Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2009-0397Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) PyPI · gstreamer-plugins
- CVE-2009-0386Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) PyPI · gstreamer-plugins
- CVE-2009-0387Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 thPyPI · gstreamer-plugins
- CVE-2008-4524SQL injection vulnerability in the "Check User" feature (includes/check_user.php) in AdaptCMS Lite and AdaptCMS Pro 1.3 allows remote attackPackagist · adaptcms/adaptcms
- CVE-2008-1396Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, PyPI · plone
- CVE-2008-1098Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HPyPI · moin
- CVE-2008-1099_macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected PyPI · moin
- CVE-2008-0781Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject aPyPI · moin
- CVE-2008-0782Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a ..PyPI · moin
- CVE-2007-6286Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty requeMaven · org.apache.tomcat:tomcat
- CVE-2007-5342The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict cMaven · org.apache.tomcat:tomcat-juli
- CVE-2002-2272Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desMaven · org.apache.tomcat:tomcat
- CVE-2007-5461Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, unMaven · org.apache.tomcat:tomcat
- CVE-2007-4724Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attacMaven · org.apache.tomcat:tomcat
- CVE-2007-3382Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters Maven · org.apache.tomcat:tomcat
- CVE-2007-3385Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" characterMaven · org.apache.tomcat:tomcat
- CVE-2007-3384Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackMaven · org.apache.tomcat:tomcat
- CVE-2007-3383Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache TomcaMaven · org.apache.tomcat:tomcat
- CVE-2007-2449Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.Maven · org.apache.tomcat:tomcat
- CVE-2005-4836The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allMaven · org.apache.tomcat:tomcat
- CVE-2007-1358Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remMaven · org.apache.tomcat:tomcat
- CVE-2006-7197The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callbacMaven · org.apache.tomcat:tomcat
- CVE-2006-2758Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ..Maven · org.mortbay.jetty:jetty
- CVE-2006-2458Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_reaPyPI · extractor
- CVE-2005-4703Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that containsMaven · org.apache.tomcat:tomcat
- CVE-2005-3745Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary webMaven · org.apache.struts:struts-core
- CVE-2005-3164The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standaMaven · org.apache.tomcat:tomcat
- CVE-2005-2875Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.PyPI · py2play
- CVE-2002-2009Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, Maven · org.apache.tomcat:tomcat
- CVE-2005-2090Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application fiMaven · org.apache.tomcat:tomcat