Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-29930An issue was discovered in the arenavec crate through 2021-01-12 for Rust.crates.io · arenavec
- CVE-2021-29931An issue was discovered in the arenavec crate through 2021-01-12 for Rust.crates.io · arenavec
- CVE-2021-29932An issue was discovered in the parse_duration crate through 2021-03-18 for Rust.crates.io · parse_duration
- CVE-2021-29933An issue was discovered in the insert_many crate through 2021-01-26 for Rust.crates.io · insert_many
- CVE-2021-29936An issue was discovered in the adtensor crate through 2021-01-11 for Rust.crates.io · adtensor
- CVE-2021-29938An issue was discovered in the slice-deque crate through 2021-02-19 for Rust.crates.io · slice-deque
- CVE-2021-29940An issue was discovered in the through crate through 2021-02-18 for Rust.crates.io · through
- CVE-2021-21638A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect tMaven · org.jenkins-ci.plugins:tfs
- CVE-2021-21637A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to conMaven · org.jenkins-ci.plugins:tfs
- CVE-2021-21636A missing permission check in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers with Overall/Read permission to enuMaven · org.jenkins-ci.plugins:tfs
- CVE-2021-26715The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability.Maven · org.mitre:openid-connect-server
- CVE-2021-29002A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameterPyPI · plone
- CVE-2021-28099In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories wMaven · com.netflix.hollow:hollow
- CVE-2021-28100Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--.Maven · com.netflix.priam:priam
- CVE-2021-26275The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function.npm · eslint-fixer
- CVE-2021-23359Arbitrary Command Injectionnpm · port-killer
- CVE-2021-27817A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPackagist · shopxo/shopxo
- CVE-2021-23355Arbitrary Command Injectionnpm · ps-kill
- CVE-2021-23356Arbitrary Command Injectionnpm · kill-process-by-name
- CVE-2021-28088Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web Packagist · impresscms/impresscms
- CVE-2021-20262A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password.Maven · org.keycloak:keycloak-core
- CVE-2020-35296ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.Packagist · zoujingli/thinkadmin
- CVE-2021-26700Visual Studio Code npm-script Extension Remote Code Execution Vulnerabilitynpm · vscode-npm-script
- CVE-2020-27543The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header.npm · restify-paginate
- CVE-2021-27582org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 containsMaven · org.mitre:openid-connect-parent
- CVE-2020-28429Command Injectionnpm · geojson2kml
- CVE-2020-14359A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass oGo · github.com/keycloak/keycloak-gatekeeper
- CVE-2020-13697An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1.Maven · org.nanohttpd:nanohttpd-nanolets
- CVE-2020-24393TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation.RubyGems · tweetstream
- CVE-2020-24392In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of tRubyGems · twitter-stream