Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10696windows-latestchromedriver downloads the latest version of chromedriver.exe.npm · windows-latestchromedriver
- CVE-2016-10697react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native.npm · react-native-baidu-voice-synthesizer
- CVE-2017-0928html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variablenpm · html-janitor
- CVE-2017-0930augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read conpm · augustine
- CVE-2017-16009ag-grid is an advanced data grid that is library agnostic.npm · ag-grid
- CVE-2017-16020Summit is a node web framework.npm · summit
- CVE-2017-16022Morris.js creates an svg graph, with labels that appear when hovering over a point.npm · morris.js
- CVE-2017-16024The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9.npm · sync-exec
- CVE-2017-16035The hubl-server module is a wrapper for the HubL Development Server.npm · hubl-server
- CVE-2017-16036`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`.npm · badjs-sourcemap-server
- CVE-2017-16037`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in thnpm · gomeplus-h5-proxy
- CVE-2017-16039`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plnpm · hftp
- CVE-2017-16040gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attanpm · gfe-sass
- CVE-2017-16044`d3.js` was a malicious module published with the intent to hijack environment variables.npm · d3.js
- CVE-2017-16045`jquery.js` was a malicious module published with the intent to hijack environment variables.npm · jquery.js
- CVE-2017-16048`node-sqlite` was a malicious module published with the intent to hijack environment variables.npm · node-sqlite
- CVE-2017-16049`nodesqlite` was a malicious module published with the intent to hijack environment variables.npm · nodesqlite
- CVE-2017-16050`sqlite.js` was a malicious module published with the intent to hijack environment variables.npm · sqlite.js
- CVE-2017-16051`sqliter` was a malicious module published with the intent to hijack environment variables.npm · sqliter
- CVE-2017-16052`node-fabric` was a malicious module published with the intent to hijack environment variables.npm · node-fabric
- CVE-2017-16053`fabric-js` was a malicious module published with the intent to hijack environment variables.npm · fabric-js
- CVE-2017-16054`nodefabric` was a malicious module published with the intent to hijack environment variables.npm · nodefabric
- CVE-2017-16055`sqlserver` was a malicious module published with the intent to hijack environment variables.npm · sqlserver
- CVE-2016-10636grunt-ccompiler is a Closure Compiler Grunt Plugin.npm · grunt-ccompiler
- CVE-2016-10637haxe-dev is a cross-platform toolkit.npm · haxe-dev
- CVE-2016-10639redis-srvr is a npm wrapper for redis-server.npm · redis-srvr
- CVE-2016-10640node-thulac is a node binding for thulac.npm · node-thulac
- CVE-2016-10641node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · node-bsdiff-android
- CVE-2016-10642cmake installs the cmake x86 linux binaries.npm · cmake
- CVE-2016-10643jstestdriver is a wrapper for Google's jstestdriver.npm · jstestdriver