Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-19277Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code iGo · github.com/phachon/mm-wiki
- CVE-2020-19278Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/Go · github.com/phachon/mm-wiki
- CVE-2021-28235Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.Go · go.etcd.io/etcd/v3
- CVE-2023-1800sjqzhang go-fastdfs File Upload uploa upload path traversalGo · github.com/sjqzhang/go-fastdfs · fixed in 1.4.5-0.20230408141131-61cbff5124c6
- CVE-2023-1777Information disclosure in linked message previewsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v6 · fixed in 7.8.1, 7.7.2, 7.1.6 and more
- CVE-2023-1776Stored XSS via SVG attachment on BoardsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 7.7.2, 7.1.6, 7.8.1
- CVE-2023-1775Unsanitized events sent over Websocket to regular users in a High Availability environmentGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 7.1.6, 7.7.2
- CVE-2023-1774Unauthorized email invite to a private channelGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 7.1.6, 7.7.2
- CVE-2023-27163request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}.Go · github.com/darklynx/request-baskets
- CVE-2023-0620Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage BackendGo · github.com/hashicorp/vault · fixed in 1.11.9, 1.12.5, 1.13.1
- CVE-2023-0665Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer MetadataGo · github.com/hashicorp/vault · fixed in 1.11.9, 1.12.5, 1.13.1
- CVE-2023-25000Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal OperationsGo · github.com/hashicorp/vault · fixed in 1.11.9, 1.12.5, 1.13.1
- CVE-2023-25809rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runcGo · github.com/opencontainers/runc · fixed in 1.1.5
- CVE-2023-28642AppArmor bypass with symlinked /proc in runcGo · github.com/opencontainers/runc · fixed in 1.1.5
- CVE-2022-41354An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.Go · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.4.28, 2.5.16, 2.6.7
- CVE-2023-0778A Time-of-check Time-of-use (TOCTOU) flaw was found in podman.Go · github.com/containers/podman/v4 · fixed in 4.4.2
- CVE-2021-3684A vulnerability was found in OpenShift Assisted Installer.Go · github.com/openshift/assisted-installer · fixed in 1.0.25.1
- CVE-2023-28436Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled processGo · tailscale.com · fixed in 1.38.2
- CVE-2023-1410Stored XSS in Graphite FunctionDescription tooltipGo · github.com/grafana/grafana · fixed in 8.5.22, 9.3.11, 9.4.7 and more
- CVE-2023-28434MinIO is vulnerable to privilege escalation on Linux/MacOSGo · github.com/minio/minio · fixed in 0.0.0-202303200415
- CVE-2023-28433Minio Privilege Escalation on Windows via Path separator manipulationGo · github.com/minio/minio · fixed in 0.0.0-202303200735
- CVE-2023-28119crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression BombGo · github.com/crewjam/saml · fixed in 0.4.13
- CVE-2023-28114`cilium-cli` disables etcd authorization for clustermesh clustersGo · github.com/cilium/cilium-cli · fixed in 0.13.2
- CVE-2022-45003Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.Go · github.com/gophish/gophish
- CVE-2022-45004Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.Go · github.com/gophish/gophish
- CVE-2023-1314Local Privilege Escalation Vulnerability in cloudflared's InstallerGo · github.com/cloudflare/cloudflared · fixed in 0.0.0-20230313153246-f686da832f85
- CVE-2023-1535Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.7
- CVE-2023-1536Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.7
- CVE-2023-1537Authentication Bypass by Capture-replay in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1538Observable Timing Discrepancy in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6