Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-10004Timing side-channel in github.com/robbert229/jwtGo · github.com/robbert229/jwt · fixed in 0.0.0-20170426191122-ca1404ee6e83
- CVE-2014-125026Out-of-bounds write in github.com/cloudflare/golz4Go · github.com/cloudflare/golz4 · fixed in 0.0.0-20140711154735-199f5f787806
- CVE-2017-20146Improper access control in github.com/gorilla/handlersGo · github.com/gorilla/handlers · fixed in 1.3.0
- CVE-2020-36569Authentication bypass in github.com/nanobox-io/golang-nanoauthGo · github.com/nanobox-io/golang-nanoauth · fixed in 0.0.0-20200131131040-063a3fb69896
- CVE-2020-36568Resource exhaustion in github.com/revel/revelGo · github.com/revel/revel · fixed in 1.0.0
- CVE-2020-36567Arbitrary log line injection in github.com/gin-gonic/ginGo · github.com/gin-gonic/gin · fixed in 1.6.0
- CVE-2022-4767Denial of Service in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2019-14802HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template renderinGo · github.com/hashicorp/nomad · fixed in 0.9.5
- CVE-2019-19030Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reGo · github.com/goharbor/harbor · fixed in 1.10.3, 2.0.1, 2.0.1+incompatible
- CVE-2021-38561golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing.Go · golang.org/x/text · fixed in 0.3.7
- CVE-2022-4741docconv XMLToText memory allocationGo · code.sajari.com/docconv, github.com/sajari/docconv · fixed in 1.2.1
- CVE-2020-36627Macaron i18n i18n.go redirectGo · github.com/go-macaron/i18n · fixed in 0.5.0
- CVE-2022-4734Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.1
- CVE-2022-4683Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4684Improper Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4686Authorization Bypass Through User-Controlled Key in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4687Incorrect Use of Privileged APIs in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4688Improper Authorization in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4689Improper Access Control in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4690Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4691Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4692Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4694Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-4695Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos · fixed in 0.9.0
- CVE-2022-47633An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attaGo · github.com/kyverno/kyverno · fixed in 1.8.5
- CVE-2020-36625destiny.gg chat main.go websocket.Upgrader cross-site request forgeryGo · github.com/destinygg/chat
- CVE-2022-47931IO FinNet tss-lib before 2.0.0 allows a collision of hash values.Go · github.com/binance-chain/tss-lib, github.com/bnb-chain/tss-lib · fixed in 1.3.6-0.20230324145555-bb6fb30bd3eb
- CVE-2022-23551AAD Pod Identity obtaining token with backslashGo · github.com/azure/aad-pod-identity · fixed in 1.8.13
- CVE-2021-4263leanote history.js define cross site scriptingGo · github.com/leanote/leanote
- CVE-2021-4272studygolang topics.js cross site scriptingGo · github.com/studygolang/studygolang