Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-18531text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 usMaven · com.github.penggle:kaptcha
- CVE-2018-18260In the 2.4 version of Camaleon CMS, Stored XSS has been discovered.RubyGems · camaleon_cms
- CVE-2018-17060Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the NuGet · telerikmvcextensions
- CVE-2014-10075The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.RubyGems · karo
- CVE-2018-17876A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product.Packagist · web-feet/coastercms
- CVE-2018-15563_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.Packagist · intelliants/subrion
- CVE-2018-16277The Image Import function in XWiki through 10.7 has XSS.Maven · org.xwiki.platform:xwiki-platform
- CVE-2018-17566In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's rPackagist · topthink/framework
- CVE-2018-17366An issue was discovered in MCMS 4.6.5.Maven · net.mingsoft:ms-mcms
- CVE-2018-17102An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2.Packagist · quickapps/cms
- CVE-2018-16704An issue was discovered in Gleez CMS v1.2.0.Packagist · gleez/cms
- CVE-2018-16551LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.Packagist · lavalite/cms
- CVE-2018-16552MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.PyPI · django-crm
- CVE-2018-16342ShowDoc v1.8.0 has XSS via a new page.Packagist · showdoc/showdoc
- CVE-2018-16347An issue was discovered in Gleez CMS v1.2.0.Packagist · gleez/cms
- CVE-2018-16330Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.npm · editor.md
- CVE-2018-16327There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.Packagist · intelliants/subrion
- CVE-2018-15121An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin.NuGet · auth0-aspnet, auth0-aspnet-owin
- CVE-2018-14572In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle filPyPI · conference-scheduler-cli
- CVE-2018-15845There is a CSRF vulnerability that can add an administrator account in Gleez CMS 1.2.0 via admin/users/add.Packagist · gleez/cms
- CVE-2016-9605A flaw was found in cobbler software component version 2.6.11-1.PyPI · cobbler
- CVE-2018-1000225Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versionPyPI · cobbler
- CVE-2018-1000640OpenCart-Overclocked version <=1.11.1 contains a Cross Site Scripting (XSS) vulnerability in User input entered unsanitised within JS functiPackagist · villagedefrance/opencart-overclocked
- CVE-2018-3784A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.npm · cryo
- CVE-2018-3785A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.npm · git-dummy-commit
- CVE-2018-11770From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism uMaven · org.apache.spark:spark-core_2.10, org.apache.spark:spark-core_2.11
- CVE-2018-3779active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoRubyGems · active-support
- CVE-2017-6213paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.Packagist · paypal/invoice-sdk-php
- CVE-2017-6215paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code ePackagist · paypal/permissions-sdk-php
- CVE-2018-8032Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.Maven · axis:axis, org.apache.axis:axis