Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2217Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form vMaven · org.jenkins-ci.plugins:compatibility-action-storage
- CVE-2020-2218Jenkins HP ALM Quality Center Plugin 1.6 and earlier stores a password unencrypted in its global configuration file on the Jenkins master whMaven · org.jenkins-ci.plugins:hp-quality-center
- CVE-2020-2215A cross-site request forgery vulnerability in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers to connect to Maven · org.jenkins-ci.plugins:zephyr-for-jira-test-management
- CVE-2020-2211Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrMaven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2020-2212Jenkins GitHub Coverage Reporter Plugin 1.8 and earlier stores secrets unencrypted in its global configuration file on the Jenkins master whMaven · io.jenkins.plugins:github-coverage-reporter
- CVE-2020-2210Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuraMaven · org.jenkins-ci.plugins:stashbranchparameter
- CVE-2020-2208Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewedMaven · org.jenkins-ci.plugins:slack-uploader
- CVE-2020-13619php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.npm · locutus
- CVE-2020-15362wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executablenpm · wifiscanner
- CVE-2013-7489The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.PyPI · beaker
- CVE-2018-21268The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter.npm · traceroute
- CVE-2020-13700An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress.Packagist · airesvsg/acf-to-rest-api
- CVE-2020-15015The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.NuGet · gleamtech.fileultimate
- CVE-2020-13155clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clPackagist · nukeviet/nukeviet
- CVE-2020-13156modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=user_add URI.Packagist · nukeviet/nukeviet
- CVE-2020-13157modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=edit&userid= URI.Packagist · nukeviet/nukeviet
- CVE-2017-18870An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4.Go · github.com/mattermost/mattermost-server
- CVE-2020-7679Prototype Pollutionnpm · casperjs
- CVE-2020-14146KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATH_INFO.Packagist · kumbiaphp/kumbiapp
- CVE-2020-7671goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable.RubyGems · goliath
- CVE-2020-7672mosc through 1.0.0 is vulnerable to Arbitrary Code Execution.npm · mosc
- CVE-2020-7673node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution.npm · node-extend
- CVE-2020-7674access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution.npm · access-policy
- CVE-2020-7675cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution.npm · cd-messenger
- CVE-2020-13980OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because Packagist · opencart/opencart
- CVE-2020-7661all versions of url-regex are vulnerable to Regular Expression Denial of Service.npm · url-regex
- CVE-2020-2200Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validatioMaven · org.jenkins-ci.plugins:play-autotest-plugin
- CVE-2020-2197Jenkins Project Inheritance Plugin 19.08.02 and earlier does not require users to have Job/ExtendedRead permission to access Inheritance ProMaven · hudson.plugins:project-inheritance
- CVE-2020-2198Jenkins Project Inheritance Plugin 19.08.02 and earlier does not redact encrypted secrets in the 'getConfigAsXML' API URL when transmitting Maven · hudson.plugins:project-inheritance
- CVE-2020-2199Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form valiMaven · org.jenkins-ci.plugins:svn-partial-release-mgr