Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-17201Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attackMaven · org.apache.sanselan:sanselan
- CVE-2019-0227A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.Maven · axis:axis, org.apache.axis:axis
- CVE-2019-10309Jenkins Self-Organizing Swarm Plug-in Modules Plugin clients that use UDP broadcasts to discover Jenkins masters do not prevent XML ExternalMaven · org.jenkins-ci.plugins:swarm
- CVE-2019-10313Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:twitter
- CVE-2019-10314Jenkins Koji Plugin disables SSL/TLS and hostname verification globally for the Jenkins master JVM.Maven · org.jenkins-ci.plugins:koji
- CVE-2018-20434LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.Packagist · librenms/librenms
- CVE-2019-9845madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, NuGet · madskristensen.aspnetcore.miniblog
- CVE-2019-11018application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-based credentials afterPackagist · zoujingli/thinkadmin
- CVE-2019-10288Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · de.e-nexus:jabber-server-plugin
- CVE-2019-10292A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackMaven · org.jenkins-ci.plugins:kmap-jenkins
- CVE-2019-10293A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with OverallMaven · org.jenkins-ci.plugins:kmap-jenkins
- CVE-2019-10294Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with ExteMaven · org.jenkins-ci.plugins:kmap-jenkins
- CVE-2019-10295Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:crittercism-dsym
- CVE-2019-10296Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieMaven · com.urbancode.ds.jenkins.plugins:sra-deploy
- CVE-2019-10297Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jenkins-ci.plugins:sametime
- CVE-2019-10298Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users Maven · org.jenkins-ci.plugins:koji
- CVE-2019-10299Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can beMaven · com.cloudcoreo.plugins:cloudcoreo-deploytime
- CVE-2019-1003086A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection foMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2019-1003087A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation meMaven · org.jenkins-ci.plugins:sinatra-chef-builder
- CVE-2019-1003088Jenkins Fabric Beta Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed bMaven · egor-n:fabric-beta-publisher
- CVE-2019-1003090A cross-site request forgery vulnerability in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validatiMaven · com.soasta.jenkins:cloudtest
- CVE-2019-1003091A missing permission check in Jenkins SOASTA CloudTest Plugin in the CloudTestServer.DescriptorImpl#doValidate form validation method allowsMaven · com.soasta.jenkins:cloudtest
- CVE-2019-1003094Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jenkins-ci.plugins:open-stf
- CVE-2019-1003095Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieweMaven · org.jenkins-ci.plugins:perfectomobile
- CVE-2019-1003097Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where theyMaven · com.ds.tools.hudson:crowd
- CVE-2019-10277Jenkins StarTeam Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Maven · hudson.plugins:starteam
- CVE-2019-10278A cross-site request forgery vulnerability in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validationMaven · org.jenkins-ci.plugins:jenkins-reviewbot
- CVE-2019-10279A missing permission check in Jenkins jenkins-reviewbot Plugin in the ReviewboardDescriptor#doTestConnection form validation method allows aMaven · org.jenkins-ci.plugins:jenkins-reviewbot
- CVE-2019-10281Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master Maven · org.jenkins-ci.plugins:relution-publisher
- CVE-2019-10284Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wMaven · org.jenkins-ci.plugins:diawi-upload