Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-37916Leak password hash of any userGo · github.com/kubeoperator/kubepi · fixed in 1.6.5
- CVE-2023-37917Privilege Escalation in kubepiGo · github.com/kubeoperator/kubepi · fixed in 1.6.5
- CVE-2023-37918API token authentication bypass in HTTP endpoints in DaprGo · github.com/dapr/dapr · fixed in 1.11.2, 1.10.9
- CVE-2023-3300Nomad Search API Leaks Information About CSI PluginsGo · github.com/hashicorp/nomad · fixed in 1.4.11, 1.5.7
- CVE-2023-3299Nomad Caller ACL Token's Secret ID is Exposed to SentinelGo · github.com/hashicorp/nomad · fixed in 1.4.11, 1.5.7
- CVE-2023-3072Nomad ACL Policies without Label are Applied to Unexpected ResourcesGo · github.com/hashicorp/nomad · fixed in 1.4.11, 1.5.6
- CVE-2023-37477Command injection in firewall ip functionality in 1PanelGo · github.com/1panel-dev/1panel · fixed in 1.4.3
- CVE-2023-37788goproxy v1.1 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.Go · github.com/elazarl/goproxy · fixed in 0.0.0-20230731152917-f99041a5c027
- CVE-2023-37265Incorrect identification of source IP addresses in CasaOSGo · github.com/icewhaletech/casaos-gateway · fixed in 0.4.4
- CVE-2023-37266Weak json web token (JWT) secrets in CasaOSGo · github.com/icewhaletech/casaos · fixed in 0.4.4
- CVE-2023-37475Attacker-controlled parameter can cause denial of service in hamba avroGo · github.com/hamba/avro, github.com/hamba/avro/v2 · fixed in 2.13.0
- CVE-2023-34236Information Disclosure Vulnerability in Weave GitOps Terraform ControllerGo · github.com/weaveworks/tf-controller · fixed in 0.14.4, 0.15.0-rc.5
- CVE-2023-34458mx-chain-go's relayed transactions always increment nonceGo · github.com/multiversx/mx-chain-go · fixed in 1.4.17
- CVE-2023-29406Insufficient sanitization of Host header in net/httpGo · stdlib · fixed in 1.19.11, 1.20.6
- CVE-2023-37264Pipelines do not validate child UIDsGo · github.com/tektoncd/pipeline
- CVE-2023-364571Panel vulnerable to command injection when adding container repositoriesGo · github.com/1panel-dev/1panel · fixed in 1.3.6
- CVE-2023-364581Panel vulnerable to ommand injection when entering the container terminalGo · github.com/1panel-dev/1panel · fixed in 1.3.6
- CVE-2023-3515Open Redirect in go-gitea/giteaGo · code.gitea.io/gitea · fixed in 1.19.4
- CVE-2023-2728Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission pluginGo · k8s.io/kubernetes · fixed in 1.27.3, 1.26.6, 1.25.11 and more
- CVE-2023-2727Bypassing policies imposed by the ImagePolicyWebhook admission pluginGo · k8s.io/kubernetes · fixed in 1.27.3, 1.26.6, 1.25.11 and more
- CVE-2023-36815Sealos billing system permission control defectGo · github.com/labring/sealos
- CVE-2023-34450CometBFT PeerState JSON serialization deadlockGo · github.com/cometbft/cometbft · fixed in 0.34.29, 0.37.2
- CVE-2023-34451CometBFT may duplicate transactions in the mempool's data structuresGo · github.com/cometbft/cometbft · fixed in 0.34.29, 0.37.2
- CVE-2023-3485Insecure Default Authorization in Temporal ServerGo · go.temporal.io/server · fixed in 1.20.0
- CVE-2023-33190Improperly configured permissions in SealosGo · github.com/labring/sealos · fixed in 4.2.1-rc4
- CVE-2023-36474Interactsh server settings make users vulnerable to Subdomain TakeoverGo · github.com/projectdiscovery/interactsh · fixed in 1.0.0
- CVE-2023-35930LookupResources may return partial results in spicedbGo · github.com/authzed/spicedb · fixed in 1.22.2
- CVE-2023-35933OpenFGA denial of service die to circular relationshipGo · github.com/openfga/openfga · fixed in 1.1.1
- CVE-2023-25307nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal.Go · github.com/nothub/mrpack-install · fixed in 0.16.3
- CVE-2023-35163Vega's validators able to submit duplicate transactions Go · code.vegaprotocol.io/vega · fixed in 0.71.6