Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10448Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usMaven · jenkins.xtc:extensivetesting
- CVE-2019-17625There is a stored XSS in Rambox 0.6.9 that can lead to code execution.npm · rambox
- CVE-2019-17433z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen.Packagist · encore/laravel-admin
- CVE-2019-17104In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly fPackagist · centreon/centreon
- CVE-2018-21025In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced Packagist · centreon/centreon
- CVE-2019-17203TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.Packagist · nilsteampassnet/teampass
- CVE-2019-17204TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.Packagist · nilsteampassnet/teampass
- CVE-2019-17205TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt.Packagist · nilsteampassnet/teampass
- CVE-2019-10202A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7.Maven · org.codehaus.jackson:jackson-mapper-asl
- CVE-2019-10434Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulMaven · com.mtvi.plateng.hudson:ldapemail
- CVE-2019-10435Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in Maven · org.jenkins-ci.plugins:vault-scm-plugin
- CVE-2019-16688Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php.Packagist · dolibarr/dolibarr
- CVE-2019-16687Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php.Packagist · dolibarr/dolibarr
- CVE-2019-16686Dolibarr 9.0.5 has stored XSS in a User Note section to note.php.Packagist · dolibarr/dolibarr
- CVE-2019-16685Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php.Packagist · dolibarr/dolibarr
- CVE-2019-9423In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check.PyPI · opencv-contrib-python, opencv-contrib-python-headless +2
- CVE-2019-16904TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admiPackagist · nilsteampassnet/teampass
- CVE-2019-10424Jenkins elOyente Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · com.technicolor:eloyente
- CVE-2019-10425Jenkins Google Calendar Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by userMaven · org.jenkins-ci.plugins:gcal
- CVE-2019-10426Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · net.arangamani.jenkins:gem-publisher
- CVE-2019-10417Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke aMaven · io.fabric8.pipeline:kubernetes-pipeline-steps
- CVE-2019-10418Jenkins Kubernetes :: Pipeline :: Arquillian Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke aMaven · io.fabric8.pipeline:kubernetes-pipeline-arquillian-steps
- CVE-2019-10419Jenkins vFabric Application Director Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where theyMaven · org.jenkins-ci.plugins:application-director-plugin
- CVE-2019-10420Jenkins Assembla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jenkins-ci.plugins:assembla
- CVE-2019-10421Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can bMaven · org.jenkins-ci.plugins:azure-event-grid-notifier
- CVE-2019-10422Jenkins Call Remote Job Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by userMaven · org.ukiuni.callotherjenkins:call-remote-job-plugin
- CVE-2019-10423Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · com.villagechief.codescan.jenkins:codescan
- CVE-2019-16669The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is ePackagist · pagekit/pagekit
- CVE-2019-5485NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability.npm · gitlabhook
- CVE-2019-16145The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.RubyGems · padrino-contrib