Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-40632Linkerd potential access to the shutdown endpointGo · github.com/linkerd/linkerd2 · fixed in 0.5.1-0.20240614165515-35fb2d6d11ef
- CVE-2024-39909SQL Injection in the KubeClarity REST APIGo · github.com/openclarity/kubeclarity/backend · fixed in 0.0.0-20240711173334-1d1178840703
- CVE-2024-6468Vault Vulnerable to Denial of Service When Setting a Proxy Protocol BehaviorGo · github.com/hashicorp/vault · fixed in 1.15.12, 1.16.3, 1.17.2
- CVE-2022-29946NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused byGo · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 +1 · fixed in 2.8.2, 0.24.6
- CVE-2024-39897Cache driver GetBlob() allows read access to any blob without access control checkGo · zotregistry.dev/zot, zotregistry.io/zot · fixed in 2.1.0
- CVE-2024-39696Evmos vulnerable to exploit of smart contract account and vestingGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +17 · fixed in 19.0.0
- CVE-2024-39321Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakesGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.6, 3.0.4, 3.1.0-rc3
- CVE-2024-39930The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.Go · github.com/gogs/gogs, gogs.io/gogs · fixed in 0.13.1
- CVE-2024-39931Gogs through 0.13.0 allows deletion of internal files.Go · github.com/gogs/gogs, gogs.io/gogs · fixed in 0.13.1
- CVE-2024-39932Gogs through 0.13.0 allows argument injection during the previewing of changes.Go · github.com/gogs/gogs, gogs.io/gogs · fixed in 0.13.1
- CVE-2024-39933Gogs through 0.13.0 allows argument injection during the tagging of a new release.Go · github.com/gogs/gogs, gogs.io/gogs · fixed in 0.13.1
- CVE-2024-6284Improper IPv4 and IPv6 byte order storage in github.com/google/nftablesGo · github.com/google/nftables · fixed in 0.2.0
- CVE-2024-39683ZITADEL Vulnerable to Session Information LeakageGo · github.com/zitadel/zitadel · fixed in 2.53.8, 2.54.5, 2.55.1
- CVE-2024-39223An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback funGo · github.com/ginuerzh/gost
- CVE-2024-24791Denial of service due to improper 100-continue handling in net/httpGo · stdlib · fixed in 1.21.12, 1.22.5
- CVE-2024-39315Pomerium exposed OAuth2 access and ID tokens in user info endpoint responseGo · github.com/pomerium/pomerium · fixed in 0.26.1
- CVE-2023-24531Output of "go env" does not sanitize values in cmd/goGo · toolchain · fixed in 1.21.0-0
- CVE-2022-30636Limited directory traversal vulnerability on Windows in golang.org/x/cryptoGo · golang.org/x/crypto · fixed in 0.0.0-20220525230936-793ad666bf5e
- CVE-2024-38513Fiber Session Middleware Token Injection VulnerabilityGo · github.com/gofiber/fiber, github.com/gofiber/fiber/v2 +1 · fixed in 2.52.5
- CVE-2024-37298Potential memory exhaustion attack due to sparse slice deserializationGo · github.com/gorilla/schema · fixed in 1.4.1
- CVE-2019-25211parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.comGo · github.com/gin-contrib/cors, github.com/gin-gonic/gin · fixed in 1.6.0
- CVE-2024-24792Panic when parsing invalid palette-color images in golang.org/x/imageGo · golang.org/x/image · fixed in 0.18.0
- CVE-2024-6257HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config ManipulationGo · github.com/hashicorp/go-getter · fixed in 1.7.5
- CVE-2024-37820A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.Go · github.com/pingcap/tidb · fixed in 8.2.0
- CVE-2024-6104go-retryablehttp can leak basic auth credentials to log filesGo · github.com/hashicorp/go-retryablehttp · fixed in 0.7.7
- CVE-2024-38361Permissions processing error in spacedbGo · github.com/authzed/spicedb · fixed in 1.33.1
- CVE-2024-38359Lightning Network Daemon Onion BombGo · github.com/lightningnetwork/lnd · fixed in 0.17.0-beta
- CVE-2024-37897Insufficient access control for password reset in sftpgoGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.6.1
- CVE-2024-5182Path Traversal in mudler/localaiGo · github.com/go-skynet/localai · fixed in 2.16.0
- CVE-2024-37904Denial of service from maliciously configured Git repository in MinderGo · github.com/stacklok/minder · fixed in 0.0.52