Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-35232github.com/huandu/facebook may expose access_token in error messageGo · github.com/huandu/facebook, github.com/huandu/facebook/v2 · fixed in 2.7.2
- CVE-2024-35223Dapr API Token ExposureGo · github.com/dapr/dapr · fixed in 1.13.3
- CVE-2024-31989ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis CacheGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.8.19, 2.9.15, 2.10.10 and more
- CVE-2024-34710Wiki.js Stored XSS through Client Side Template Injection Go · github.com/requarks/wiki
- CVE-2024-35194Stacklok Minder vulnerable to denial of service from maliciously crafted templatesGo · github.com/stacklok/minder · fixed in 0.0.50
- CVE-2024-35192Trivy possibly leaks registry credential when scanning images from malicious registriesGo · github.com/aquasecurity/trivy · fixed in 0.51.2
- CVE-2024-5042Submariner-operator: rbac permissions can allow for the spread of node compromisesGo · github.com/submariner-io/submariner-operator · fixed in 0.16.4, 0.17.2, 0.15.4 and more
- CVE-2024-35185Denial of service of Minder Server with attacker-controlled REST endpointGo · github.com/stacklok/minder · fixed in 0.0.49
- CVE-2024-35183wolfictl leaks GitHub tokens to remote non-GitHub git serversGo · github.com/wolfi-dev/wolfictl · fixed in 0.16.10
- CVE-2023-40297Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.Go · github.com/stakater/forecastle
- CVE-2024-31216source-controller leaks theAzure Storage SAS token into logs on connection errorsGo · github.com/fluxcd/source-controller · fixed in 1.2.5
- CVE-2024-3744Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logsGo · sigs.k8s.io/azurefile-csi-driver · fixed in 1.29.4, 1.30.1
- CVE-2024-35175sshpiper's Enabling of Proxy Protocol without proper feature flagging allows faking source addressGo · github.com/tg123/sshpiper · fixed in 1.3.0
- CVE-2020-26312GHSL-2020-254: Arbitrary file read and/or write in dotmeshGo · github.com/dotmesh-io/dotmesh
- CVE-2024-34713sshproxy vulnerable to SSH option injectionGo · github.com/cea-hpc/sshproxy · fixed in 1.6.3
- CVE-2024-34079octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usageGo · github.com/octo-sts/app · fixed in 0.1.0
- CVE-2024-34360Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATXGo · github.com/spacemeshos/api, github.com/spacemeshos/api/release/go +1 · fixed in 1.37.1, 1.5.2-hotfix1
- CVE-2024-3727Containers/image: digest type does not guarantee valid typeGo · github.com/containers/image, github.com/containers/image/v5 · fixed in 5.30.1, 5.29.3
- CVE-2024-34352Arbitrary file write vulnerability in 1Panel Go · github.com/1panel-dev/1panel · fixed in 1.10.3-lts
- CVE-2024-24787Arbitrary code execution during build on Darwin in cmd/goGo · toolchain · fixed in 1.21.10, 1.22.3
- CVE-2024-24788Malformed DNS message can cause infinite loop in netGo · stdlib · fixed in 1.22.3
- CVE-2024-32886Vitess vulnerable to infinite memory consumption and vtgate crashGo · github.com/vitessio/vitess, vitess.io/vitess · fixed in 19.0.4, 18.0.5, 17.0.7 and more
- CVE-2024-34084Minder's Github Webhook Handler vulnerable to denial of service from un-validated requestsGo · github.com/stacklok/minder · fixed in 0.0.48
- CVE-2024-33434An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows aGo · github.com/tiagorlampert/chaos · fixed in 0.0.0-20220716132853-b47438d36e3a
- CVE-2024-32972go-ethereum denial of service via malicious p2p messageGo · github.com/ethereum/go-ethereum · fixed in 1.13.15
- CVE-2024-34478btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failuGo · github.com/btcsuite/btcd · fixed in 0.24.0
- CVE-2024-34066Arbitrary File Write/Read in Pterodactyl wingsGo · github.com/pterodactyl/wings · fixed in 1.11.12
- CVE-2024-34068Server-side Request Forgery during remote file pull in Pterodactyl wingsGo · github.com/pterodactyl/wings · fixed in 1.11.12
- CVE-2024-33398There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to imGo · github.com/piraeusdatastore/piraeus-operator, github.com/piraeusdatastore/piraeus-operator/v2
- CVE-2024-4128CSRF in firebase-tools emulator suiteGo · github.com/firebase/firebase-tools