Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-6458Client side path traversal due to lack of route parameters validationGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server +1 · fixed in 7.8.14, 9.1.2, 8.1.5 and more
- CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alGo · github.com/pubnub/go, github.com/pubnub/go/v5 +2 · fixed in 0.0.0-20231016150651-428517fef5b9, 5.0.4-0.20231016150651-428517fef5b9, 6.1.1-0.20231016150651-428517fef5b9 and more
- CVE-2023-45287Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelGo · stdlib · fixed in 1.20.0
- CVE-2023-49290Malicious parameters can cause a denial of service in lestrrat-go/jwxGo · github.com/lestrrat-go/jwx, github.com/lestrrat-go/jwx/v2 · fixed in 1.2.27, 2.0.18
- CVE-2023-49292Possible private key restoration in go package github.com/ecies/goGo · github.com/ecies/go/v2 · fixed in 2.0.8
- CVE-2023-47633Uncontrolled Resource Consumption in TraefikGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.10.6, 3.0.0-beta5
- CVE-2023-47106Incorrect processing of fragment in the URL leads to Authorization Bypass in TraefikGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.10.6, 3.0.0-beta5
- CVE-2023-47124Denial of service whith ACME HTTPChallenge in TraefikGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.10.6, 3.0.0-beta5
- CVE-2023-49097ZITADEL vulnerable account takeover via malicious host header injectionGo · github.com/zitadel/zitadel · fixed in 2.39.9, 2.40.10, 2.41.6
- CVE-2023-45286HTTP request body disclosure in github.com/go-resty/resty/v2Go · github.com/go-resty/resty/v2 · fixed in 2.11.0
- CVE-2023-48713Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscalerGo · knative.dev/serving · fixed in 0.39.0
- CVE-2023-47168Open redirect in /oauth/<service>/mobile_login?redirect_to=Go · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 9.1.1, 9.0.2 and more
- CVE-2023-6202Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost BoardsGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 9.1.1, 9.0.2 and more
- CVE-2023-43754Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channelsGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 9.1.1, 9.0.2 and more
- CVE-2023-48369Log Flooding due to specially crafted requests in different endpointsGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 9.1.1, 9.0.2 and more
- CVE-2023-35075HTML injection via channel autocompleteGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 8.1.4
- CVE-2023-40703Denial of Service via specially crafted block fields in Mattermost BoardsGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 9.1.1, 9.0.2 and more
- CVE-2023-48268Denial of Service via Board Import Zip BombGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 9.1.1, 9.0.2 and more
- CVE-2023-45223Users full name disclosure through Mattermost Boards with Show Full Name Option disabledGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 8.1.4
- CVE-2023-47865Username and Icon override can be used by members when Hardened Mode is enabledGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.13, 8.1.4
- CVE-2023-46480An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter oGo · github.com/owncast/owncast
- CVE-2023-48312Authentication bypass using an empty token in capsule-proxyGo · github.com/clastix/capsule-proxy, github.com/projectcapsule/capsule-proxy · fixed in 0.4.6
- CVE-2023-46575A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and Go · github.com/layer5io/meshery · fixed in 0.6.179
- CVE-2023-46402git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.Go · github.com/whilp/git-urls
- CVE-2023-47025An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.Go · github.com/free5gc/free5gc
- CVE-2023-47345Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP HeGo · github.com/free5gc/free5gc
- CVE-2023-47630Attacker can cause Kyverno user to unintentionally consume insecure imageGo · github.com/kyverno/kyverno · fixed in 1.10.5
- CVE-2023-5528Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalationGo · k8s.io/kubernetes · fixed in 1.25.16, 1.26.11, 1.27.8 and more
- CVE-2023-46132Crosslinking transaction attack in hyperledger/fabricGo · github.com/hyperledger/fabric · fixed in 2.2.14, 2.5.5
- CVE-2023-42813Denial of service from malicious manifest in kyvernoGo · github.com/kyverno/kyverno · fixed in 1.5.0-rc1.0.20230918070231-fec2992e3f9f