Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-5216Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.RubyGems · radiant
- CVE-2017-1000477XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.Packagist · desperado/xml-bundle
- CVE-2017-1000467LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disrupPackagist · lavalite/cms
- CVE-2017-1000420Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwriteGo · github.com/syncthing/syncthing
- CVE-2018-3814Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace itPackagist · craftcms/cms
- CVE-2017-17516scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by thePyPI · rtv
- CVE-2017-17431GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter.Packagist · genix/cms
- CVE-2017-1000406OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cacheMaven · org.opendaylight.integration:distribution-karaf
- CVE-2017-14176Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dPyPI · bzr
- CVE-2017-1000170jqueryFileTree 2.1.5 and older Directory Traversalnpm · jqueryfiletree
- CVE-2017-16763An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0.PyPI · confire
- CVE-2017-16764An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3.PyPI · django-make-app
- CVE-2015-3933Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to executePackagist · genix/cms
- CVE-2014-0115Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a ..Maven · org.apache.storm:storm
- CVE-2016-5002XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackMaven · org.apache.xmlrpc:xmlrpc
- CVE-2016-5003The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a craftedMaven · org.apache.xmlrpc:xmlrpc
- CVE-2017-15374Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend moduPackagist · shopware/shopware
- CVE-2017-15364The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) orRubyGems · ccsv
- CVE-2017-10862jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWMaven · io.really:jwt-scala
- CVE-2017-1000105The optional Run/Artifacts permission can be enabled by setting a Java system property.Maven · io.jenkins.blueocean:blueocean
- CVE-2017-1000119October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other aPackagist · october/cms
- CVE-2017-14761In GeniXCMS 1.1.4, /inc/lib/backend/menus.control.php has XSS via the id parameter.Packagist · genix/cms
- CVE-2017-14762In GeniXCMS 1.1.4, /inc/lib/Control/Backend/menus.control.php has XSS via the id parameter.Packagist · genix/cms
- CVE-2017-14763In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of Packagist · genix/cms
- CVE-2017-14764In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of Packagist · genix/cms
- CVE-2017-14765In GeniXCMS 1.1.4, gxadmin/index.php has XSS via the Menu ID field in a page=menus request.Packagist · genix/cms
- CVE-2017-7549A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack PlatformPyPI · instack, instack-undercloud
- CVE-2017-14158Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are readPyPI · scrapy
- CVE-2015-5695Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas PyPI · designate
- CVE-2017-10844baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.Packagist · baserproject/basercms