Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-12679The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications PyPI · coapthon3
- CVE-2019-10686An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT.Maven · com.ctrip.framework.apollo:apollo
- CVE-2019-9648An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674.NuGet · coreftp
- CVE-2019-7539A code injection issue was discovered in ipycache through 2016-05-31.PyPI · ipycache
- CVE-2018-14486DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.NuGet · dotnetnuke.core
- CVE-2019-5416A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the remnpm · localhost-now
- CVE-2018-19917Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.Packagist · microweber/microweber
- CVE-2019-9737Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC="data:image/svg+xml' substring.npm · editor.md
- CVE-2018-16809An issue was discovered in Dolibarr through 7.0.0.Packagist · dolibarr/dolibarr
- CVE-2019-1003008A cross-site request forgery vulnerability exists in Jenkins Warnings Next Generation Plugin 2.1.1 and earlier in src/main/java/io/jenkins/pMaven · io.jenkins.plugins:warnings-ng
- CVE-2019-1000001TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can rePackagist · nilsteampassnet/teampass
- CVE-2018-16481A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absnpm · html-pages
- CVE-2018-16482A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive informanpm · mcstatic
- CVE-2018-16486A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prnpm · defaults-deep
- CVE-2018-16493A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the servnpm · static-resource-server
- CVE-2018-20682Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).Packagist · forkcms/forkcms
- CVE-2018-20594An issue was discovered in hsweb 3.0.4.Maven · org.hswebframework.web:hsweb-commons
- CVE-2018-20595A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter inMaven · org.hswebframework.web:hsweb-commons
- CVE-2018-16630Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.Packagist · getkirby/kirby
- CVE-2018-19799Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.Packagist · dolibarr/dolibarr
- CVE-2018-20465Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demPackagist · craftcms/cms
- CVE-2018-20418index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.Packagist · craftcms/cms
- CVE-2018-20325There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python.PyPI · definitions
- CVE-2018-1000836bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser thaMaven · org.bedework.caleng:bw-calendar-engine
- CVE-2018-20133ymlref allows code injection.PyPI · ymlref
- CVE-2018-14623A SQL injection flaw was found in katello's errata-related API.RubyGems · katello
- CVE-2018-20094An issue was discovered in XXL-CONF 1.6.0.Maven · com.xuxueli:xxl-conf-admin
- CVE-2018-20096There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3.PyPI · exiv2
- CVE-2018-20098There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.PyPI · exiv2
- CVE-2018-20099There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3.PyPI · exiv2