Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-19206Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.Packagist · dolibarr/dolibarr
- CVE-2011-3583It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could Packagist · typo3/cms
- CVE-2019-19013A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.Packagist · pagekit/pagekit
- CVE-2015-5694Designate does not enforce the DNS protocol limit concerning record set sizesPyPI · designate
- CVE-2014-0084Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily RubyGems · openshift-origin-node
- CVE-2019-10172A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries.Maven · org.codehaus.jackson:jackson-mapper-asl
- CVE-2012-0051Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.PyPI · tahoe-lafs
- CVE-2019-17221PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI.npm · phantomjs
- CVE-2019-18608Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting npm · cezerin
- CVE-2019-18409The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files.RubyGems · ruby_parser-legacy
- CVE-2019-17606The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content ofnpm · hexo-admin
- CVE-2019-10474A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to tMaven · org.jenkins-ci.plugins:global-post-script
- CVE-2019-10475A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript intoMaven · org.jenkins-ci.plugins:build-metrics
- CVE-2019-10470A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read accMaven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2019-10468A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-Maven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2019-10469A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect toMaven · com.elasticbox.jenkins-ci.plugins:kubernetes-ci
- CVE-2019-10466An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolvMaven · org.jenkins-ci.plugins.plugin:fireline
- CVE-2019-10464A cross-site request forgery vulnerability in Jenkins Deploy WebLogic Plugin allows attackers to connect to an attacker-specified URL using Maven · org.jenkins-ci.plugins:weblogic-deployer-plugin
- CVE-2019-10465A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specifiMaven · org.jenkins-ci.plugins:weblogic-deployer-plugin
- CVE-2019-17576An issue was discovered in Dolibarr 10.0.2.Packagist · dolibarr/dolibarr
- CVE-2019-17577An issue was discovered in Dolibarr 10.0.2.Packagist · dolibarr/dolibarr
- CVE-2019-17578An issue was discovered in Dolibarr 10.0.2.Packagist · dolibarr/dolibarr
- CVE-2019-10456A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an aMaven · org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic
- CVE-2019-10457A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to coMaven · org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute-classic
- CVE-2019-10458Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers ablMaven · org.jenkins-ci.plugins.workflow:puppet-enterprise-pipeline
- CVE-2019-10453Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:delphix
- CVE-2019-10450Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they canMaven · com.elasticbox.jenkins-ci.plugins:elasticbox
- CVE-2019-10451Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewMaven · com.soasta.jenkins:cloudtest
- CVE-2019-10452Jenkins View26 Test-Reporting Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed bMaven · org.jenkins-ci.plugins:view26
- CVE-2019-10447Jenkins Sofy.AI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with EMaven · io.jenkins.plugins:sofy-ai