Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7603closure-compiler-stream through 0.1.15 allows execution of arbitrary commands.npm · closure-compiler-stream
- CVE-2020-7607gulp-styledocco through 0.0.3 allows execution of arbitrary commands.npm · gulp-styledocco
- CVE-2020-7605gulp-tape through 1.0.0 allows execution of arbitrary commands.npm · gulp-tape
- CVE-2020-7606docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands.npm · docker-compose-remote-api
- CVE-2020-7604pulverizr through 0.7.0 allows execution of arbitrary commands.npm · pulverizr
- CVE-2020-7602node-prompt-here through 1.0.1 allows execution of arbitrary commands.npm · node-prompt-here
- CVE-2020-7601gulp-scss-lint through 1.0.0 allows execution of arbitrary commands.npm · gulp-scss-lint
- CVE-2020-10237An issue was discovered in Froxlor through 0.10.15.Packagist · froxlor/froxlor
- CVE-2020-2158Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rMaven · org.jenkins-ci.plugins:literate
- CVE-2020-2159Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins mastMaven · io.jenkins.plugins:cryptomove
- CVE-2020-2155Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuratiMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2020-2156Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially rMaven · com.openmake:deployhub
- CVE-2020-2157Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentialMaven · org.jenkins-ci.plugins:skytap
- CVE-2020-2154Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the JeMaven · org.jenkins-ci.plugins:zephyr-for-jira-test-management
- CVE-2020-2151Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration formMaven · org.jenkins-ci.plugins:quality-gates
- CVE-2020-2152Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, reMaven · org.jvnet.hudson.plugins:svn-release-mgr
- CVE-2020-2150Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuratMaven · org.jenkins-ci.plugins:sonar-quality-gates
- CVE-2019-10801enpeem through 2.2.0 allows execution of arbitrary commands.npm · enpeem
- CVE-2019-10802giting version prior to 0.0.8 allows execution of arbritary commands.npm · giting
- CVE-2019-10803push-dir through 0.4.1 allows execution of arbritary commands.npm · push-dir
- CVE-2019-10804serial-number through 1.3.0 allows execution of arbritary commands.npm · serial-number
- CVE-2019-10805valib through 2.0.0 allows Internal Property Tampering.npm · valib
- CVE-2020-8132Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructnpm · pdf-image
- CVE-2020-9447There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality.Maven · com.googlecode.gwtupload:gwtupload
- CVE-2019-10796rpi through 0.0.3 allows execution of arbritary commands.npm · rpi
- CVE-2019-10798rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution.npm · rdf-graph-array
- CVE-2020-5186DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).NuGet · dotnetnuke.core
- CVE-2020-5188DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.NuGet · dotnetnuke.core
- CVE-2020-8441JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function.Maven · org.jyaml:jyaml
- CVE-2019-10794All versions of component-flatten are vulnerable to Prototype Pollution.npm · component-flatten