Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16200uv-tj-demo is a static file server.npm · uv-tj-demo
- CVE-2017-16201zjjserver is a static file server.npm · zjjserver
- CVE-2017-16202The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installatnpm · cofeescript
- CVE-2017-16203The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installanpm · coffe-script
- CVE-2017-16204The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.npm · jquey
- CVE-2017-16205The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installatnpm · coffescript
- CVE-2017-16206The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installanpm · cofee-script
- CVE-2017-16207discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.npm · discordi.js
- CVE-2017-16208dmmcquay.lab6 is a REST server.npm · dmmcquay.lab6
- CVE-2017-16209enserver is a simple web server.npm · enserver
- CVE-2017-16210jn_jj_server is a static file server.npm · jn_jj_server
- CVE-2017-16211lessindex is a static file server.npm · lessindex
- CVE-2017-16212ltt is a static file server.npm · ltt
- CVE-2017-16213mfrserver is a simple file server.npm · mfrserver
- CVE-2017-16214peiserver is a static file server.npm · peiserver
- CVE-2017-16215sgqserve is a simple file server.npm · sgqserve
- CVE-2017-16216tencent-server is a simple web server.npm · tencent-server
- CVE-2017-16217fbr-client sends files through sockets via socket.io and webRTC.npm · fbr-client
- CVE-2017-16218dgard8.lab6 is a static file server.npm · dgard8.lab6
- CVE-2017-16219yttivy is a static file server.npm · yttivy
- CVE-2017-16220wind-mvc is an mvc framework.npm · wind-mvc
- CVE-2017-16221yzt is a simple file server.npm · yzt
- CVE-2017-16222elding is a simple web server.npm · elding
- CVE-2017-16223nodeaaaaa is a static file server.npm · nodeaaaaa
- CVE-2018-3724general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious npm · general-file-server
- CVE-2018-3727626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read contentnpm · 626
- CVE-2018-3730mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to reanpm · mcstatic
- CVE-2018-3735bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in templatenpm · bracket-template
- CVE-2018-1000196A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_nMaven · org.jenkins-ci.ruby-plugins:gitlab-hook
- CVE-2016-10695The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings.npm · npm-test-sqlite3-trunk