Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-4643docconv pdf_ocr.go ConvertPDFImages os command injectionGo · code.sajari.com/docconv, github.com/sajari/docconv · fixed in 1.3.5, 1.2.1
- CVE-2022-23542OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 0.3.1
- CVE-2022-39304ghinstallation returns app JWT in error responsesGo · github.com/bradleyfalzon/ghinstallation · fixed in 2.0.0, 1.1.2-0.20210308182858-d24f14f8be70
- CVE-2022-23536Alertmanager can expose local files content via specially crafted configGo · github.com/cortexproject/cortex · fixed in 1.14.1, 1.13.2
- CVE-2022-31683Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue.Go · github.com/concourse/concourse · fixed in 6.7.9, 7.8.3
- CVE-2022-4609Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos
- CVE-2022-23526Helm contains Denial of service through schema fileGo · helm.sh/helm/v3 · fixed in 3.10.3
- CVE-2022-23525Helm vulnerable to Denial of service via NULL Pointer DereferenceGo · helm.sh/helm/v3 · fixed in 3.10.3
- CVE-2022-23524Helm vulnerable to Denial of service through string value parsingGo · helm.sh/helm/v3 · fixed in 3.10.3
- CVE-2022-45969Alist v3.4.0 is vulnerable to Directory Traversal,Go · github.com/alist-org/alist, github.com/alist-org/alist/v3 · fixed in 3.6.0
- CVE-2022-43996The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html.Go · github.com/csaf-poc/csaf_distribution · fixed in 0.8.2
- CVE-2022-23511A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2Go · github.com/aws/amazon-cloudwatch-agent · fixed in 1.247355.0
- CVE-2022-45968Alist v3.4.0 is vulnerable to File Upload.Go · github.com/alist-org/alist, github.com/alist-org/alist/v3 · fixed in 3.5.1
- CVE-2022-45970Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.Go · github.com/alist-org/alist/v3
- CVE-2022-46153Routes exposed with an empty TLSOption in traefikGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 · fixed in 2.9.6
- CVE-2022-23469Authorization header displayed in the debug logsGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 · fixed in 2.9.6
- CVE-2022-23495ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledagGo · github.com/ipfs/go-merkledag · fixed in 0.8.1
- CVE-2022-41717Excessive memory growth in net/http and golang.org/x/net/http2Go · golang.org/x/net, golang.org/x/net/http2 +1 · fixed in 0.4.0, 1.18.9, 1.19.4
- CVE-2022-23492go-libp2p denial of service vulnerability from lack of resource managementGo · github.com/libp2p/go-libp2p · fixed in 0.18.0
- CVE-2022-4122A vulnerability was found in buildah.Go · github.com/containers/podman, github.com/containers/podman/v2 +2 · fixed in 4.5.0
- CVE-2022-4123A flaw was found in Buildah.Go · github.com/containers/podman/v4
- CVE-2022-23471containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leakGo · github.com/containerd/containerd · fixed in 1.5.16, 1.6.12
- CVE-2020-36565Directory traversal on Windows in github.com/labstack/echo/v4Go · github.com/labstack/echo/v4 · fixed in 4.1.18-0.20201215153152-4422e3b66b9f, 4.2.0
- CVE-2022-41720Restricted file access on Windows in os and net/httpGo · stdlib · fixed in 1.18.9, 1.19.4
- CVE-2022-44942Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.Go · github.com/casdoor/casdoor · fixed in 1.126.1
- CVE-2022-23466DOM-based cross-site scripting (XSS) in teler dashboardGo · teler.app · fixed in 2.0.0-rc.4, 2.0.0-dev.2, 0.0.0-20221203202318-20f59eda2420 and more
- CVE-2022-46167Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant NamespaceGo · github.com/clastix/capsule · fixed in 0.1.3
- CVE-2022-46156Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive informationGo · github.com/grafana/synthetic-monitoring-agent, github.com/grafana/synthetic-monitoring-agent/cmd/synthetic-monitoring-agent · fixed in 0.12.0
- CVE-2022-3751 SQL Injection in owncast/owncastGo · github.com/owncast/owncast · fixed in 0.0.13
- CVE-2022-46146Prometheus Exporter Toolkit vulnerable to basic authentication bypassGo · github.com/prometheus/exporter-toolkit · fixed in 0.7.2, 0.8.2