Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10665An issue was discovered in LibreNMS through 1.47.Packagist · librenms/librenms
- CVE-2019-16148Sakai through 12.6 allows XSS via a chat user name.Maven · org.sakaiproject:chat-base
- CVE-2019-15952An issue was discovered in Total.js CMS 12.0.0.npm · total4
- CVE-2019-15953An issue was discovered in Total.js CMS 12.0.0.npm · total4
- CVE-2019-15954An issue was discovered in Total.js CMS 12.0.0.npm · total4
- CVE-2019-14470cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/sPackagist · cosenary/instagram
- CVE-2019-5480A path traversal vulnerability in <= v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders.npm · statichttpserver
- CVE-2019-15630Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before AuguMaven · org.mule.runtime:mule
- CVE-2019-11457Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-passPyPI · django-crm
- CVE-2019-15546An issue was discovered in the pancurses crate through 0.16.1 for Rust.crates.io · pancurses
- CVE-2019-15547An issue was discovered in the ncurses crate through 5.99.0 for Rust.crates.io · ncurses
- CVE-2019-15548An issue was discovered in the ncurses crate through 5.99.0 for Rust.crates.io · ncurses
- CVE-2016-10933An issue was discovered in the portaudio crate through 0.7.0 for Rust.crates.io · portaudio
- CVE-2019-10387A missing permission check in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection allows users withMaven · com.xebialabs.xlt.ci:xltestview-plugin
- CVE-2019-10388A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to havMaven · org.jenkins-ci.plugins:relution-publisher
- CVE-2019-10389A missing permission check in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiaMaven · org.jenkins-ci.plugins:relution-publisher
- CVE-2019-10373A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipelMaven · org.jenkins-ci.plugins:build-pipeline-plugin
- CVE-2019-10374A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions aMaven · org.jenkins-ci.plugins:pegdown-formatter
- CVE-2019-10375An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins toMaven · hudson.plugins.filesystem_scm:filesystem_scm
- CVE-2019-10376A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML aMaven · org.jenkins-ci.plugins:jenkinswalldisplay
- CVE-2019-10377A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any usMaven · net.hurstfrost.jenkins:avatar
- CVE-2019-10378Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they caMaven · org.jenkins-ci.plugins:testlink
- CVE-2019-10379Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the JeMaven · org.jenkins-ci.plugins:gcm-notification
- CVE-2019-10380Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attacMaven · org.jenkins-ci.plugins:simple-travis-runner
- CVE-2019-10381Jenkins Codefresh Integration Plugin 1.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jenkins-ci.plugins:codefresh
- CVE-2019-10382Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jenkins-ci.plugins:labmanager
- CVE-2019-10385Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be vieweMaven · org.jenkins-ci.plugins:eggplant-plugin
- CVE-2019-10386A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptor#doTestConnection aMaven · com.xebialabs.xlt.ci:xltestview-plugin
- CVE-2019-12950An issue was discovered in TeamPass 2.1.27.35.Packagist · nilsteampassnet/teampass
- CVE-2019-14653pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.npm · editor.md