Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-4807Improper Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4808Improper Privilege Management in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4809Improper Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4810Improper Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4811Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4812Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4813Insufficient Granularity of Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4814Improper Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-3347Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolverGo · github.com/peterzen/goresolver
- CVE-2022-3346Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolverGo · github.com/peterzen/goresolver
- CVE-2022-3064Excessive resource consumption in gopkg.in/yaml.v2Go · gopkg.in/yaml.v2 · fixed in 2.2.4
- CVE-2021-4239Weak encryption and denial of service in github.com/flynn/noiseGo · github.com/flynn/noise · fixed in 1.0.0
- CVE-2022-2584Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpbGo · github.com/ipld/go-codec-dagpb · fixed in 1.3.1
- CVE-2021-4238Insufficient randomness in github.com/Masterminds/goutilsGo · github.com/masterminds/goutils · fixed in 1.1.1
- CVE-2022-2583Race condition in github.com/ntbosscher/gobaseGo · github.com/ntbosscher/gobase · fixed in 0.7.2
- CVE-2022-2582Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-goGo · github.com/aws/aws-sdk-go · fixed in 1.34.0
- CVE-2021-4236Panic or authentication bypass in github.com/ecnepsnai/webGo · github.com/ecnepsnai/web · fixed in 1.5.2
- CVE-2020-36566Path traversal in github.com/whyrusleeping/tar-utilsGo · github.com/whyrusleeping/tar-utils · fixed in 0.0.0-20201201191210-20a61371de5b
- CVE-2021-4235Denial of service in gopkg.in/yaml.v2Go · github.com/go-yaml/yaml, gopkg.in/yaml.v2 · fixed in 2.2.3
- CVE-2020-36564Improper input validation in github.com/justinas/nosurfGo · github.com/justinas/nosurf · fixed in 1.1.1
- CVE-2020-36563Weak hash (SHA-1) in github.com/RobotsAndPencils/go-samlGo · github.com/robotsandpencils/go-saml
- CVE-2016-15005Cryptographically weak random number generation in github.com/dinever/golfGo · github.com/dinever/golf · fixed in 0.3.0
- CVE-2020-36562Uncontrolled Resource Consumption in github.com/shiyanhui/dhtGo · github.com/shiyanhui/dht
- CVE-2019-25072Uncontrolled resource consumption in github.com/tendermint/tendermintGo · github.com/tendermint/tendermint · fixed in 0.31.1
- CVE-2020-36561Path traversal in github.com/yi-ge/unzipGo · github.com/yi-ge/unzip · fixed in 1.0.3-0.20200308084313-2adbaa4891b9
- CVE-2020-36560Path traversal in github.com/artdarek/go-unzipGo · github.com/artdarek/go-unzip · fixed in 1.0.0, 2.0.0
- CVE-2020-36559Path Traversal in aahframe.workGo · aahframe.work, github.com/go-aah/aah · fixed in 0.12.4
- CVE-2019-25073Path traversal in github.com/goadesign/goaGo · github.com/goadesign/goa, goa.design/goa +1 · fixed in 1.4.3, 3.0.9
- CVE-2018-25046Path traversal in code.cloudfoundry.org/archiverGo · code.cloudfoundry.org/archiver, github.com/cloudfoundry/archiver · fixed in 0.0.0-20180523222229-09b5706aa936
- CVE-2013-10005Infinite loop in github.com/btcsuite/go-socksGo · github.com/btcsuite/go-socks, github.com/btcsuitereleases/go-socks · fixed in 0.0.0-20130808000456-233bccbb1abe