Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-3649The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" folloRubyGems · open-uri-cached
- CVE-2015-2674Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the defaultPyPI · restkit
- CVE-2017-11675The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which Packagist · zencart/zencart
- CVE-2017-11127Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header.Packagist · bolt/bolt
- CVE-2017-11128Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry.Packagist · bolt/bolt
- CVE-2017-9791The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message tMaven · org.apache.struts:struts2-struts1-plugin
- CVE-2017-6086Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attacPackagist · opensolutions/vimbadmin
- CVE-2017-9840Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code executionPackagist · dolibarr/dolibarr
- CVE-2016-5004The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (Maven · org.apache.xmlrpc:xmlrpc-common
- CVE-2017-9239An issue was discovered in Exiv2 0.26.PyPI · exiv2
- CVE-2017-5870Multiple cross-site scripting (XSS) vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via thPackagist · opensolutions/vimbadmin
- CVE-2016-4879Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the autPackagist · baserproject/basercms
- CVE-2017-7886Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.Packagist · dolibarr/dolibarr
- CVE-2017-7887Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.Packagist · dolibarr/dolibarr
- CVE-2017-7888Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.Packagist · dolibarr/dolibarr
- CVE-2017-8879Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackPackagist · dolibarr/dolibarr
- CVE-2017-8874Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for Packagist · mautic/core
- CVE-2017-8298cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.Packagist · austintoddj/canvas
- CVE-2016-6902lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.PyPI · limited-shell
- CVE-2016-6903lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.PyPI · limited-shell
- CVE-2017-3590Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python).PyPI · mysql-connector-python
- CVE-2017-1000360StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql.Maven · org.opendaylight.controller:releasepom
- CVE-2017-1000361DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight.Maven · org.opendaylight.controller:releasepom
- CVE-2013-7463The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allowsRubyGems · aescrypt
- CVE-2017-7725concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on instPackagist · concrete5/concrete5
- CVE-2017-7390A Cross-Site Scripting (XSS) was discovered in 'SocialNetwork v1.2.1'.Packagist · movingbytes/social-network
- CVE-2015-8234The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted PyPI · glance
- CVE-2017-7298In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVGPackagist · moodle/moodle
- CVE-2017-6068Subrion CMS 4.0.5 has CSRF in admin/blocks/add/.Packagist · intelliants/subrion
- CVE-2017-6370TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtainPackagist · typo3/cms