Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-10285Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · org.jenkins-ci.plugins:minio-storage
- CVE-2019-1003056Jenkins WebSphere Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by uMaven · org.jenkins-ci.plugins:websphere-deployer
- CVE-2019-1003057Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieMaven · org.jenkins-ci.plugins:bitbucket-approve
- CVE-2019-1003058A cross-site request forgery vulnerability in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attMaven · org.jvnet.hudson.plugins:ftppublisher
- CVE-2019-1003059A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with OverMaven · org.jvnet.hudson.plugins:ftppublisher
- CVE-2019-1003060Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viMaven · org.jenkins-ci.plugins:zap
- CVE-2019-1003061Jenkins jenkins-cloudformation-plugin Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be Maven · org.jenkins-ci.plugins:jenkins-cloudformation-plugin
- CVE-2019-1003062Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where theMaven · org.jenkins-ci.plugins:aws-cloudwatch-logs-publisher
- CVE-2019-1003065Jenkins CloudShare Docker-Machine Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they caMaven · org.jenkins-ci.plugins:cloudshare-docker
- CVE-2019-1003066Jenkins Bugzilla Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by usMaven · org.jvnet.hudson.plugins:bugzilla
- CVE-2019-1003067Jenkins Trac Publisher Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by usersMaven · org.jenkins-ci.plugins:trac-publisher-plugin
- CVE-2019-1003068Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be vieMaven · com.inkysea.vmware.vra:vmware-vrealize-automation-plugin
- CVE-2019-1003070Jenkins veracode-scanner Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewMaven · org.jenkins-ci.plugins:veracode-scanner
- CVE-2019-1003072Jenkins WildFly Deployer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by useMaven · org.jenkins-ci.plugins:wildfly-deployer
- CVE-2019-1003073Jenkins VS Team Services Continuous Deployment Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where theMaven · org.jenkins-ci.plugins:vsts-cd
- CVE-2019-1003074Jenkins Hyper.sh Commons Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewMaven · sh.hyper.plugins:hyper-commons
- CVE-2019-1003075Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vieMaven · org.jenkins-ci.plugins:audit2db
- CVE-2019-1003076A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection foMaven · org.jenkins-ci.plugins:audit2db
- CVE-2019-1003077A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation meMaven · org.jenkins-ci.plugins:audit2db
- CVE-2019-1003078A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection forMaven · org.jenkins-ci.plugins:labmanager
- CVE-2019-1003079A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation metMaven · org.jenkins-ci.plugins:labmanager
- CVE-2019-1003080A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2019-1003081A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form validMaven · org.jenkins-ci.plugins:openshift-deployer
- CVE-2019-1003051Jenkins IRC Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users wMaven · org.jvnet.hudson.plugins:ircbot
- CVE-2019-1003052Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where tMaven · org.jenkins-ci.plugins:aws-beanstalk-publisher-plugin
- CVE-2019-1003053Jenkins HockeyApp Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users withMaven · org.jenkins-ci.plugins:hockeyapp
- CVE-2019-1003054Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by uMaven · info.bluefloyd.jenkins:jenkins-jira-issue-updater
- CVE-2019-1003055Jenkins FTP publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed Maven · org.jvnet.hudson.plugins:ftppublisher
- CVE-2019-5422XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitnpm · buttle
- CVE-2018-12680The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service inPyPI · coapthon