Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7615fsa through 0.5.1 is vulnerable to Command Injection.npm · fsa
- CVE-2020-1728A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing gMaven · org.keycloak:keycloak-core
- CVE-2020-7636adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.npm · adb-driver
- CVE-2020-7635compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.npm · compass-compile
- CVE-2020-7633apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argumentnpm · apiconnect-cli-plugins
- CVE-2020-7632node-mpv through 1.4.3 is vulnerable to Command Injection.npm · node-mpv
- CVE-2020-7631diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.npm · diskusage-ng
- CVE-2020-8147Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remotnpm · utils-extend
- CVE-2020-7630git-add-remote through 1.0.0 is vulnerable to Command Injection.npm · git-add-remote
- CVE-2020-7629install-package through 0.4.0 is vulnerable to Command Injection.npm · install-package
- CVE-2020-7628umount through 1.1.6 is vulnerable to Command Injection.npm · umount
- CVE-2020-7627node-key-sender through 1.0.11 is vulnerable to Command Injection.npm · node-key-sender
- CVE-2020-7626karma-mojo through 1.0.1 is vulnerable to Command Injection.npm · karma-mojo
- CVE-2020-7625op-browser through 1.0.6 is vulnerable to Command Injection.npm · op-browser
- CVE-2020-7623jscover through 1.0.0 is vulnerable to Command Injection.npm · jscover
- CVE-2020-7621strong-nginx-controller through 1.0.2 is vulnerable to Command Injection.npm · strong-nginx-controller
- CVE-2020-7619get-git-data through 1.3.1 is vulnerable to Command Injection.npm · get-git-data
- CVE-2020-7620pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' paramsnpm · pomelo-monitor
- CVE-2020-7617Prototype Pollutionnpm · ini-parser
- CVE-2016-11023odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection.Maven · org.odata4j:odata4j-core, org.odata4j:odata4j-dist +1
- CVE-2016-11024odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection.Maven · org.odata4j:odata4j-core, org.odata4j:odata4j-dist +1
- CVE-2019-17561The "Apache NetBeans" autoupdate system does not fully validate code signatures.Maven · org.codehaus.mevenide:netbeans
- CVE-2019-17560The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads.Maven · org.codehaus.mevenide:netbeans
- CVE-2020-10963FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_imagPackagist · frozennode/administrator
- CVE-2020-10793CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page.Packagist · codeigniter4/framework
- CVE-2020-10800lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the npm · lix
- CVE-2020-10596OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.Packagist · opencart/opencart
- CVE-2019-19212Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).Packagist · dolibarr/dolibarr
- CVE-2020-9471Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.NuGet · umbracocms.core
- CVE-2019-19208Codiad Web IDE through 2.8.4 allows PHP Code injection.Packagist · codiad/codiad