Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-4318File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.RubyGems · features
- CVE-2019-17571Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exeMaven · log4j:log4j, org.zenframework.z8.dependencies.commons:log4j-1.2.17
- CVE-2019-15596A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within tnpm · statics-server
- CVE-2019-15597A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.npm · node-df
- CVE-2019-15600A Path traversal exists in http_server which allows an attacker to read arbitrary system files.npm · http_server
- CVE-2019-19634class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, Packagist · verot/class.upload.php
- CVE-2019-16576A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to conMaven · io.alauda.jenkins.plugins:alauda-kubernetes-support
- CVE-2019-16574A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to conneMaven · com.alauda.jenkins.plugins:alauda-devops-pipeline
- CVE-2019-16575A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an atMaven · io.alauda.jenkins.plugins:alauda-kubernetes-support
- CVE-2019-16571A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attaMaven · org.jenkins-ci.plugins:rapiddeploy-jenkins
- CVE-2019-16572Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can Maven · org.jenkins-ci.plugins:weibo
- CVE-2019-16573A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attaMaven · com.alauda.jenkins.plugins:alauda-devops-pipeline
- CVE-2019-16569A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified weMaven · org.jenkins-ci.plugins:mantis
- CVE-2019-16570A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specifieMaven · org.jenkins-ci.plugins:rapiddeploy-jenkins
- CVE-2019-16567A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access tMaven · org.jenkins-ci.plugins:teamconcert
- CVE-2019-16568Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configurMaven · hudson.plugins.sctmexecutor:sctmexecutor
- CVE-2019-16565A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-speciMaven · org.jenkins-ci.plugins:teamconcert
- CVE-2019-16566A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an aMaven · org.jenkins-ci.plugins:teamconcert
- CVE-2019-16563Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a storedMaven · tech.andrey.jenkins:mission-control-view
- CVE-2019-16560A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tesMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-16561Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validaMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-16562Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerMaven · org.jenkins-ci.plugins:buildgraph-view
- CVE-2019-16559A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform cMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-19771The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name.npm · lodahs
- CVE-2019-19729An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js.npm · bson-objectid
- CVE-2013-2095rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injectionRubyGems · openshift-origin-controller
- CVE-2019-10769safer-eval is a npm package to sandbox the he evaluation of code used within the eval function.npm · safer-eval
- CVE-2019-14910A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS froMaven · org.keycloak:keycloak-parent
- CVE-2019-19596GitBook through 2.6.9 allows XSS via a local .md file.npm · gitbook
- CVE-2019-14909A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or vMaven · org.keycloak:keycloak-parent