Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-39690Capsule tenant owner with "patch namespace" permission can hijack system namespacesGo · github.com/projectcapsule/capsule · fixed in 0.7.1
- CVE-2024-43379TruffleHog has a Blind SSRF in some DetectorsGo · github.com/trufflesecurity/trufflehog, github.com/trufflesecurity/trufflehog/v3 · fixed in 3.81.9
- CVE-2024-7646A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `exGo · github.com/kubernetes/ingress-nginx
- CVE-2024-42486Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway APIGo · github.com/cilium/cilium · fixed in 1.15.8, 1.16.1
- CVE-2024-42488Cilium agent's race condition may lead to policy bypass for Host Firewall policyGo · github.com/cilium/cilium · fixed in 1.14.14, 1.15.8
- CVE-2024-42487Cilium's Gateway API route matching order contradicts specificationGo · github.com/cilium/cilium · fixed in 1.15.8, 1.16.1
- CVE-2024-32231Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.Go · github.com/stashapp/stash · fixed in 0.26.0
- CVE-2024-7625Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive UnpackingGo · github.com/hashicorp/nomad · fixed in 1.6.14, 1.7.11, 1.8.3
- CVE-2024-42368open-telemetry has an Observable Timing DiscrepancyGo · github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension · fixed in 0.107.0
- CVE-2024-42480Kamaji's RBAC Roles for `etcd` are not disjunctGo · github.com/clastix/kamaji
- CVE-2024-42473OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 1.5.9
- CVE-2024-41888Apache Answer: The link for resetting user password is not Single-UseGo · github.com/apache/incubator-answer · fixed in 1.3.6
- CVE-2024-41890Apache Answer: The link to reset the user's password will remain valid after sending a new linkGo · github.com/apache/incubator-answer · fixed in 1.3.6
- CVE-2024-6886Inproper Sanitation of field leading to stored XSSGo · code.gitea.io/gitea · fixed in 1.22.1
- CVE-2024-41270An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecatGo · github.com/appleboy/gorush · fixed in 1.18.5
- CVE-2024-41820Cluster-level privilege escalation in kubeanGo · github.com/kubean-io/kubean · fixed in 0.18.0
- CVE-2024-37286APM Server Insertion of Sensitive Information into Log FileGo · github.com/elastic/apm-server · fixed in 8.14.0
- CVE-2024-3056Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attackGo · github.com/containers/podman, github.com/containers/podman/v2 +3
- CVE-2024-22278Harbor fails to validate the user permissions when updating project configurationsGo · github.com/goharbor/harbor · fixed in 2.9.5, 2.10.3, 2.9.5+incompatible and more
- CVE-2024-41956Soft Serve allows arbitrary code execution by crafting git-lfs requestsGo · github.com/charmbracelet/soft-serve · fixed in 0.7.5
- CVE-2024-41926Malicious remote can claim that a user was synced from another remoteGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3 · fixed in 5.3.2-0.20240604093018-5114c3b7cdb8, 9.5.7+incompatible, 9.9.1+incompatible and more
- CVE-2024-41162Malicious remote can make an arbitrary local channel read-onlyGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3 · fixed in 5.3.2-0.20240628125750-70b218839fa7, 9.5.7+incompatible, 9.7.6+incompatible and more
- CVE-2024-41144Malicious remote can create/update/delete arbitrary posts in arbitrary channelsGo · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +3 · fixed in 5.3.2-0.20240619142046-8181a9ddffc0, 9.5.7+incompatible, 9.7.6+incompatible and more
- CVE-2024-39839Remote username set to an arbitrary string by remote userGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.7+incompatible, 9.7.6+incompatible, 9.8.2+incompatible and more
- CVE-2024-39837Malicious remote can create arbitrary channelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.7+incompatible, 9.9.1+incompatible, 9.9.1 and more
- CVE-2024-39832Permanently local data deletion by malicious remoteGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.7+incompatible, 9.7.6+incompatible, 9.8.2+incompatible and more
- CVE-2024-39777Malicious remote can invite itself to an arbitrary local channelGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.7+incompatible, 9.7.6+incompatible, 9.8.1+incompatible and more
- CVE-2024-39274Malicious remote can add users to arbitrary teams and channelsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.7+incompatible, 9.7.6+incompatible, 9.8.2+incompatible and more
- CVE-2024-36492Existing local user overwritten by malicious remoteGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.7+incompatible, 9.7.6+incompatible, 9.8.2+incompatible and more
- CVE-2024-29977Malicious remote can create arbitrary reactions on arbitrary postsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.7+incompatible, 9.9.1+incompatible, 9.5.7 and more