Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-39324Grafana vulnerable to spoofing originalUrl of snapshotsGo · github.com/grafana/grafana · fixed in 9.2.8, 8.5.16
- CVE-2023-22736argo-cd Controller reconciles apps outside configured namespaces when sharding is enabledGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.5.8, 2.6.0-rc5
- CVE-2023-22482JWT audience claim is not verifiedGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.3.14, 2.4.20, 2.5.8 and more
- CVE-2023-0229A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-prGo · github.com/openshift/apiserver-library-go · fixed in 0.0.0-20230120221150-cefee9e0162b, 0.0.0-20230119093715-30f75d79e424
- CVE-2022-46959An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.Go · github.com/go-sonic/sonic · fixed in 1.0.5
- CVE-2023-22726Unrestricted file upload leading to privilege escalation in actGo · github.com/nektos/act · fixed in 0.2.40
- CVE-2022-47747kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.Go · github.com/uber/kraken
- CVE-2023-0290Rapid7 Velociraptor directory traversal in client ID parameter Go · www.velocidex.com/golang/velociraptor · fixed in 0.6.7-5
- CVE-2023-0242Insufficient permission check in the VQL copy() functionGo · www.velocidex.com/golang/velociraptor · fixed in 0.6.7-5
- CVE-2022-23538User credentials leaked to third-party service via HTTP redirect in scs-library-clientGo · github.com/sylabs/scs-library-client · fixed in 1.4.2, 1.3.4
- CVE-2023-22478KubePi is vulnerable to missing authorizationGo · github.com/kubeoperator/kubepi · fixed in 1.6.4
- CVE-2023-22480KubeOperator is vulnerable to unauthorized access to system APIGo · github.com/kubeoperator/kubeoperator
- CVE-2022-41721Request smuggling due to improper request handling in golang.org/x/net/http2/h2cGo · golang.org/x/net · fixed in 0.1.1-0.20221104162952-702349b0e862
- CVE-2023-0247Uncontrolled Search Path Element in bits-and-blooms/bloomGo · github.com/bits-and-blooms/bloom · fixed in 3.3.1
- CVE-2023-22492RefreshToken invalidation vulnerabilityGo · github.com/zitadel/zitadel · fixed in 2.17.3, 2.16.4
- CVE-2023-22479KubePi vulnerable to session fixation attack Go · github.com/kubeoperator/kubepi · fixed in 1.6.4
- CVE-2022-23509Weave Gitops Run vulnerable to insecure communicationGo · github.com/weaveworks/weave-gitops · fixed in 0.12.0
- CVE-2022-23508GitOps Run allows for Kubernetes workload injectionGo · github.com/weaveworks/weave-gitops · fixed in 0.12.0
- CVE-2020-36645square squalor sql injectionGo · github.com/square/squalor · fixed in 0.0.0-20200306154055-f6f0a47cc344
- CVE-2014-125055agnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancyGo · github.com/agnivade/easy-scrypt · fixed in 1.0.0
- CVE-2023-0106Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.10.0
- CVE-2023-0107Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.10.0
- CVE-2023-0108Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.10.0
- CVE-2023-0110Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.10.0
- CVE-2023-0111Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.10.0
- CVE-2023-0112Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.10.0
- CVE-2023-22463KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token Go · github.com/kubeoperator/kubepi · fixed in 1.6.3
- CVE-2023-22460go-ipld-prime json codec may panic if asked to encode bytesGo · github.com/ipld/go-ipld-prime · fixed in 0.19.0
- CVE-2022-48195An issue was discovered in Mellium mellium.im/sasl before 0.3.1.Go · mellium.im/sasl · fixed in 0.3.1
- CVE-2022-4865Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1