Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7734Cross-site Scripting (XSS)PyPI · cabot
- CVE-2020-2278Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permisMaven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2020-2276Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/ConfMaven · org.jvnet.hudson.plugins:selection-tasks-plugin
- CVE-2020-2277Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.Maven · org.jvnet.hudson.plugins:storable-configs-plugin
- CVE-2020-2273A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-spMaven · org.jenkins-ci.plugins:elastest
- CVE-2020-2274Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller Maven · org.jenkins-ci.plugins:elastest
- CVE-2020-2275Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workMaven · org.jvnet.hudson.plugins:copy-data-to-workspace-plugin
- CVE-2020-2271Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scriptiMaven · org.jvnet.hudson.plugins:locked-files-report
- CVE-2020-2272A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacMaven · org.jenkins-ci.plugins:elastest
- CVE-2020-2269Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-sMaven · org.jenkins-ci.plugins:chosen-views-tabbar
- CVE-2020-2270Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site sMaven · org.jvnet.hudson.plugins:clearcase-release
- CVE-2020-2266Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-sitMaven · org.jenkins-ci.plugins:description-column-plugin
- CVE-2020-2267A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some meMaven · org.jenkins-ci.plugins:mongodb
- CVE-2020-2268A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadataMaven · org.jenkins-ci.plugins:mongodb
- CVE-2020-2264Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting Maven · org.jenkins-ci.plugins:custom-job-icon
- CVE-2020-2265Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored Maven · org.jenkins-ci.plugins:covcomplplot
- CVE-2020-2262Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (Maven · org.jvnet.hudson.plugins:android-lint
- CVE-2020-2263Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scriptMaven · org.jenkins-ci.plugins:radiatorviewplugin
- CVE-2020-25575An issue was discovered in the failure crate through 0.1.5 for Rust.crates.io · failure
- CVE-2020-25540ThinkAdmin v6 is affected by a directory traversal vulnerability.Packagist · zoujingli/thinkadmin
- CVE-2020-23811xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.Maven · com.xuxueli:xxl-job
- CVE-2020-25102silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) Packagist · silverstripe-australia/advancedreports
- CVE-2020-5776Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens.Packagist · dweeves/magmi
- CVE-2020-7666Arbitrary File Write via Archive Extraction (Zip Slip)Go · github.com/u-root/u-root/pkg/cpio
- CVE-2020-2249Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the JenkinMaven · org.jenkins-ci.plugins:tfs
- CVE-2020-2248Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.Maven · org.jenkins-ci.plugins:jsgames
- CVE-2020-2245Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Maven · org.jenkins-ci.plugins:valgrind
- CVE-2020-2246Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vMaven · org.jenkins-ci.plugins:valgrind
- CVE-2020-7725Prototype Pollutionnpm · worksmith
- CVE-2020-7726Prototype Pollutionnpm · safe-object2