Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-1000120A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of seNuGet · curl
- CVE-2018-1000126Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeratPyPI · ajenti-panel
- CVE-2018-1000080Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins asPyPI · ajenti-panel
- CVE-2018-1000081Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server CrashinPyPI · ajenti-panel
- CVE-2018-1000082Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to managePyPI · ajenti-panel
- CVE-2018-1000083Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a pPyPI · ajenti-panel
- CVE-2018-7302Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.Packagist · tikiwiki/tiki-manager
- CVE-2018-7261There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4.RubyGems · radiant
- CVE-2017-1000507Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and exPackagist · austintoddj/canvas
- CVE-2018-1000023Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpointnpm · insight-api
- CVE-2018-6594lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive PyPI · pycrypto
- CVE-2014-1834The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semiRubyGems · echor
- CVE-2014-1835The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watchinRubyGems · echor
- CVE-2018-6464Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.npm · simditor
- CVE-2017-1000403Jenkins Speaks! Plugin, all current versions, allows users with Job/Configure permission to run arbitrary Groovy code inside the Jenkins JVMMaven · org.jvnet.hudson.plugins:speaks
- CVE-2018-1000011Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackersMaven · org.jvnet.hudson.plugins.findbugs:library
- CVE-2018-5960Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.Packagist · tribalsystems/zenario
- CVE-2014-4991(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials oRubyGems · codders-dataset
- CVE-2014-4992lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtRubyGems · cap-strap
- CVE-2014-4993(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for RubyRubyGems · backup-agoddard, backup_checksum
- CVE-2014-4995Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reRubyGems · vladtheenterprising
- CVE-2014-4996lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmRubyGems · vladtheenterprising
- CVE-2014-4997lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain seRubyGems · point-cli
- CVE-2014-4998test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local uRubyGems · lean-ruport
- CVE-2014-4999vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldumpRubyGems · kajam
- CVE-2014-5000The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local usersRubyGems · lawn-login
- CVE-2014-5001lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psRubyGems · kcapifony
- CVE-2014-5003chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary fRubyGems · ciborg
- CVE-2014-5004lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtaiRubyGems · brbackup
- CVE-2018-5215Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.Packagist · forkcms/forkcms