Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-2196Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrativeMaven · org.jenkins-ci.plugins:selenium
- CVE-2020-7659reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing.RubyGems · reel
- CVE-2020-13487The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/ePackagist · bbpress/bbpress
- CVE-2020-13241Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extPackagist · microweber/microweber
- CVE-2020-13239The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the dirPackagist · dolibarr/dolibarr
- CVE-2020-13240The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecuPackagist · dolibarr/dolibarr
- CVE-2020-13226WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this Maven · org.wso2.am:am-parent
- CVE-2020-13163em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of RubyGems · em-imap
- CVE-2019-20390A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the sPackagist · intelliants/subrion
- CVE-2019-20389An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page.Packagist · intelliants/subrion
- CVE-2020-7646curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.npm · curlrequest
- CVE-2020-11671Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to becomePackagist · nilsteampassnet/teampass
- CVE-2020-12477The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-ForwPackagist · nilsteampassnet/teampass
- CVE-2020-12478TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root.Packagist · nilsteampassnet/teampass
- CVE-2020-12479TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sourcePackagist · nilsteampassnet/teampass
- CVE-2020-12467Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.Packagist · intelliants/subrion
- CVE-2020-12468Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language.Packagist · intelliants/subrion
- CVE-2020-12469admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpagesPackagist · intelliants/subrion
- CVE-2020-7644fun-map through 3.3.1 is vulnerable to Prototype Pollution.npm · fun-map
- CVE-2020-7643paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution.npm · paypal-adaptive
- CVE-2020-11887svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.npm · svg2png
- CVE-2020-11825In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks.Packagist · dolibarr/dolibarr
- CVE-2020-11823In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page.Packagist · dolibarr/dolibarr
- CVE-2020-8828As of v1.5.0, the default admin password is set to the argocd-server pod name.Go · github.com/argoproj/argo-cd
- CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2020-11610An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2020-11611An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2015-9545An issue was discovered in xdLocalStorage through 2.0.5.npm · xdlocalstorage
- CVE-2020-7614npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any npm · npm-programmatic
- CVE-2020-7616express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution.npm · express-mock-middleware