Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-36377An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameternpm · aaptjs
- CVE-2020-36378An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parnpm · aaptjs
- CVE-2020-36376An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameternpm · aaptjs
- CVE-2020-26705The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expPyPI · easy-xml
- CVE-2021-3901Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiiPackagist · grumpydictator/firefly-iii
- CVE-2021-3900Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiiPackagist · grumpydictator/firefly-iii
- CVE-2020-28957Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web Packagist · froxlor/froxlor
- CVE-2021-23452Prototype Pollutionnpm · x-assign
- CVE-2021-42228A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.npm · kindeditor
- CVE-2021-42227Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .htmlnpm · kindeditor
- CVE-2021-41138Validity check for signed Frontier-specific extrinsic not called in block executioncrates.io · pallet-ethereum
- CVE-2021-23448Prototype Pollutionnpm · config-handler
- CVE-2020-19003An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances uPyPI · gateone
- CVE-2021-41862AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).Maven · com.googlecode.aviator:aviator
- CVE-2021-41467Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to injPackagist · hjue/justwriting
- CVE-2021-41616Apache ddlutils 1.0 readobject vulnerabilityMaven · org.apache.ddlutils:ddlutils
- CVE-2020-20129LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML viPackagist · wanglelecc/laracms
- CVE-2020-20120ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" Packagist · topthink/thinkphp
- CVE-2020-20693A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.Packagist · gilacms/gila
- CVE-2020-20695A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a craftedPackagist · gilacms/gila
- CVE-2020-20696A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTPackagist · gilacms/gila
- CVE-2021-31605furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket.PyPI · openvpn-monitor
- CVE-2021-31604furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.PyPI · openvpn-monitor
- CVE-2021-31606furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.PyPI · openvpn-monitor
- CVE-2021-25740Holes in EndpointSlice Validation Enable Host Network HijackGo · k8s.io/kubernetes
- CVE-2020-8561Webhook redirect in kube-apiserverGo · k8s.io/kubernetes
- CVE-2020-21125An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.Maven · com.bstek.ureport:ureport2-core
- CVE-2020-21122UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.Maven · com.bstek.ureport:ureport2-console
- CVE-2021-3783Cross-site Scripting (XSS) - Reflected in yourls/yourlsPackagist · yourls/yourls
- CVE-2021-40839The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack PyPI · rencode