Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7777Arbitrary Code Executionnpm · jsen
- CVE-2020-28271Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remnpm · deephas
- CVE-2020-28269Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remotnpm · field
- CVE-2020-7767Regular Expression Denial of Service (ReDoS)npm · express-validators
- CVE-2019-7357Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.Packagist · intelliants/subrion
- CVE-2020-23136Microweber v1.1.18 is affected by no session expiry after log-out.Packagist · microweber/microweber
- CVE-2020-2318Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins coMaven · org.jenkins-ci.plugins:mailcommander
- CVE-2020-2319Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controMaven · org.jenkins-ci.plugins:labmanager
- CVE-2020-2316Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-siMaven · org.jvnet.hudson.plugins:analysis-core
- CVE-2020-2317Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSMaven · org.jvnet.hudson.plugins:findbugs
- CVE-2020-7757Path Traversalnpm · droppy
- CVE-2020-7755Regular Expression Denial of Service (ReDoS)npm · dat.gui
- CVE-2020-10721A flaw was found in the fabric8-maven-plugin 4.0.0 and later.Maven · io.fabric8:fabric8-maven-plugin
- CVE-2020-7747Cross-site Scripting (XSS)npm · lightning-server
- CVE-2020-7744Information ExposureMaven · com.mintegral.msdk:alphab
- CVE-2020-2298Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:nerrvana-plugin
- CVE-2020-2296A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objMaven · org.jenkins-ci.plugins:shared-objects
- CVE-2020-2297Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controlleMaven · com.hoiio.jenkins:sms
- CVE-2020-2294Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers withMaven · com.barchart.jenkins:maven-release-cascade
- CVE-2020-2295A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascadMaven · com.barchart.jenkins:maven-release-cascade
- CVE-2020-2293Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.Maven · org.jenkins-ci.plugins:persona
- CVE-2020-25262PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.Packagist · pyrocms/pyrocms
- CVE-2020-25263PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary pluginPackagist · pyrocms/pyrocms
- CVE-2020-24807The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execunpm · socket.io-file
- CVE-2020-7740Server-side Request Forgery (SSRF)npm · node-pdf-generator
- CVE-2020-7739Server-side Request Forgery (SSRF)npm · phantomjs-seo
- CVE-2017-18924oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE.npm · oauth2-server
- CVE-2020-7738Arbitrary Code Executionnpm · shiba
- CVE-2020-7737Prototype Pollutionnpm · safetydance
- CVE-2019-20903The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScripnpm · @atlaskit/editor-core