Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-8462Windmill HTTP Request users.rs excessive authenticationGo · github.com/windmill-labs/windmill
- CVE-2024-45395Unbounded loop over untrusted input can lead to endless data attackGo · github.com/sigstore/sigstore-go · fixed in 0.6.1
- CVE-2024-43405Nuclei Template Signature Verification BypassGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.3.2
- CVE-2024-45310runc can be confused to create empty files/directories on the hostGo · github.com/opencontainers/runc · fixed in 1.1.14, 1.2.0-rc.3
- CVE-2024-43803BMO can expose particularly named secrets from other namespaces via BMH CRDGo · github.com/metal3-io/baremetal-operator · fixed in 0.8.0, 0.6.2, 0.5.2
- CVE-2024-45388Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)Go · github.com/spectolabs/hoverfly · fixed in 1.10.3
- CVE-2024-8365Vault Leaks AppRole Client Tokens And Accessor in Audit LogGo · github.com/hashicorp/vault · fixed in 1.17.5
- CVE-2024-8260OPA SMB Force-AuthenticationGo · github.com/open-policy-agent/opa · fixed in 0.68.0
- CVE-2024-45436extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.Go · github.com/ollama/ollama · fixed in 0.1.47
- CVE-2024-45043OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass VulnerabilityGo · github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver · fixed in 0.108.0
- CVE-2024-45054Potential Permission Leakage of Cluster Level in hwameistorGo · github.com/hwameistor/hwameistor · fixed in 0.14.6
- CVE-2024-43798Chisel AUTH environment variable not respected in server entrypointGo · github.com/jpillora/chisel · fixed in 1.10.0
- CVE-2024-45244Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.Go · github.com/hyperledger/fabric
- CVE-2024-45258The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionGo · github.com/imroc/req, github.com/imroc/req/v2 +1 · fixed in 3.43.4
- CVE-2024-43105Excessive Resource Consumption via `/export`Go · github.com/mattermost/mattermost-plugin-channel-export · fixed in 1.0.1
- CVE-2024-42490authentik has Insufficient Authorization for several API endpointsGo · goauthentik.io · fixed in 2024.6.4, 2024.4.4
- CVE-2024-43780Unauthorized channel file uploadGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.8+incompatible, 9.8.3+incompatible, 9.9.2+incompatible and more
- CVE-2024-42497Insufficient permissions checks on teamsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.8+incompatible, 9.8.3+incompatible, 9.9.2+incompatible and more
- CVE-2024-40884Unauthorized disabling of invite URLGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.8+incompatible, 9.10.1+incompatible, 9.5.8 and more
- CVE-2024-8071System Role with edit access to permissions can elevate themselves to system adminGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.8+incompatible, 9.8.3+incompatible, 9.9.2+incompatible and more
- CVE-2024-40886One-click Client-Side Path Traversal Leading to CSRF in User Management admin pageGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.8+incompatible, 9.8.3+incompatible, 9.9.2+incompatible and more
- CVE-2024-32939Email addresses of remote users visible in props regardless of server settingsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.8+incompatible, 9.8.3+incompatible, 9.9.2+incompatible and more
- CVE-2024-39836Munged email address used for password resets and notificationsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.8+incompatible, 9.8.3+incompatible, 9.9.2+incompatible and more
- CVE-2024-6508Openshift-console: oauth2 insufficient state parameter entropyGo · github.com/openshift/console
- CVE-2024-43403Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalationGo · github.com/kanisterio/kanister
- CVE-2024-41658GHSL-2024-036: Reflected XSS in QrCodePage.jsGo · github.com/casdoor/casdoor
- CVE-2024-41657GHSL-2024-035: Casdoor CORS misconfigurationGo · github.com/casdoor/casdoor
- CVE-2024-41659GHSL-2024-034: memos CORS Misconfiguration in server.goGo · github.com/usememos/memos · fixed in 0.21.0
- CVE-2024-6322Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account Go · github.com/grafana/grafana · fixed in 11.1.1, 11.1.3, 0.0.0-20240725142242-c326d865c58b and more
- CVE-2024-43406LF Edge eKuiper has a SQL Injection in sqlKvStoreGo · github.com/lf-edge/ekuiper · fixed in 1.14.2