Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-20097There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3.PyPI · exiv2
- CVE-2018-19907A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18.Maven · org.craftercms:crafter-studio
- CVE-2018-1002103In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000.Go · k8s.io/minikube
- CVE-2018-16629panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.Packagist · intelliants/subrion
- CVE-2018-16478A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.npm · simplehttpserver
- CVE-2018-19784The str_rot_pass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier foPackagist · athlon1600/php-proxy
- CVE-2018-19621server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.Packagist · showdoc/showdoc
- CVE-2018-17256Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the NuGet · umbraco
- CVE-2018-19609ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading notePackagist · showdoc/showdoc
- CVE-2018-19458In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnePackagist · athlon1600/php-proxy-app
- CVE-2018-9209Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2Packagist · fineuploader/php-traditional-server
- CVE-2018-17190In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'woMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11
- CVE-2018-14655A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final.Maven · org.keycloak:keycloak-parent
- CVE-2018-14658A flaw was found in JBOSS Keycloak 3.2.1.Final.Maven · org.keycloak:keycloak-core
- CVE-2018-19246PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell accessPackagist · athlon1600/php-proxy
- CVE-2018-19183ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" npm · ethereumjs-vm
- CVE-2018-19133In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.Packagist · flarum/framework
- CVE-2018-19056pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.npm · editor.md
- CVE-2018-19057SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandlenpm · simplemde
- CVE-2018-16473A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.npm · takeapeek
- CVE-2018-16474A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.npm · tianma-static
- CVE-2018-16475A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.npm · knightjs
- CVE-2018-18830An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5.Maven · net.mingsoft:ms-mcms
- CVE-2018-18831An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5.Maven · net.mingsoft:ms-mcms
- CVE-2018-18548ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.PyPI · ajenti
- CVE-2018-11804Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation.Maven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11
- CVE-2018-18546ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the kePackagist · topthink/framework
- CVE-2018-18420Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizPackagist · tribalsystems/zenario
- CVE-2018-18529ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles thPackagist · topthink/framework
- CVE-2018-18530ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregatePackagist · topthink/framework