaven · org.jenkins-ci.plugins:pom2config
- CVE-2021-21701Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:performance
- CVE-2021-33618Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY elPackagist · dolibarr/dolibarr
- CVE-2021-42279Chakra Scripting Engine Memory Corruption VulnerabilityNuGet · microsoft.chakracore
- CVE-2021-3924Path Traversal in getgrav/gravPackagist · getgrav/grav
- CVE-2021-23472Cross-site Scripting (XSS)npm · bootstrap-table
- CVE-2020-36379An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parametnpm · aaptjs
- CVE-2020-36381An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath pnpm · aaptjs
- CVE-2020-36380An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parametnpm · aaptjs