Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-32079Netmaker Privilige Escalation VulnerabilityGo · github.com/gravitl/netmaker · fixed in 0.17.1, 0.18.6
- CVE-2023-32078Netmaker IDOR Vulnerability Allows User to Update Other User's PasswordGo · github.com/gravitl/netmaker · fixed in 0.17.1, 0.18.6
- CVE-2023-32077Netmaker has Hardcoded DNS Secret KeyGo · github.com/gravitl/netmaker · fixed in 0.17.1, 0.18.6
- CVE-2023-40025Argo CD web terminal session doesn't expireGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.6.14, 2.7.12, 2.8.1 and more
- CVE-2023-38976An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.Go · github.com/weaviate/weaviate · fixed in 1.20.6, 1.19.13, 1.18.6
- CVE-2023-40034Repositoty takeover in woodpecker-ciGo · github.com/woodpecker-ci/woodpecker · fixed in 1.0.2
- CVE-2023-40023Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File ReadingGo · github.com/yaklang/yaklang · fixed in 1.2.4-sp2
- CVE-2023-4108Audit logging fails to sanitize post metadataGo · github.com/mattermost/mattermost-server/v6 · fixed in 7.8.8, 7.9.6, 7.10.4
- CVE-2023-4107Incorrect authorization allows a user manager to update a system adminGo · github.com/mattermost/mattermost-server/v6 · fixed in 7.8.8, 7.9.6, 7.10.4
- CVE-2023-4106A guest user can perform various actions on public playbooksGo · github.com/mattermost/mattermost-server/v6 · fixed in 7.9.6, 7.10.4, 7.8.8
- CVE-2023-4105Attachment of deleted message in a thread remains accessible and downloadable Go · github.com/mattermost/mattermost-server/v6 · fixed in 7.9.6, 7.10.4, 7.8.8
- CVE-2023-399661Panel arbitrary file write vulnerability exists in the backgroundGo · github.com/1panel-dev/1panel · fixed in 1.5.0
- CVE-2023-399651Panel Unauthorized access in BackendGo · github.com/1panel-dev/1panel · fixed in 1.5.0
- CVE-2023-399641Panel O&M management panel has a background arbitrary file reading vulnerabilityGo · github.com/1panel-dev/1panel · fixed in 1.5.0
- CVE-2023-3518JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for AccessGo · github.com/hashicorp/consul · fixed in 1.16.1
- CVE-2023-39533libp2p nodes vulnerable to attack using large RSA keysGo · github.com/libp2p/go-libp2p · fixed in 0.27.8, 0.28.2, 0.29.1
- CVE-2022-38795In Gitea through 1.17.1, repo cloning can occur in the migration function.Go · code.gitea.io/gitea · fixed in 1.17.2
- CVE-2023-37896Nuclei Path Traversal vulnerabilityGo · github.com/projectdiscovery/nuclei, github.com/projectdiscovery/nuclei/v2 · fixed in 2.9.9
- CVE-2023-4127Race Condition within a Thread in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.1.1
- CVE-2023-4126Insufficient Session Expiration in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.1.0
- CVE-2023-4125Weak Password Requirements in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.1.0
- CVE-2023-4124Missing Authorization in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.1.1
- CVE-2023-29407Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiffGo · golang.org/x/image · fixed in 0.10.0
- CVE-2023-29408Excessive resource consumption in golang.org/x/image/tiffGo · golang.org/x/image · fixed in 0.10.0
- CVE-2023-3978Improper rendering of text nodes in golang.org/x/net/htmlGo · golang.org/x/net · fixed in 0.13.0
- CVE-2023-29409Large RSA keys can cause high CPU usage in crypto/tlsGo · stdlib · fixed in 1.19.12, 1.20.7, 1.21.0-rc.4
- CVE-2023-3462Vault's LDAP Auth Method Allows for User EnumerationGo · github.com/hashicorp/vault · fixed in 1.13.5, 1.14.1
- CVE-2023-38495Crossplane vulnerable to possible image tampering from missing image validation for PackagesGo · github.com/crossplane/crossplane · fixed in 1.11.5, 1.12.3
- CVE-2023-37900Crossplane vulnerable to denial of service from large imageGo · github.com/crossplane/crossplane · fixed in 1.11.5, 1.12.3
- CVE-2023-38496Apptainer's ineffective privileges drop when requesting container networkGo · github.com/apptainer/apptainer · fixed in 1.2.1