Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-3802IBAX go-ibax rowsInfo sql injectionGo · github.com/ibax-io/go-ibax · fixed in 1.4.2
- CVE-2022-3616OctoRPKI crash when maximum iterations number is reachedGo · github.com/cloudflare/cfrpki · fixed in 1.4.4
- CVE-2022-36182Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to maliGo · github.com/hashicorp/boundary
- CVE-2022-39340OpenFGA Information DisclosureGo · github.com/openfga/openfga · fixed in 0.2.4
- CVE-2022-39341OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 0.2.4
- CVE-2022-39342OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 0.2.4
- CVE-2022-39345Gin-vue-admin arbitrary file upload vulnerability caused by path traversalGo · github.com/flipped-aurora/gin-vue-admin/server · fixed in 2.5.4
- CVE-2022-38580Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).Go · github.com/zalando/skipper · fixed in 0.13.237
- CVE-2022-43677In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString.Go · github.com/free5gc/aper, github.com/free5gc/free5gc
- CVE-2022-39272Flux2 vulnerable to Denial of Service due to Improper use of metav1.DurationGo · github.com/fluxcd/flux2, github.com/fluxcd/helm-controller +11 · fixed in 0.35.0, 0.24.0, 0.26.0 and more
- CVE-2022-39267Brokercap Bifrost vulnerable to authentication bypass for admin and monitor user groupsGo · github.com/brokercap/bifrost · fixed in 1.8.7-release
- CVE-2022-42968Gitea before 1.17.3 does not sanitize and escape refs in the git backend.Go · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.17.3
- CVE-2022-2879Unbounded memory consumption when reading headers in archive/tarGo · stdlib · fixed in 1.18.7, 1.19.2
- CVE-2022-2880Incorrect sanitization of forwarded query parameters in net/http/httputilGo · stdlib · fixed in 1.18.7, 1.19.2
- CVE-2022-32149Denial of service via crafted Accept-Language header in golang.org/x/text/languageGo · golang.org/x/text · fixed in 0.3.8
- CVE-2022-41715Memory exhaustion when compiling regular expressions in regexp/syntaxGo · stdlib · fixed in 1.18.7, 1.19.2
- CVE-2022-31123Grafana plugin signature bypass vulnerabilityGo · github.com/grafana/grafana · fixed in 9.1.8, 8.5.14
- CVE-2022-31130Grafana data source and plugin proxy endpoints leaking authentication tokens to some destination pluginsGo · github.com/grafana/grafana · fixed in 9.1.8, 8.5.14
- CVE-2022-39201Data source and plugin proxy endpoints could leak the authentication cookie to some destination pluginsGo · github.com/grafana/grafana · fixed in 8.5.14, 9.1.8
- CVE-2022-39229Grafana users with email as a username can block other users from signing inGo · github.com/grafana/grafana · fixed in 8.5.14, 9.1.8
- CVE-2022-41316HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role'sGo · github.com/hashicorp/vault · fixed in 1.11.4, 1.10.7, 1.9.10
- CVE-2022-32174Gogs - XSSGo · gogs.io/gogs
- CVE-2022-32175AdGuardHome - CSRFGo · github.com/adguardteam/adguardhome · fixed in 0.108.0-b.16
- CVE-2022-39271Traefik HTTP/2 connections management could cause a denial of serviceGo · github.com/traefik/traefik/v2 · fixed in 2.8.8, 2.9.0-rc5
- CVE-2022-41606HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can bGo · github.com/hashicorp/nomad · fixed in 1.2.13, 1.3.6
- CVE-2022-32171Zinc - Stored XSSGo · github.com/zinclabs/zinc, github.com/zincsearch/zincsearch · fixed in 0.3.2
- CVE-2022-32172Zinc - Cross-Site ScriptingGo · github.com/zinclabs/zinc, github.com/zincsearch/zincsearch · fixed in 0.3.2
- CVE-2022-39222OAuth authorization code exposure in DexGo · github.com/dexidp/dex · fixed in 2.35.0
- CVE-2022-39237Digital Signature Hash Algorithms Not Validated in sylabs/sifGo · github.com/sylabs/sif/v2 · fixed in 2.8.1
- CVE-2022-39273Default OAuth Authorization Server secret in FlyteAdminGo · github.com/flyteorg/flyteadmin · fixed in 1.1.44