Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-41912crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elementsGo · github.com/crewjam/saml · fixed in 0.4.9
- CVE-2022-45933KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authenticGo · github.com/benc-uk/kubeview
- CVE-2022-4045Authenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost serverGo · github.com/mattermost/mattermost-server · fixed in 7.1.4, 7.2.1, 7.3.1
- CVE-2022-4044Authenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost serverGo · github.com/mattermost/mattermost-server · fixed in 7.1.4, 7.2.1, 7.3.1
- CVE-2022-36111immundb has insufficient verification of data authenticityGo · github.com/codenotary/immudb · fixed in 1.4.1
- CVE-2022-41924Tailscale Windows daemon is vulnerable to RCE via CSRFGo · tailscale.com · fixed in 1.32.3
- CVE-2022-41925Tailscale daemon is vulnerable to information disclosure via CSRFGo · tailscale.com, tailscale.com/cmd · fixed in 1.32.3
- CVE-2022-39199Lack of proper validation in immudb Go · github.com/codenotary/immudb · fixed in 1.4.1
- CVE-2022-38871In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.Go · github.com/free5gc/free5gc
- CVE-2022-39389Witness Block Parsing DoS Vulnerability in lndGo · github.com/lightningnetwork/lnd · fixed in 0.15.4-beta
- CVE-2022-41920Zip slip in LancetGo · github.com/duke-git/lancet, github.com/duke-git/lancet/v2 · fixed in 1.3.4, 2.1.10
- CVE-2022-39383SSRF vulnerability in KubeVela VelaUX APIServerGo · github.com/oam-dev/kubevela · fixed in 1.6.2, 1.5.9, 1.5.8 and more
- CVE-2022-3920Consul Peering Imported Nodes/Services LeakGo · github.com/hashicorp/consul · fixed in 1.14.0
- CVE-2022-41719Panic in github.com/shamaton/msgpack/v2Go · github.com/shamaton/msgpack/v2 · fixed in 2.1.1
- CVE-2022-3867Nomad Event Stream Subscriber Using a Token with TTL Receives Updates Until Garbage CollectedGo · github.com/hashicorp/nomad · fixed in 1.4.2
- CVE-2022-3866Nomad Workload Identity Token Can List Non-sensitive Metadata for Paths Under nomad/Go · github.com/hashicorp/nomad · fixed in 1.4.2
- CVE-2021-40289mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS).Go · github.com/phachon/mm-wiki
- CVE-2022-39388Istio may allow identity impersonation if user has localhost accessGo · github.com/istio/istio · fixed in 1.15.3
- CVE-2022-39395Vela Insecure DefaultsGo · github.com/go-vela/server, github.com/go-vela/worker · fixed in 0.16.0
- CVE-2022-39306Grafana contains Improper Input ValidationGo · github.com/grafana/grafana · fixed in 8.5.15, 9.2.4
- CVE-2022-39307Grafana subject to Exposure of Sensitive Information resulting in User enumeration via forget passwordGo · github.com/grafana/grafana · fixed in 9.2.4, 8.5.15
- CVE-2022-39328Grafana vulnerable to race condition allowing privilege escalationGo · github.com/grafana/grafana · fixed in 9.2.4
- CVE-2022-39352OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 0.2.5
- CVE-2022-44797btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.Go · github.com/btcsuite/btcd, github.com/lightningnetwork/lnd · fixed in 0.23.2, 0.15.2-beta
- CVE-2022-3023Use of Externally-Controlled Format String in pingcap/tidbGo · github.com/pingcap/tidb
- CVE-2022-41716Unsanitized NUL in environment variables on Windows in syscall and os/execGo · stdlib · fixed in 1.18.8, 1.19.3
- CVE-2022-3798IBAX go-ibax tablesInfo sql injectionGo · github.com/ibax-io/go-ibax · fixed in 1.4.2
- CVE-2022-3799IBAX go-ibax tablesInfo sql injectionGo · github.com/ibax-io/go-ibax · fixed in 1.4.2
- CVE-2022-3800IBAX go-ibax rowsInfo sql injectionGo · github.com/ibax-io/go-ibax · fixed in 1.4.2
- CVE-2022-3801IBAX go-ibax rowsInfo sql injectionGo · github.com/ibax-io/go-ibax · fixed in 1.4.2