Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-25153containerd OCI image importer memory exhaustionGo · github.com/containerd/containerd · fixed in 1.5.18, 1.6.18
- CVE-2022-25978All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on exteGo · github.com/usememos/memos · fixed in 0.10.4-0.20230211093429-b11d2130a084
- CVE-2022-38867SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbitrary code.Go · github.com/zhaojh329/rttys
- CVE-2023-23625Denial of service in HAMT Decoding in go-unixfs Go · github.com/ipfs/go-unixfs · fixed in 0.4.3
- CVE-2023-23626Denial of service when feeding malformed size arguments in go-bitfieldGo · github.com/ipfs/go-bitfield · fixed in 1.1.0
- CVE-2023-23631HAMT Decoding Panics in github.com/ipfs/go-unixfsnodeGo · github.com/ipfs/go-unixfsnode · fixed in 1.5.2
- CVE-2023-25168Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wingsGo · github.com/pterodactyl/wings · fixed in 1.7.4, 1.11.4
- CVE-2023-25163Argo CD leaks repository credentials in user-facing error messages and in logsGo · github.com/argoproj/argo-cd/v2 · fixed in 2.6.1
- CVE-2023-25151DoS vulnerability for high cardinality metrics in opentelemetry-go-contribGo · go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego, go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp · fixed in 0.39.0
- CVE-2023-25165getHostByName Function Information DisclosureGo · helm.sh/helm/v3 · fixed in 3.11.1
- CVE-2023-25152Symbolic Link (Symlink) Following in github.com/pterodactyl/wingsGo · github.com/pterodactyl/wings · fixed in 1.7.3, 1.11.3
- CVE-2023-0690Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service ConfiguredGo · github.com/hashicorp/boundary · fixed in 0.12.0
- CVE-2023-0739Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.4
- CVE-2023-0740Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.4
- CVE-2023-0741Cross-site Scripting (XSS) - DOM in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.4
- CVE-2023-0742Cross-site Scripting (XSS) - Stored in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.4
- CVE-2023-0743Cross-site Scripting (XSS) - Generic in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.4
- CVE-2023-0744Improper Access Control in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.4
- CVE-2023-24827Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syftGo · github.com/anchore/syft · fixed in 0.70.0
- CVE-2022-21953Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster Go · github.com/rancher/rancher · fixed in 2.5.17, 2.6.10, 2.7.1
- CVE-2022-31249[RANCHER] OS command injection in Rancher and FleetGo · github.com/rancher/wrangler · fixed in 0.7.4-security1, 0.8.5-security1, 1.0.1 and more
- CVE-2022-43755Rancher: Non-random authentication tokenGo · github.com/rancher/rancher · fixed in 2.6.10, 2.7.1
- CVE-2022-43756Rancher/Wrangler: Denial of service when processing Git credentialsGo · github.com/rancher/wrangler · fixed in 0.7.4-security1, 0.8.5-security1, 1.0.1 and more
- CVE-2022-43757Rancher: Exposure of sensitive fieldsGo · github.com/rancher/rancher · fixed in 2.5.17, 2.6.10, 2.7.1
- CVE-2022-43758Rancher: Command injection in Git packageGo · github.com/rancher/rancher · fixed in 2.5.17, 2.6.10, 2.7.1
- CVE-2022-43759Rancher: Privilege escalation via promoted rolesGo · github.com/rancher/rancher · fixed in 2.5.17, 2.6.10
- CVE-2022-28923Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via cGo · github.com/caddyserver/caddy/v2 · fixed in 2.5.0-beta.1
- CVE-2022-45786Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injectionGo · github.com/apache/age/drivers/golang · fixed in 1.1.1
- CVE-2022-47762In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.Go · github.com/flipped-aurora/gin-vue-admin · fixed in 2.5.5, 2.5.5+incompatible
- CVE-2023-24623Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addressGo · github.com/hakobe/paranoidhttp · fixed in 0.3.0