Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-4866Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2018-25060Macaron csrf csrf.go missing secure attributeGo · github.com/go-macaron/csrf · fixed in 0.0.0-20180426211050-dadd1711a617
- CVE-2018-25059pastebinit server.go pasteHandler path traversalGo · github.com/jessfraz/pastebinit · fixed in 0.2.3
- CVE-2022-4863Improper Handling of Insufficient Permissions or Privileges in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-46181Gotify server XSS vulnerability in the application image file uploadGo · github.com/gotify/server, github.com/gotify/server/v2 · fixed in 2.2.2
- CVE-2022-4839Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4840Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4841Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4844Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos
- CVE-2022-4845Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4846Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos
- CVE-2022-4847Incorrectly Specified Destination in a Communication Channel in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4848Improper Verification of Source of a Communication Channel in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4849Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4850Cross-Site Request Forgery (CSRF) in usememos/memosGo · github.com/usememos/memos
- CVE-2022-4851Improper Handling of Values in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2021-4294OpenShift OSIN CheckClientSecret timing discrepancyGo · github.com/openshift/osin · fixed in 1.0.2-0.20210113124101-8612686d6dda
- CVE-2022-46174Race condition during concurrent TLS mounts in efs-utilsGo · github.com/kubernetes-sigs/aws-efs-csi-driver · fixed in 1.4.8
- CVE-2022-46173Elrond go Processing: fallback search of SCRs when not found in the main cacheGo · github.com/elrondnetwork/elrond-go · fixed in 1.3.50
- CVE-2022-4796Incorrect Use of Privileged APIs in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4797Improper Restriction of Excessive Authentication Attempts in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4798Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4799Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4800Improper Verification of Source of a Communication Channel in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4801Insufficient Granularity of Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4802Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4803Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4804Improper Authorization in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4805Incorrect Use of Privileged APIs in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4806Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1