Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10790taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-inpm · taffy, taffydb
- CVE-2020-9016Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.Packagist · dolibarr/dolibarr
- CVE-2020-2133Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed bMaven · com.applatix.jenkins:applatix
- CVE-2020-2130Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it cMaven · org.jenkins-ci.plugins:harvest
- CVE-2020-2131Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viMaven · org.jenkins-ci.plugins:harvest
- CVE-2020-2128Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where itMaven · com.catalogic.ecxjenkins:catalogic-ecx
- CVE-2020-2129Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it Maven · com.mobileenerlytics.eagle.tester:eagle-tester
- CVE-2020-2125Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the JenkinsMaven · ru.yandex.jenkins.plugins.debuilder:debian-package-builder
- CVE-2020-2127Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the JenMaven · rpd:bmc-rpd
- CVE-2020-2124Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins mastMaven · com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter
- CVE-2019-18210Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the sPackagist · moodle/moodle
- CVE-2014-8739Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the CrePackagist · blueimp/jquery-file-upload
- CVE-2011-1150bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.Packagist · bbpress/bbpress
- CVE-2019-10786network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.npm · network-manager
- CVE-2019-10787im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument.npm · im-resize
- CVE-2019-10788im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument.npm · im-metadata
- CVE-2019-10783All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection.npm · lsof
- CVE-2020-2108Jenkins WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XXE attacks which can be exploited by a useMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2020-7994Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via thePackagist · dolibarr/dolibarr
- CVE-2020-7995The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.Packagist · dolibarr/dolibarr
- CVE-2020-7996htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.Packagist · dolibarr/dolibarr
- CVE-2019-17570An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpMaven · org.apache.xmlrpc:xmlrpc
- CVE-2020-2096Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerabiMaven · org.jenkins-ci.ruby-plugins:gitlab-hook
- CVE-2011-2715An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column namPackagist · drupal/core
- CVE-2011-2714A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions,Packagist · drupal/core
- CVE-2019-15602The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability innpm · fileview
- CVE-2019-15603The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directorynpm · seeftl
- CVE-2020-5497The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsaMaven · org.mitre:openid-connect-server
- CVE-2019-5063An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2
- CVE-2019-9553Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.Packagist · bolt/bolt