Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-14517pandao Editor.md 1.5.0 allows XSS via the Javascript: string.npm · editor.md
- CVE-2019-5457Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execunpm · min-http-server
- CVE-2019-5458Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to execnpm · http-file-server
- CVE-2019-14315A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1, 3.20-test2, 3.12, and earlier allows remote attackPackagist · sunhater/kcfinder
- CVE-2019-14282The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · simple_captcha2
- CVE-2019-14281The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · datagrid
- CVE-2019-1010206OSS Http Request (Apache Cordova Plugin) 6 is affected by: Missing SSL certificate validation.Maven · com.github.kevinsawicki:http-request
- CVE-2019-1010241Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format.Maven · org.jenkins-ci.plugins:credentials-binding
- CVE-2019-1010113Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS).NuGet · cleditor
- CVE-2019-1010054Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF).Packagist · dolibarr/dolibarr
- CVE-2019-5447A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.npm · http-file-server
- CVE-2019-1010016Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS).Packagist · dolibarr/dolibarr
- CVE-2019-13589The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · paranoid2
- CVE-2019-10350Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usersMaven · org.jenkins-ci.plugins:port-allocator
- CVE-2019-10351Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users witMaven · com.brianfromoregon:caliper-ci
- CVE-2017-6217paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code executionPackagist · paypal/adaptivepayments-sdk-php
- CVE-2019-13114http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by retuPyPI · exiv2
- CVE-2018-15747The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supportsGo · github.com/prasmussen/glot-code-runner
- CVE-2018-15890An issue was discovered in EthereumJ 1.8.2.Maven · org.ethereum:ethereumj-core
- CVE-2019-12799In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, wPackagist · shopware/shopware
- CVE-2019-5442XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amountsMaven · ro.pippo:pippo-jaxb
- CVE-2019-3875A vulnerability was found in keycloak before 6.0.2.Maven · org.keycloak:keycloak-core
- CVE-2019-11881A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary conGo · github.com/rancher/rancher
- CVE-2019-10047A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file pPyPI · pydio
- CVE-2019-10321A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnecMaven · org.jenkins-ci.plugins:artifactory
- CVE-2019-10322A missing permission check in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed useMaven · org.jenkins-ci.plugins:artifactory
- CVE-2019-10323A missing permission check in Jenkins Artifactory Plugin 3.2.3 and earlier in various 'fillCredentialsIdItems' methods allowed users with OvMaven · org.jenkins-ci.plugins:artifactory
- CVE-2019-11082core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in theMaven · de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl
- CVE-2018-13983ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheckPackagist · impresscms/impresscms
- CVE-2018-17202Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which couMaven · org.apache.sanselan:sanselan