Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-3328Race condition in snap-confine's must_mkdir_and_open_with_perms()Go · github.com/snapcore/snapd · fixed in 2.57.6
- CVE-2023-46742CubeFS leaks users key in logsGo · github.com/cubefs/cubefs · fixed in 3.3.1
- CVE-2023-46741CubeFS leaks magic secret key when starting Blobstore access serviceGo · github.com/cubefs/cubefs · fixed in 3.3.1
- CVE-2023-46740Insecure random string generator used for sensitive dataGo · github.com/cubefs/cubefs · fixed in 3.3.1
- CVE-2023-46739Timing attack can leak user passwordsGo · github.com/cubefs/cubefs · fixed in 3.3.1
- CVE-2023-46738Authenticated users can crash the CubeFS servers with maliciously crafted requestsGo · github.com/cubefs/cubefs · fixed in 3.3.1
- CVE-2023-30617Leverage the kruise-daemon pod to list all secrets in the entire clusterGo · github.com/openkruise/kruise · fixed in 1.3.1, 1.4.1, 1.5.2
- CVE-2023-47858Details of archived public channels are leaked to members of another teamGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 7.8.10, 8.1.1
- CVE-2023-50333Lack of restriction to manage group names for freshly demoted guestsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.1.7
- CVE-2023-48732Keywords that trigger mentions are leaked to other usersGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.1.7+incompatible, 8.1.7
- CVE-2023-7113Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web cGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.1.7
- CVE-2023-52081ewen-lbh/ffcss late-Unicode normalization vulnerabilityGo · github.com/ewen-lbh/ffcss · fixed in 0.2.0
- CVE-2023-50658The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) Go · github.com/dvsekhvalnov/jose2go · fixed in 1.6.0, 1.5.1-0.20231206184617-48ba0b76bc88
- CVE-2016-15036Deis Workflow Manager race conditionGo · github.com/deis/workflow-manager · fixed in 2.3.3+incompatible, 2.3.3
- CVE-2023-51651Potential URI resolution path traversal in the AWS SDK for PHPGo · github.com/beam-cloud/beta9
- CVE-2023-43116A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user tGo · github.com/buildkite/elastic-ci-stack-for-aws/v6 · fixed in 6.7.0
- CVE-2023-43741A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildGo · github.com/buildkite/elastic-ci-stack-for-aws, github.com/buildkite/elastic-ci-stack-for-aws/v5 +1 · fixed in 6.7.1
- CVE-2023-49391An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AGo · github.com/free5gc/amf
- CVE-2023-51442Authentication bypass vulnerability in navidrome's subsonic endpointGo · github.com/navidrome/navidrome · fixed in 0.50.2
- CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypasGo · golang.org/x/crypto · fixed in 0.17.0, 0.0.0-20231218163308-9d2ee975ef9f
- CVE-2023-49922Beats Insertion of Sensitive Information into Log FileGo · github.com/elastic/beats, github.com/elastic/beats/v7 · fixed in 8.11.3, 7.17.16
- CVE-2023-50424Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)Go · github.com/sap/cloud-security-client-go · fixed in 0.17.0
- CVE-2023-50422Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)Go · github.com/sap/cloud-security-client-go · fixed in 0.17.0
- CVE-2020-10676In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a naGo · github.com/rancher/rancher · fixed in 2.6.13, 2.7.4
- CVE-2023-45292Captcha verification bypass in github.com/mojocn/base64CaptchaGo · github.com/mojocn/base64captcha · fixed in 1.3.6
- CVE-2023-50463The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof theiGo · github.com/shift72/caddy-geo-ip
- CVE-2023-6337Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP RequestsGo · github.com/hashicorp/vault · fixed in 1.13.12, 1.14.8, 1.15.4
- CVE-2023-45285Command 'go get' may unexpectedly fallback to insecure git in cmd/goGo · toolchain · fixed in 1.20.12, 1.21.5
- CVE-2023-39326Denial of service via chunk extensions in net/httpGo · stdlib · fixed in 1.20.12, 1.21.5
- CVE-2023-6459Public endpoint /metrics of Calls plugin reveals channel IDsGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.14, 8.1.5