Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-24557Moby classic builder cache poisoningGo · github.com/docker/docker, github.com/moby/moby · fixed in 24.0.9, 25.0.2, 24.0.9+incompatible and more
- CVE-2024-0831Vault May Expose Sensitive Information When Configuring An Audit Log DeviceGo · github.com/hashicorp/vault · fixed in 1.15.5
- CVE-2024-24747MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationGo · github.com/minio/minio · fixed in 0.0.0-20240131185645-0ae4915a9391
- CVE-2024-23653BuildKit interactive containers API does not validate entitlements checkGo · github.com/moby/buildkit · fixed in 0.12.5
- CVE-2024-23652BuildKit possible host system access from mount stub cleanerGo · github.com/moby/buildkit · fixed in 0.12.5
- CVE-2024-23651BuildKit possible race condition with accessing subpaths from cache mountsGo · github.com/moby/buildkit · fixed in 0.12.5
- CVE-2024-23650BuildKit possible panic when incorrect parameters sent from frontendGo · github.com/moby/buildkit · fixed in 0.12.5
- CVE-2024-21626runc container breakout through process.cwd trickery and leaked fdsGo · github.com/opencontainers/runc · fixed in 1.1.12
- CVE-2024-24579Tar path traversal in stereoscope when processing OCI tar archivesGo · github.com/anchore/stereoscope · fixed in 0.0.1
- CVE-2023-44313Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend APIGo · github.com/apache/servicecomb-service-center · fixed in 2.2.0
- CVE-2023-44312Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center serverGo · github.com/apache/servicecomb-service-center · fixed in 2.2.0
- CVE-2024-23840`goreleaser release --debug` shows secretsGo · github.com/goreleaser/goreleaser · fixed in 1.24.0
- CVE-2024-23647PKCE downgrade attack in AuthentikGo · goauthentik.io · fixed in 2023.10.7, 2023.8.7
- CVE-2024-23828Nginx-UI authenticated RCE through injecting into the application config via CRLFGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20240126104956-d70e37c8575e
- CVE-2024-23827Nginx-UI arbitrary file write through the Import Certificate featureGo · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20240128060047-8581bdd3c6f4
- CVE-2024-23820OpenFGA DoSGo · github.com/openfga/openfga · fixed in 1.4.3
- CVE-2024-23656Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphersGo · github.com/dexidp/dex · fixed in 2.38.0, 0.0.0-20240125115555-5bbdb4420254
- CVE-2023-52354chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.Go · blitiri.com.ar/go/chasquid, github.com/albertito/chasquid · fixed in 1.13.0, 1.13
- CVE-2024-23332Client configured with permissive trust policies susceptible to rollback attack in Notary ProjectGo · github.com/notaryproject/notation
- CVE-2024-22424Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cdGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.7.16, 2.8.8, 2.9.4 and more
- CVE-2023-49569Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsGo · github.com/go-git/go-git/v5, gopkg.in/src-d/go-git.v4 · fixed in 5.11.0
- CVE-2023-49568Maliciously crafted Git server replies can cause DoS on go-git clientsGo · github.com/go-git/go-git/v5, gopkg.in/src-d/go-git.v4 · fixed in 5.11.0
- CVE-2024-22198Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20231219184941-827e76c46e63
- CVE-2024-22196Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20231219195202-ec93ab05a3ec
- CVE-2024-22197Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)Go · github.com/0xjacky/nginx-ui · fixed in 1.9.10-0.20231219184941-827e76c46e63
- CVE-2024-22199Django Template Engine Vulnerable to XSSGo · github.com/gofiber/template/django/v3 · fixed in 3.1.9
- CVE-2023-49295quic-go's path validation mechanism can cause denial of serviceGo · github.com/quic-go/quic-go · fixed in 0.40.1, 0.39.4, 0.38.2 and more
- CVE-2023-49619Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.Go · github.com/apache/incubator-answer · fixed in 1.2.1
- CVE-2023-6476Cri-o: pods are able to break out of resource confinement on cgroupv2Go · github.com/cri-o/cri-o · fixed in 1.29.1, 1.28.3, 1.27.3
- CVE-2024-21664Parsing JSON serialized payload without protected field can lead to segfaultGo · github.com/lestrrat-go/jwx, github.com/lestrrat-go/jwx/v2 · fixed in 1.2.28, 2.0.19