Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-22647An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate KGo · github.com/rancher/rancher · fixed in 2.6.13, 2.7.4
- CVE-2023-22648A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while theyGo · github.com/rancher/rancher · fixed in 2.6.13, 2.7.4
- CVE-2023-33967EaseProbe vulnerable to SQL injection when using MySQL/PostgreSQL data checkingGo · github.com/megaease/easeprobe · fixed in 2.1.0
- CVE-2023-33964mx-chain-go does not treat invalid transaction with wrong username correctlyGo · github.com/multiversx/mx-chain-go · fixed in 1.4.16
- CVE-2023-26131All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerablGo · github.com/xyproto/algernon
- CVE-2023-32684In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing fileGo · github.com/lima-vm/lima · fixed in 0.16.0
- CVE-2023-2981Abstrium Pydio Cells Chat cross site scriptingGo · github.com/pydio/cells, github.com/pydio/cells/v4 · fixed in 4.2.1
- CVE-2023-2980Abstrium Pydio Cells User Creation resource injectionGo · github.com/pydio/cells, github.com/pydio/cells/v4 · fixed in 4.2.1
- CVE-2023-2978Abstrium Pydio Cells Change Subscription authorizationGo · github.com/pydio/cells, github.com/pydio/cells/v4 · fixed in 4.2.1
- CVE-2023-33955Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploitedGo · github.com/minio/console · fixed in 0.28.0
- CVE-2023-33191kyverno seccomp control can be circumventedGo · github.com/kyverno/kyverno · fixed in 1.9.4
- CVE-2023-33189Incorrect Authorization with specially crafted requestsGo · github.com/pomerium/pomerium · fixed in 0.22.2, 0.21.4, 0.20.1 and more
- CVE-2023-32698nfpm vulnerable to Incorrect Default PermissionsGo · github.com/goreleaser/nfpm, github.com/goreleaser/nfpm/v2 · fixed in 2.29.0
- CVE-2023-32691ginuerzh/gost vulnerable to Timing AttackGo · github.com/ginuerzh/gost
- CVE-2023-34205In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML.Go · github.com/moov-io/signedxml · fixed in 1.1.0
- CVE-2023-33199malformed proposed intoto v0.0.2 entries can cause a panic in RekorGo · github.com/sigstore/rekor · fixed in 1.2.0
- CVE-2023-30851Potential HTTP policy bypass when using header rules in CiliumGo · github.com/cilium/cilium · fixed in 1.11.16, 1.12.9, 1.13.2
- CVE-2021-25748Ingress-nginx `path` sanitization can be bypassed with newline characterGo · k8s.io/ingress-nginx · fixed in 1.2.1
- CVE-2023-31135Dgraph Audit Log Encryption nonce reuseGo · github.com/dgraph-io/dgraph · fixed in 23.0.0
- CVE-2023-2515Privilege escalation to system admin via personal access tokensGo · github.com/mattermost/mattermost-server/v6 · fixed in 7.1.8, 7.7.4, 7.8.3 and more
- CVE-2023-32082etcd key name can be accessed via LeaseTimeToLive APIGo · github.com/etcd-io/etcd · fixed in 3.4.26, 3.5.9
- CVE-2023-29195Vitess VTAdmin users that can create shards can deny access to other functionsGo · vitess.io/vitess · fixed in 0.16.2
- CVE-2023-24539Improper sanitization of CSS values in html/templateGo · stdlib · fixed in 1.19.9, 1.20.4
- CVE-2023-24540Improper handling of JavaScript whitespace in html/templateGo · stdlib · fixed in 1.19.9, 1.20.4
- CVE-2023-29400Improper handling of empty HTML attributes in html/templateGo · stdlib · fixed in 1.19.9, 1.20.4
- CVE-2023-32080Wings vulnerable to escape to host from installation containerGo · github.com/pterodactyl/wings · fixed in 1.7.5, 1.11.6
- CVE-2023-1732Improper random reading in CIRCLGo · github.com/cloudflare/circl · fixed in 1.3.3
- CVE-2023-25568Boxo bitswap/server: DOS unbounded persistent memory leakGo · github.com/ipfs/go-bitswap, github.com/ipfs/go-libipfs · fixed in 0.12.0, 0.4.1, 0.6.0
- CVE-2023-2590Missing Authorization in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.9
- CVE-2023-30844Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpointsGo · github.com/mutagen-io/mutagen, github.com/mutagen-io/mutagen-compose · fixed in 0.16.6, 0.17.1