Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-3128Grafana is validating Azure AD accounts based on the email claim.Go · github.com/grafana/grafana · fixed in 9.4.13, 9.3.16, 9.2.20 and more
- CVE-2023-34927Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password.Go · github.com/casdoor/casdoor
- CVE-2023-30625rudder-server vulnerable to SQL InjectionGo · github.com/rudderlabs/rudder-server · fixed in 1.3.0-rc.1
- CVE-2023-2783App Framework does not checks for the secret provided in the incoming webhook requestGo · github.com/mattermost/mattermost-server/v6 · fixed in 7.10.1, 7.9.4, 7.8.5 and more
- CVE-2023-2431Bypass of seccomp profile enforcementGo · k8s.io/kubernetes · fixed in 1.24.14, 1.25.10, 1.26.5 and more
- CVE-2023-34242Cilium vulnerable to information leakage via incorrect ReferenceGrant handlingGo · github.com/cilium/cilium · fixed in 1.13.4
- CVE-2023-34620An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that Go · github.com/hjson/hjson-go, github.com/hjson/hjson-go/v4 · fixed in 4.5.0
- CVE-2023-2121Vault’s KV Diff Viewer Allowed for HTML InjectionGo · github.com/hashicorp/vault · fixed in 1.11.11, 1.12.7, 1.13.3
- CVE-2023-29401Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/ginGo · github.com/gin-gonic/gin · fixed in 1.9.1
- CVE-2023-24535Panic when parsing invalid messages in google.golang.org/protobufGo · google.golang.org/protobuf · fixed in 1.29.1
- CVE-2023-29405Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goGo · toolchain · fixed in 1.19.10, 1.20.5
- CVE-2023-29404Improper handling of non-optional LDFLAGS in go command with cgo in cmd/goGo · toolchain · fixed in 1.19.10, 1.20.5
- CVE-2023-29403Unsafe behavior in setuid/setgid binaries in runtimeGo · stdlib · fixed in 1.19.10, 1.20.5
- CVE-2023-29402Code injection via go command with cgo in cmd/goGo · toolchain · fixed in 1.19.10, 1.20.5
- CVE-2023-34231Snowflake Golang Driver vulnerable to Command InjectionGo · github.com/snowflakedb/gosnowflake · fixed in 1.6.19
- CVE-2023-2878Kubernetes secrets-store-csi-driver discloses service account tokens in logsGo · sigs.k8s.io/secrets-store-csi-driver · fixed in 1.3.3
- CVE-2023-33498alist <=3.16.3 is vulnerable to Incorrect Access Control.Go · github.com/alist-org/alist/v3
- CVE-2023-33959Verification bypass can cause users into verifying the wrong artifactGo · github.com/notaryproject/notation-go · fixed in 1.0.0-rc.6
- CVE-2023-33958Default `maxSignatureAttempts` in `notation verify` enables an endless data attack in notationGo · github.com/notaryproject/notation · fixed in 1.0.0-rc.6
- CVE-2023-33957Denial of service from high number of artifact signatures in notationGo · github.com/notaryproject/notation · fixed in 1.0.0-rc.6
- CVE-2023-2183Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana · fixed in 8.5.26, 9.2.19, 9.3.15 and more
- CVE-2023-2801Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana · fixed in 9.4.12, 9.5.3
- CVE-2022-46165Cross-site Scripting (XSS) in Web GUI in syncthingGo · github.com/syncthing/syncthing · fixed in 1.23.5
- CVE-2023-2253A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of recGo · github.com/distribution/distribution, github.com/docker/distribution · fixed in 2.8.2-beta.1+incompatible, 2.8.2-beta.1
- CVE-2023-32766Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiGo · github.com/gitpod-io/gitpod · fixed in 2022.11.3
- CVE-2023-1297 Consul Cluster Peering can Result in Denial of ServiceGo · github.com/hashicorp/consul · fixed in 1.14.5, 1.15.3
- CVE-2023-2816Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service OwnerGo · github.com/hashicorp/consul · fixed in 1.15.3
- CVE-2023-34091Kyverno resource with a deletionTimestamp may allow policy circumventionGo · github.com/kyverno/kyverno · fixed in 1.10.0
- CVE-2023-33965Brook's tproxy server is vulnerable to a drive-by command injection.Go · github.com/txthinking/brook · fixed in 20230606
- CVE-2022-43760An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some hGo · github.com/rancher/rancher · fixed in 2.6.13, 2.7.4