Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-1442User with permissions to create a data source can CRUD all data sourcesGo · github.com/grafana/grafana · fixed in 9.5.7, 10.0.12, 10.1.8 and more
- CVE-2024-28110Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentialsGo · github.com/cloudevents/sdk-go/v2 · fixed in 2.15.2
- CVE-2024-27918Coder's OIDC authentication allows email with partially matching domain to registerGo · github.com/coder/coder, github.com/coder/coder/v2 · fixed in 2.8.4, 2.7.3, 2.6.1
- CVE-2024-27916`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated userGo · github.com/stacklok/minder · fixed in 0.0.33
- CVE-2023-48703SAML authentication bypass vulnerability in RobotsAndPencils/go-samlGo · github.com/robotsandpencils/go-saml
- CVE-2024-27304pgx SQL Injection via Protocol Message Size OverflowGo · github.com/jackc/pgproto3, github.com/jackc/pgproto3/v2 +3 · fixed in 2.3.3, 4.18.2, 5.5.4
- CVE-2024-27302Authorization Bypass Through User-Controlled Key in go-zeroGo · github.com/zeromicro/go-zero · fixed in 1.4.4
- CVE-2024-27289pgx SQL Injection via Line Comment CreationGo · github.com/jackc/pgx, github.com/jackc/pgx/v4 · fixed in 4.18.2
- CVE-2024-272881Panel open source panel project has an unauthorized vulnerability.Go · github.com/1panel-dev/1panel · fixed in 1.10.1-lts
- CVE-2024-24766CasaOS Username EnumerationGo · github.com/icewhaletech/casaos-userservice · fixed in 0.4.7
- CVE-2024-24767CasaOS Improper Restriction of Excessive Authentication Attempts vulnerabilityGo · github.com/icewhaletech/casaos-userservice · fixed in 0.4.7
- CVE-2024-24765CasaOS-UserService allows unauthorized access to any fileGo · github.com/icewhaletech/casaos-userservice · fixed in 0.4.7
- CVE-2024-24786Infinite loop in JSON unmarshaling in google.golang.org/protobufGo · google.golang.org/protobuf, google.golang.org/protobuf/encoding/protojson +1 · fixed in 1.33.0
- CVE-2024-24785Errors returned from JSON marshaling may break template escaping in html/templateGo · stdlib · fixed in 1.21.8, 1.22.1
- CVE-2024-24784Comments in display names are incorrectly handled in net/mailGo · stdlib · fixed in 1.21.8, 1.22.1
- CVE-2023-45289Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/httpGo · stdlib · fixed in 1.21.8, 1.22.1
- CVE-2023-45290Memory exhaustion in multipart form parsing in net/textproto and net/httpGo · stdlib · fixed in 1.21.8, 1.22.1
- CVE-2024-24783Verify panics on certificates with an unknown public key algorithm in crypto/x509Go · stdlib · fixed in 1.21.8, 1.22.1
- CVE-2024-2056Artica Proxy Loopback Services Remotely Accessible UnauthenticatedGo · github.com/gvalkov/tailon
- CVE-2024-2048Vault Cert Auth Method Did Not Correctly Validate Non-CA CertificatesGo · github.com/hashicorp/vault · fixed in 1.15.5, 1.14.10
- CVE-2024-27101Integer overflow in chunking helper causes dispatching to miss elements or panicGo · github.com/authzed/spicedb · fixed in 1.29.2
- CVE-2024-1953Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested fGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.2.5+incompatible, 9.3.1+incompatible, 9.4.2+incompatible and more
- CVE-2024-1952Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing anGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.4.0+incompatible, 9.4.0
- CVE-2024-1949A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized accGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.4.2+incompatible, 9.4.2, 8.1.9
- CVE-2024-1942Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under speGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.2.5+incompatible, 9.3.1+incompatible, 9.3.1 and more
- CVE-2024-1888Existing server guests invited to the team by members without "invite_guest" permissionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.2.5+incompatible, 9.3.1+incompatible, 9.4.2+incompatible and more
- CVE-2024-24988Excessive resource consumption when sending long emoji names in user custom statusGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.2.5+incompatible, 9.3.1+incompatible, 9.3.1 and more
- CVE-2024-1887Public channel post content accessible without membership when compliance export is enabledGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.2.5+incompatible, 9.3.1+incompatible, 9.3.1 and more
- CVE-2024-23488Files of archived channels accessible with the “Allow users to view archived channels” option disabledGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.4.2+incompatible, 9.4.2, 8.1.9
- CVE-2024-23493 Team associated AD/LDAP Groups Leaked due to missing authorizationGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.2.5+incompatible, 9.3.1+incompatible, 9.4.2+incompatible and more