Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10593ibapi is an Interactive Brokers API addon for NodeJS.npm · ibapi
- CVE-2016-10601webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver.npm · webdrvr
- CVE-2016-10611strider-sauce is Sauce Labs / Selenium support for Strider.npm · strider-sauce
- CVE-2016-10627scala-bin is a binary wrapper for Scala.npm · scala-bin
- CVE-2016-10650ntfserver is a Network Testing Framework Server.npm · ntfserver
- CVE-2016-10658native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP, which leaves it vulnerable to MITMnpm · native-opencv
- CVE-2016-10659poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks.npm · poco
- CVE-2016-10666tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to Mnpm · tomita-parser
- CVE-2016-10679selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver.npm · selenium-standalone-painful
- CVE-2016-10680adamvr-geoip-lite is a light weight native JavaScript implementation of GeoIP API from MaxMind adamvr-geoip-lite downloads geoip resources onpm · adamvr-geoip-lite
- CVE-2016-10681roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTPnpm · roslib-socketio
- CVE-2016-10682massif is a Phantomjs fork massif downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · massif
- CVE-2016-10698mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP, which leavnpm · mystem-fix
- CVE-2017-16047mysqljs was a malicious module published with the intent to hijack environment variables.npm · mysqljs
- CVE-2017-16061tkinter was a malicious module published with the intent to hijack environment variables.npm · tkinter
- CVE-2017-16153gaoxuyan is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.npm · gaoxuyan
- CVE-2018-3744The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.npm · html-pages
- CVE-2018-11494The "program extension upload" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that aPackagist · opencart/opencart
- CVE-2018-11495OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?rouPackagist · opencart/opencart
- CVE-2017-14740Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the Packagist · genix/cms
- CVE-2018-10225thinkphp 3.1.3 has SQL Injection via the index.php s parameter.Packagist · topthink/framework
- CVE-2018-1000160RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js thnpm · @risingstack/protect
- CVE-2017-18259Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.Packagist · dolibarr/dolibarr
- CVE-2017-18260Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut paramePackagist · dolibarr/dolibarr
- CVE-2018-7035Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML contePackagist · gleez/cms
- CVE-2018-1000145An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.jMaven · org.jvnet.hudson.plugins:perforce
- CVE-2018-1000147An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.jMaven · org.jvnet.hudson.plugins:perforce
- CVE-2018-1000148An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapperMaven · org.jenkins-ci.plugins:copy-to-slave
- CVE-2018-9108CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privilegesPackagist · quickapps/cms
- CVE-2018-1229Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature.Maven · org.springframework.batch:spring-batch-admin-manager