Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-6591There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.PyPI · django-epiceditor
- CVE-2017-6589EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration.npm · epiceditor
- CVE-2016-4947Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.npm · gethue
- CVE-2016-10194The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speeRubyGems · festivaltts4r
- CVE-2016-4314Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbMaven · org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui
- CVE-2016-4316Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via tMaven · org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui, org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui +1
- CVE-2013-7459Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers PyPI · pycrypto
- CVE-2017-5605An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includPackagist · movim/moxl
- CVE-2017-5941An issue was discovered in the node-serialize package 0.0.4 for Node.js.npm · node-serialize
- CVE-2017-5630PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect,Packagist · pear/pear
- CVE-2016-4807Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged inPyPI · web2py
- CVE-2016-9187Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated usePackagist · moodle/moodle
- CVE-2016-9188Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML viPackagist · moodle/moodle
- CVE-2016-7190The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupNuGet · microsoft.chakracore
- CVE-2016-7194The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupNuGet · microsoft.chakracore
- CVE-2016-3296The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting EngiNuGet · microsoft.chakracore
- CVE-2016-3248The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, MicrosoftNuGet · microsoft.chakracore
- CVE-2015-0899The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions vMaven · org.apache.struts:struts-core, struts:struts
- CVE-2016-1181ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attaMaven · org.apache.struts:struts-core, struts:struts
- CVE-2016-1182ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackeMaven · org.apache.struts:struts-core, struts:struts
- CVE-2016-1912Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web scripPackagist · dolibarr/dolibarr
- CVE-2015-5062Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and condPackagist · silverstripe/cms, silverstripe/framework
- CVE-2015-2067Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remotPackagist · dweeves/magmi
- CVE-2014-8114The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafMaven · org.uberfire:uberfire-parent
- CVE-2014-8770Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for MagentPackagist · dweeves/magmi
- CVE-2014-3596The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's CMaven · axis:axis, org.apache.axis:axis
- CVE-2014-4036Cross-site scripting (XSS) vulnerability in modules/system/admin.php in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web sPackagist · impresscms/impresscms
- CVE-2014-3840Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authePyPI · mayan-edms
- CVE-2014-3242SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction wiPyPI · soappy
- CVE-2014-2322lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharactRubyGems · arabic-prawn