Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-27093Minder trusts client-provided mapping from repo name to upstream IDGo · github.com/stacklok/minder · fixed in 0.20240226.1425
- CVE-2024-22393Apache Answer: Pixel Flood Attack by uploading the large pixel fileGo · github.com/apache/incubator-answer · fixed in 1.2.5
- CVE-2024-23349Apache Answer: XSS vulnerability when submitting summaryGo · github.com/apache/incubator-answer · fixed in 1.2.5
- CVE-2024-26578Apache Answer: Repeated submission at registration created duplicate users with the same nameGo · github.com/apache/incubator-answer · fixed in 1.2.5
- CVE-2024-26147Helm's Missing YAML Content Leads To PanicGo · helm.sh/helm/v3 · fixed in 3.14.2
- CVE-2024-25124Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with CredentialsGo · github.com/gofiber/fiber/v2 · fixed in 2.52.1
- CVE-2024-25631Unencrypted traffic between pods when using Wireguard and an external kvstoreGo · github.com/cilium/cilium · fixed in 1.14.7
- CVE-2024-25630Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryptionGo · github.com/cilium/cilium · fixed in 1.14.7
- CVE-2024-21493All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a CaddyfileGo · github.com/greenpau/caddy-security
- CVE-2024-21495Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure randGo · github.com/greenpau/caddy-security
- CVE-2024-21494All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For hGo · github.com/greenpau/caddy-security
- CVE-2024-21500All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts vGo · github.com/greenpau/caddy-security
- CVE-2024-21499All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due Go · github.com/greenpau/caddy-security
- CVE-2024-21498All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host heaGo · github.com/greenpau/caddy-security
- CVE-2024-21497Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter.Go · github.com/greenpau/caddy-security
- CVE-2024-21492All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user sessioGo · github.com/greenpau/caddy-security
- CVE-2024-21496All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to iGo · github.com/greenpau/caddy-security
- CVE-2024-25620Dependency management path traversal in helmGo · helm.sh/helm/v3 · fixed in 3.14.1
- CVE-2024-1485Registry-support: decompress can delete files outside scope via relative pathsGo · github.com/devfile/registry-support/registry-library · fixed in 0.0.0-20240206
- CVE-2023-6152A user changing their email after signing up and verifying it can change it without verification in profile settings.Go · github.com/grafana/grafana · fixed in 9.5.16, 10.0.11, 10.1.7 and more
- CVE-2023-52430The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with eithGo · github.com/greenpau/caddy-security
- CVE-2024-25712http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFilGo · github.com/swaggo/http-swagger · fixed in 1.2.6
- CVE-2024-1402Denial of service in mattermost mobile apps and server via emoji reactionsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.1.5+incompatible, 9.2.4+incompatible, 8.1.8 and more
- CVE-2024-24776 Incorrect Authorization leads to Channel Member Count LeakGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.3.0+incompatible, 8.1.8, 9.3.0
- CVE-2024-24774Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)Go · github.com/mattermost/mattermost-plugin-jira · fixed in 4.0.0-rc1
- CVE-2024-23319CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)Go · github.com/mattermost/mattermost-plugin-jira · fixed in 1.1.2-0.20230830170046-f4cf4c6de017
- CVE-2024-1329Nomad Vulnerable to Arbitrary Write Through Symlink AttackGo · github.com/hashicorp/nomad · fixed in 1.5.14, 1.6.7, 1.7.4
- CVE-2024-23448APM Server Insertion of Sensitive Information into Log FileGo · github.com/elastic/apm-server · fixed in 8.12.1
- CVE-2024-1052Boundary Vulnerable to Session Hijacking Through TLS Certificate TamperingGo · github.com/hashicorp/boundary · fixed in 0.15.0
- CVE-2024-247681Panel set-cookie is missing the Secure keywordGo · github.com/1panel-dev/1panel · fixed in 1.9.6