Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-46324pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared seGo · github.com/free5gc/udm · fixed in 1.2.0
- CVE-2023-45823Arbitrary file read in Artifact HubGo · github.com/artifacthub/hub · fixed in 1.16.0
- CVE-2023-45822Unsafe rego built-in allowed in Artifact HubGo · github.com/artifacthub/hub · fixed in 1.16.0
- CVE-2023-45821Incorrect Docker Hub registry check in Artifact HubGo · github.com/artifacthub/hub · fixed in 1.16.0
- CVE-2023-45825Token in custom credentials object can leak through logs in ydb-go-sdkGo · github.com/ydb-platform/ydb-go-sdk/v3 · fixed in 3.53.3
- CVE-2023-43800Insufficient Verification of Data Authenticity in Arduino Create AgentGo · github.com/arduino/arduino-create-agent · fixed in 1.3.3
- CVE-2023-43801Path traversal in Arduino Create AgentGo · github.com/arduino/arduino-create-agent · fixed in 1.3.3
- CVE-2023-43802Path traversal in Arduino Create AgentGo · github.com/arduino/arduino-create-agent · fixed in 1.3.3
- CVE-2023-43803Path traversal in Arduino Create AgentGo · github.com/arduino/arduino-create-agent · fixed in 1.3.3
- CVE-2023-42319Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumptiGo · github.com/ethereum/go-ethereum
- CVE-2023-45810OpenFGA denial of serviceGo · github.com/openfga/openfga · fixed in 1.3.4
- CVE-2023-45141CSRF Token Validation Vulnerability in fiberGo · github.com/gofiber/fiber/v2 · fixed in 2.50.0
- CVE-2023-45128CSRF Token Reuse Vulnerability in fiberGo · github.com/gofiber/fiber/v2 · fixed in 2.50.0
- CVE-2023-45683Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/samlGo · github.com/crewjam/saml · fixed in 0.4.14
- CVE-2023-4457Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/google-sheets-datasource · fixed in 1.2.2
- CVE-2023-4822Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana
- CVE-2023-45142OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metricsGo · go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful, go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin +5 · fixed in 0.44.0
- CVE-2023-1943Privilege Escalation in kOps using GCE/GCP Provider in Gossip ModeGo · k8s.io/kops · fixed in 1.25.4, 1.26.2
- CVE-2023-39325HTTP/2 rapid reset can cause excessive work in net/httpGo · golang.org/x/net, stdlib · fixed in 0.17.0, 1.20.10, 1.21.3
- CVE-2023-44399ZITADEL's password reset does not respect the "Ignoring unknown usernames" settingGo · github.com/zitadel/zitadel · fixed in 2.37.3
- CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, asGo · golang.org/x/net · fixed in 0.17.0
- CVE-2023-44378gnark vulnerable to unsoundness in variable comparison/non-unique binary decompositionGo · github.com/consensys/gnark · fixed in 0.9.0
- CVE-2023-39323Arbitrary code execution during build via line directives in cmd/goGo · toolchain · fixed in 1.20.9, 1.21.2
- CVE-2023-43809Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is EnabledGo · github.com/charmbracelet/soft-serve · fixed in 0.6.2
- CVE-2023-5194A system/user manager can demote / deactivate another managerGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.10, 8.1.1, 8.0.2
- CVE-2023-5195A team member can soft delete other teams that they are not part ofGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.10, 8.1.1, 8.0.2
- CVE-2023-5193System Role with manage posts permission can read posts of Direct MessagesGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.10, 8.1.1, 8.0.2
- CVE-2023-5196DoS via Channel Notification PropertiesGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.10, 8.1.1, 8.0.2
- CVE-2023-5159A User Manager role with user edit permissions could manage/update botsGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.10, 8.1.1, 8.0.2
- CVE-2023-5077Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating RolesetsGo · github.com/hashicorp/vault · fixed in 1.13.0