Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-28232Username Enumeration in CasaOS via bypass of CVE-2024-24766Go · github.com/icewhaletech/casaos-userservice · fixed in 0.4.8
- CVE-2024-29893Uncontrolled Resource Consumption vulnerability in ArgoCD's repo serverGo · github.com/argoproj/argo-cd/v2 · fixed in 2.8.14, 2.9.10, 2.10.5
- CVE-2024-29892ZITADEL's actions can overload reserved claimsGo · github.com/zitadel/zitadel · fixed in 2.42.17, 2.43.11, 2.44.7 and more
- CVE-2024-29891ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP BypassGo · github.com/zitadel/zitadel · fixed in 2.42.17, 2.43.11, 2.44.7 and more
- CVE-2024-28860Insecure IPsec transport encryption in CiliumGo · github.com/cilium/cilium · fixed in 1.13.14, 1.14.9, 1.15.3
- CVE-2024-1313Users outside an organization can delete a snapshot with its keyGo · github.com/grafana/grafana · fixed in 9.5.18, 10.0.13, 10.1.9 and more
- CVE-2024-29031Meshery SQL Injection vulnerabilityGo · github.com/layer5io/meshery · fixed in 0.7.17
- CVE-2024-1394Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsGo · github.com/golang-fips/go, github.com/golang-fips/openssl/v2 +2 · fixed in 2.0.1, 0.2.9
- CVE-2024-29026Owncast cross origin requestGo · github.com/owncast/owncast · fixed in 0.1.3
- CVE-2024-29018External DNS requests from 'internal' networks could lead to data exfiltrationGo · github.com/docker/docker · fixed in 25.0.5+incompatible, 26.0.0-rc3+incompatible, 26.0.0-rc3 and more
- CVE-2024-28855ZITADEL vulnerable to improper HTML sanitizationGo · github.com/zitadel/zitadel · fixed in 1.80.0-v2.20.0.20240312162750-5908b97e7c22, 2.41.15, 2.42.15 and more
- CVE-2024-28250Cilium has possible unencrypted traffic between nodes when using WireGuard and L7 policiesGo · github.com/cilium/cilium · fixed in 1.14.8, 1.15.2
- CVE-2024-28249Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policiesGo · github.com/cilium/cilium · fixed in 1.13.13, 1.14.8, 1.15.2
- CVE-2024-28248Cilium intermittent HTTP policy bypassGo · github.com/cilium/cilium · fixed in 1.13.13, 1.14.8, 1.15.2
- CVE-2024-21662Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache OverflowGo · github.com/argoproj/argo-cd/v2 · fixed in 2.8.13, 2.9.9, 2.10.4
- CVE-2024-21661Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded EnvironmentGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.8.13, 2.9.9, 2.10.4
- CVE-2024-21652Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data LossGo · github.com/argoproj/argo-cd/v2 · fixed in 2.8.13, 2.9.9, 2.10.4
- CVE-2024-1753Buildah: buildah: container escape via improper bind mount validationGo · github.com/containers/buildah, github.com/containers/podman/v4 +1 · fixed in 1.35.1, 1.34.3, 1.33.7 and more
- CVE-2024-27920Unsigned code template execution through workflows in projectdiscovery/nucleiGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 +1 · fixed in 3.2.0
- CVE-2023-51699OS Command Injection for Fluid Users with JuicefsRuntimeGo · github.com/fluid-cloudnative/fluid · fixed in 0.9.3
- CVE-2024-28053Resource Exhaustion via the Invitation FeatureGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 0.0.0-20240209181221-674f549daf0e
- CVE-2023-50726Users with `create` but not `override` privileges can perform local sync in argo-cdGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.8.12, 2.9.8, 2.10.3
- CVE-2024-28175Cross-site scripting on application summary component in argo-cdGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.9.8, 2.10.3, 2.8.12
- CVE-2024-27102Improper isolation of server file access in github.com/pterodactyl/wingsGo · github.com/pterodactyl/wings · fixed in 1.11.9
- CVE-2024-28236Insecure Variable Substitution in VelaGo · github.com/go-vela/worker · fixed in 0.23.2
- CVE-2024-28197Account Takeover via Session Fixation in Zitadel [Bypassing MFA]Go · github.com/zitadel/zitadel · fixed in 2.44.3, 2.45.1
- CVE-2024-23521Panel swap baseApi.UpdateDeviceSwap command injectionGo · github.com/1panel-dev/1panel · fixed in 1.10.1-lts
- CVE-2024-28180Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)Go · github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4 +2 · fixed in 3.0.3, 4.0.1, 2.6.3
- CVE-2024-28122 JWX vulnerable to a denial of service attack using compressed JWE messageGo · github.com/lestrrat-go/jwx, github.com/lestrrat-go/jwx/v2 · fixed in 1.2.29, 2.0.21
- CVE-2024-1725Kubevirt-csi: persistentvolume allows access to hcp's root nodeGo · github.com/kubevirt/csi-driver · fixed in 0.0.0-202403081943-cc28dcbb0afc14