Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-14835Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.Packagist · intelliants/subrion
- CVE-2017-2650It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commMaven · cprice404:pipeline-classpath
- CVE-2017-7545It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files.Maven · org.jbpm.jbpm5:jbpmmigration
- CVE-2018-1999021Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary webPackagist · gleez/cms
- CVE-2018-3771An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browsenpm · statics-server
- CVE-2018-14009Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.Packagist · codiad/codiad
- CVE-2018-13439WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.Maven · com.github.wxpay:wxpay-sdk
- CVE-2018-13339Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute ofnpm · angular-redactor
- CVE-2018-3766Path traversal in buttle module versions <= 0.2.0 allows to read any file in the server.npm · buttle
- CVE-2018-3767`memjs` versions <= 1.1.0 allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage.npm · memjs
- CVE-2018-3751The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object whenpm · merge-recursive
- CVE-2018-3753The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when npm · merge-object
- CVE-2018-3754Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of usernpm · query-mysql
- CVE-2018-13067/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change Packagist · opencart/opencart
- CVE-2018-13003An issue was discovered in OpenTSDB 2.3.0.Maven · net.opentsdb:opentsdb
- CVE-2018-12972An issue was discovered in OpenTSDB 2.3.0.Maven · net.opentsdb:opentsdb
- CVE-2018-12973An issue was discovered in OpenTSDB 2.3.0.Maven · net.opentsdb:opentsdb
- CVE-2018-1000523topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of dPyPI · topydo
- CVE-2018-0569baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbiPackagist · baserproject/basercms
- CVE-2018-0570Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote aPackagist · baserproject/basercms
- CVE-2018-0574Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote aPackagist · baserproject/basercms
- CVE-2018-0575baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction Packagist · baserproject/basercms
- CVE-2018-12532JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapperMaven · org.richfaces:richfaces-core
- CVE-2018-12533JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitMaven · org.richfaces:richfaces-core
- CVE-2018-12290The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.Packagist · ptheofan/yii2-statemachine
- CVE-2017-3199GraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserializationMaven · org.graniteds:granite-core
- CVE-2017-3200The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code controlMaven · org.graniteds:granite-server-core
- CVE-2017-3202The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code controlMaven · com.exadel.flamingo.flex:amf-serializer
- CVE-2017-3203Pivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserializationMaven · org.springframework.flex:spring-flex
- CVE-2017-16056mssql.js was a malicious module published with the intent to hijack environment variables.npm · mssql.js