Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-41259Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account informationGo · github.com/navidrome/navidrome
- CVE-2024-41260A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtaGo · github.com/netbirdio/netbird · fixed in 0.29.2
- CVE-2024-41264An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.Go · github.com/casdoor/casdoor
- CVE-2024-41265A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequeGo · github.com/cortexlabs/cortex, github.com/cortexproject/cortex
- CVE-2024-41953Zitadel improperly sanitizes HTML in emails and Console UIGo · github.com/zitadel/zitadel · fixed in 2.52.3, 2.53.9, 2.54.8 and more
- CVE-2024-41952Zitadel has an "Ignoring unknown usernames" vulnerabilityGo · github.com/zitadel/zitadel · fixed in 2.53.9, 2.54.8, 2.55.5 and more
- CVE-2024-40464An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smGo · github.com/beego/beego/v2 · fixed in 2.2.1
- CVE-2024-40465An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go fileGo · github.com/beego/beego/v2 · fixed in 2.2.1
- CVE-2024-41255filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a manGo · github.com/mickael-kerjean/filestash
- CVE-2024-41256Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification Go · github.com/mickael-kerjean/filestash
- CVE-2024-6984An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access Go · github.com/juju/juju · fixed in 2.9.50, 3.1.9, 3.3.6 and more
- CVE-2024-29069snapd will follow archived symlinks when unpacking a filesystemGo · github.com/snapcore/snapd · fixed in 2.62
- CVE-2024-29068snapd non-regular file indefinite blocking readGo · github.com/snapcore/snapd · fixed in 2.62
- CVE-2024-1724snapd allows $HOME/bin symlinkGo · github.com/snapcore/snapd · fixed in 2.62
- CVE-2024-41666The Argo CD web terminal session does not handle the revocation of user permissions properly.Go · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.9.21, 2.10.16, 2.11.7
- CVE-2024-41110Moby authz zero length regressionGo · github.com/docker/docker, github.com/moby/moby · fixed in 25.0.6+incompatible, 26.1.5+incompatible, 27.1.1+incompatible and more
- CVE-2024-36533Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's Go · github.com/volcano-sh/volcano, volcano.sh/volcano · fixed in 1.10.0-alpha.0
- CVE-2024-36536Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's Go · github.com/fabedge/fabedge
- CVE-2024-6717Nomad Vulnerable to Allocation Directory Path Escape Through Archive UnpackingGo · github.com/hashicorp/nomad · fixed in 1.11.1, 1.8.2
- CVE-2024-40634Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook EndpointGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.9.20, 2.10.15, 2.11.6
- CVE-2024-41122Custom environment variables allow to alter execution flow of plugins in WoodpeckerGo · go.woodpecker-ci.org/woodpecker, go.woodpecker-ci.org/woodpecker/v2 · fixed in 2.7.0
- CVE-2024-41121Custom workspace allow to overwrite plugin entrypoint executable in WoodpeckerGo · go.woodpecker-ci.org/woodpecker, go.woodpecker-ci.org/woodpecker/v2 · fixed in 2.7.0
- CVE-2024-21527Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenbergGo · github.com/gotenberg/gotenberg/v7, github.com/gotenberg/gotenberg/v8 · fixed in 8.1.0
- CVE-2024-21583Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gGo · github.com/gitpod-io/gitpod, github.com/gitpod-io/gitpod/components/server/go +2
- CVE-2024-41111BishopFox Sliver Authenticated Remote Code ExecutionGo · github.com/bishopfox/sliver · fixed in 1.6.0
- CVE-2024-5321Incorrect permissions on Windows containers logsGo · k8s.io/kubernetes · fixed in 1.27.16, 1.28.12, 1.29.7 and more
- CVE-2024-399111Panel SQL injectionGo · github.com/1panel-dev/1panel · fixed in 1.10.12-lts
- CVE-2024-39907a sqlinjection in 1Panel Go · github.com/1panel-dev/1panel · fixed in 1.10.12-tls
- CVE-2024-40641Unsigned code template execution through workflows in projectdiscovery/nucleiGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.3.0
- CVE-2024-6535Skupper: potential authentication bypass to skupper console via forged cookiesGo · github.com/skupperproject/skupper · fixed in 0.0.0-20240703184342-c26bce4079ff