Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-1539Improper Restriction of Excessive Authentication Attempts in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1540Observable Response Discrepancy in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1541Business Logic Errors in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1542Business Logic Errors in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1543Insufficient Session Expiration in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1496Cross-site Scripting (XSS) - Reflected in imgproxy/imgproxyGo · github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 +1 · fixed in 3.14.0
- CVE-2023-28609api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.Go · github.com/ansible-semaphore/semaphore · fixed in 2.8.89
- CVE-2023-27595Cilium eBPF filters may be temporarily removed during agent restartGo · github.com/cilium/cilium · fixed in 1.13.1
- CVE-2023-27594Cilium vulnerable to potential network policy bypass when routing IPv6 traffic Go · github.com/cilium/cilium · fixed in 1.11.15, 1.12.8, 1.13.1
- CVE-2023-27593cilium-agent container can access the host via `hostPath` mountGo · github.com/cilium/cilium · fixed in 1.11.15, 1.12.8, 1.13.1
- CVE-2023-27591Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metricsGo · miniflux.app, miniflux.app/v2 · fixed in 2.0.43
- CVE-2023-27592Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handlerGo · miniflux.app/v2 · fixed in 2.0.43
- CVE-2023-28109Play With Docker vulnerable to Authorization Bypass Through User-Controlled KeyGo · github.com/play-with-docker/play-with-docker
- CVE-2023-28105Go-huge-util vulnerable to path traversal when unzipping filesGo · github.com/dablelv/go-huge-util · fixed in 0.0.34
- CVE-2023-26484On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specsGo · kubevirt.io/kubevirt
- CVE-2023-1299Nomad Job Submitter Privilege Escalation Using Workload IdentityGo · github.com/hashicorp/nomad · fixed in 1.5.1
- CVE-2023-1296Nomad ACLs Can Not Deny Access to Workload's Own VariablesGo · github.com/hashicorp/nomad · fixed in 1.4.6, 1.5.1
- CVE-2023-27582Full authentication bypass if SASL authorization username is specifiedGo · github.com/foxcpp/maddy · fixed in 0.6.3
- CVE-2023-24999Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy OperationGo · github.com/hashicorp/vault · fixed in 1.10.11, 1.11.8, 1.12.4
- CVE-2023-27484Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplaneGo · github.com/crossplane/crossplane · fixed in 1.9.2, 1.10.3, 1.11.2
- CVE-2023-27483fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtimeGo · github.com/crossplane/crossplane-runtime · fixed in 0.16.1, 0.19.2
- CVE-2023-0845Consul Server Panic when Ingress and API Gateways Configured with PeeringGo · github.com/hashicorp/consul · fixed in 1.14.5
- CVE-2023-24532Incorrect calculation on P256 curves in crypto/internal/nistecGo · stdlib · fixed in 1.19.7, 1.20.2
- CVE-2023-24533Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistecGo · filippo.io/nistec · fixed in 0.0.2
- CVE-2023-27475Goutil vulnerable to path traversal when unzipping filesGo · github.com/gookit/goutil · fixed in 0.6.0, 0.6.7
- CVE-2023-1237Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1238Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1239Cross-site Scripting (XSS) - Reflected in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1240Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1241Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6