Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23404Cross-site Request Forgery (CSRF)PyPI · sqlite-web
- CVE-2021-39193Transaction validity oversight in pallet-ethereumcrates.io · pallet-ethereum
- CVE-2021-40494A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.PyPI · lxdui
- CVE-2021-23427Arbitrary File Write via Archive Extraction (Zip Slip)NuGet · elfinder.netcore
- CVE-2021-23428Directory TraversalNuGet · elfinder.netcore
- CVE-2021-23426Prototype Pollutionnpm · proto
- CVE-2020-19002Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componenPyPI · mezzanine
- CVE-2021-39165Unauthenticated SQL InjectionPackagist · cachethq/cachet
- CVE-2021-3734Improper Restriction of Rendered UI Layers or Frames in yourls/yourlsPackagist · yourls/yourls
- CVE-2020-19709Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.Packagist · feehi/feehicms
- CVE-2021-38556includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.Packagist · billz/raspap-webgui
- CVE-2021-38557raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.Packagist · billz/raspap-webgui
- CVE-2021-23432Prototype Pollutionnpm · mootools
- CVE-2021-23429Denial of Service (DoS)npm · transpile
- CVE-2021-23430Directory Traversalnpm · startserver
- CVE-2020-18899An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of serPyPI · exiv2
- CVE-2021-32830The @diez/generation npm package is a client for Diez.npm · @diez/generation
- CVE-2021-32827Arbitrary code execution in MockServerMaven · org.mock-server:mockserver
- CVE-2021-32822File disclosure in hbsnpm · hbs
- CVE-2020-18705XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.PyPI · quokka
- CVE-2020-18703XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.PyPI · quokka
- CVE-2020-18702Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component PyPI · quokka
- CVE-2020-18701Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the aPyPI · lin-cms
- CVE-2020-18699Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'UsernamPyPI · lin-cms
- CVE-2020-18698Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'loPyPI · lin-cms
- CVE-2021-38713imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.Packagist · helloxz/imgurl
- CVE-2021-38302The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.Packagist · ecodev/newsletter
- CVE-2021-23421Prototype Pollutionnpm · merge-change
- CVE-2021-38384Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implemnpm · serverless-offline
- CVE-2020-36432An issue was discovered in the alg_ds crate through 2020-08-25 for Rust.crates.io · alg_ds