Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-1242Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1243Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1244Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-1245Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-26054Credentials inlined to Git URLs could end up in provenance attestation in BuildKitGo · github.com/moby/buildkit · fixed in 0.11.4
- CVE-2023-26047teler-waf contains detection rule bypass via entities payloadGo · github.com/kitabisa/teler-waf · fixed in 0.2.0
- CVE-2023-26483gosaml2 vulnerable to Denial of Service via deflate decompression bombGo · github.com/russellhaering/gosaml2 · fixed in 0.9.0
- CVE-2022-2835A flaw was found in coreDNS.Go · github.com/coredns/coredns
- CVE-2022-2837A flaw was found in coreDNS.Go · github.com/coredns/coredns
- CVE-2023-27561runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.Go · github.com/opencontainers/runc · fixed in 1.1.5
- CVE-2023-26046teler-waf subject to bypass of common web attack threat rule with HTML entities payloadGo · github.com/kitabisa/teler-waf · fixed in 0.1.1
- CVE-2023-22462Stored XSS in Grafana Text pluginGo · github.com/grafana/grafana · fixed in 9.2.10, 9.3.4
- CVE-2023-0594Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana · fixed in 8.5.21, 9.2.13, 9.3.8
- CVE-2023-0507Grafana is an open-source platform for monitoring and observability.Go · github.com/grafana/grafana · fixed in 8.5.21, 9.2.13, 9.3.8
- CVE-2022-3162Unauthorized read of Custom ResourcesGo · github.com/kubernetes/kubernetes, k8s.io/kubernetes · fixed in 1.25.4, 1.24.8, 1.23.14 and more
- CVE-2022-3294Node address isn't always verified when proxyingGo · github.com/kubernetes/kubernetes, k8s.io/kubernetes · fixed in 1.25.4, 1.24.8, 1.23.14 and more
- CVE-2022-41727Denial of service via crafted TIFF image in golang.org/x/image/tiffGo · golang.org/x/image · fixed in 0.5.0
- CVE-2022-41723Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/netGo · golang.org/x/net, stdlib · fixed in 0.7.0, 1.19.6, 1.20.1
- CVE-2022-41724Panic on large handshake records in crypto/tlsGo · stdlib · fixed in 1.19.6, 1.20.1
- CVE-2022-41725Excessive resource consumption in mime/multipartGo · stdlib · fixed in 1.19.6, 1.20.1
- CVE-2022-41722Path traversal on Windows in path/filepathGo · stdlib · fixed in 1.19.6, 1.20.1
- CVE-2022-2024OS Command Injection in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.11
- CVE-2015-10085GoPistolet MTA denial of serviceGo · github.com/gopistolet/gopistolet · fixed in 0.0.0-20210418093520-a5395f728f8d
- CVE-2023-0934Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.5
- CVE-2023-25656notation-go has excessive memory allocation on verificationGo · github.com/notaryproject/notation-go · fixed in 1.0.0-rc.3
- CVE-2021-32163Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.Go · mosn.io/mosn · fixed in 0.23.0
- CVE-2023-0821Nomad Client Vulnerable to Decompression Bombs in Artifact BlockGo · github.com/hashicorp/nomad · fixed in 1.2.16, 1.3.9, 1.4.4
- CVE-2023-0475Go-Getter Vulnerable to Decompression BombsGo · github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/v2 · fixed in 1.7.0, 2.2.0
- CVE-2023-23947Argo CD users with any cluster secret update access may update out-of-bounds cluster secretsGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.3.17, 2.4.23, 2.5.11 and more
- CVE-2023-25173containerd supplementary groups are not set up properlyGo · github.com/containerd/containerd · fixed in 1.5.18, 1.6.18