Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-32191rke's credentials are stored in the RKE1 Cluster state ConfigMapGo · github.com/rancher/rke · fixed in 1.4.19, 1.5.10
- CVE-2023-32188JWT token compromise can allow malicious actions including Remote Code Execution (RCE)Go · github.com/neuvector/neuvector · fixed in 0.0.0-20231003121714-be746957ee7c
- CVE-2023-22650Rancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderGo · github.com/rancher/rancher · fixed in 2.7.14, 2.8.5
- CVE-2023-22649Rancher 'Audit Log' leaks sensitive informationGo · github.com/rancher/rancher · fixed in 2.6.14, 2.7.10, 2.8.2
- CVE-2024-9594VM images built with Image Builder with some providers use default credentials during buildsGo · github.com/kubernetes-sigs/image-builder · fixed in 0.1.38
- CVE-2024-9486VM images built with Image Builder and Proxmox provider use default credentialsGo · github.com/kubernetes-sigs/image-builder · fixed in 0.1.38
- CVE-2024-44337The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML.Go · github.com/gomarkdown/markdown · fixed in 0.0.0-20240729212818-a2a9c4f76ef5
- CVE-2024-48909SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is notGo · github.com/authzed/spicedb · fixed in 1.37.1
- CVE-2024-46528An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x Go · github.com/kubesphere/kubesphere · fixed in 4.1.3, 3.4.1
- CVE-2024-38365btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionalityGo · github.com/btcsuite/btcd · fixed in 0.24.2-beta.rc1
- CVE-2024-47877Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.Go · github.com/codeclysm/extract, github.com/codeclysm/extract/v3 +1 · fixed in 4.0.0
- CVE-2024-9180Vault Operators in Root Namespace May Elevate Their PrivilegesGo · github.com/hashicorp/vault, github.com/openbao/openbao · fixed in 1.18.0, 2.0.3
- CVE-2024-9312Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions.Go · github.com/ubuntu/authd · fixed in 0.3.6
- CVE-2024-47832XML Signature Bypass via differential XML parsing in ssoreadyGo · github.com/ssoready/ssoready · fixed in 0.0.0-20241009153838-7f92a0630439
- CVE-2024-9675Buildah: buildah allows arbitrary directory mountGo · github.com/containers/buildah · fixed in 1.38.0, 1.37.1
- CVE-2024-36814An arbitrary file read vulnerability in Adguard Home before v0.107.52 allows authenticated attackers to access arbitrary files as root on thGo · github.com/adguardteam/adguardhome · fixed in 0.107.53
- CVE-2024-9313Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform anGo · github.com/ubuntu/authd · fixed in 0.3.5, 0.0.0-20240930103526-63e527496b01
- CVE-2024-47616Pomerium's service account access token may grant unintended access to databroker APIGo · github.com/pomerium/pomerium · fixed in 0.27.1
- CVE-2024-8038Vulnerable juju introspection abstract UNIX domain socket.Go · github.com/juju/juju · fixed in 0.0.0-20240829052008-43f0fc59790d
- CVE-2024-8037Vulnerable juju hook tool abstract UNIX domain socket.Go · github.com/juju/juju · fixed in 0.0.0-20240820065804-2f2ec128ef5a
- CVE-2024-7558JUJU_CONTEXT_ID is a predictable authentication secret.Go · github.com/juju/juju · fixed in 0.0.0-20240826044107-ecd7e2d0e986
- CVE-2024-33662Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.Go · github.com/portainer/portainer · fixed in 2.20.2
- CVE-2024-9407Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instructionGo · github.com/containers/buildah, github.com/containers/podman +4 · fixed in 1.37.4, 5.2.4
- CVE-2024-9341Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go libraryGo · github.com/containers/common · fixed in 0.60.4
- CVE-2024-9355Golang-fips: golang fips zeroed bufferGo · github.com/golang-fips/openssl
- CVE-2024-47534Incorrect delegation lookups can make go-tuf download the wrong artifactGo · github.com/theupdateframework/go-tuf/v2 · fixed in 2.0.1
- CVE-2024-47067Alist Contains a Reflected Cross-Site Scripting VulnerabilityGo · github.com/alist-org/alist, github.com/alist-org/alist/v3 · fixed in 3.29.0
- CVE-2024-47182Dozzle uses unsafe hash for passwordsGo · github.com/amir20/dozzle · fixed in 8.5.3
- CVE-2024-7594Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By DefaultGo · github.com/hashicorp/vault, github.com/openbao/openbao · fixed in 1.17.6, 0.0.0-20241003222810-d5b4e9224698
- CVE-2024-45042Ory Kratos's `highest_available` setting does not properly respect code + mfa credentialsGo · github.com/ory/kratos · fixed in 1.3.0