Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-38817Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.Go · github.com/dapr/dashboard
- CVE-2022-2529Multiple DoS Attack Vectors in sflow packet handlingGo · github.com/cloudflare/goflow, github.com/cloudflare/goflow/v3 · fixed in 3.4.4
- CVE-2022-40931dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).Go · github.com/dutchcoders/transfer.sh
- CVE-2022-40083Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component.Go · github.com/labstack/echo/v4 · fixed in 4.9.0
- CVE-2022-40082Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.Go · github.com/cloudwego/hertz · fixed in 0.3.1
- CVE-2022-32169bytebase - Improper AuthorizationGo · github.com/bytebase/bytebase
- CVE-2022-32170bytebase - Improper AuthorizationGo · github.com/bytebase/bytebase
- CVE-2022-39219Bifrost users using basic authntication can bypass write permission limitGo · github.com/brokercap/bifrost · fixed in 1.8.7-release
- CVE-2022-3257Server-side Denial of Service while processing a specifically crafted GIF fileGo · github.com/mattermost/mattermost-server/v6 · fixed in 7.2.0
- CVE-2021-41803HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage Go · github.com/hashicorp/consul · fixed in 1.11.9, 1.12.5, 1.13.2
- CVE-2022-40716HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPGo · github.com/hashicorp/consul · fixed in 1.11.9, 1.12.5, 1.13.2
- CVE-2022-36062Grafana folders admin only permission privilege escalationGo · github.com/grafana/grafana · fixed in 8.5.13, 9.0.9, 9.1.6
- CVE-2022-40186An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3.Go · github.com/hashicorp/vault · fixed in 1.9.9, 1.10.6, 1.11.3
- CVE-2022-39220XSS Vulnerabilities in WebClientGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.3.5
- CVE-2022-32167Cloudreve - Stored XSSGo · github.com/cloudreve/cloudreve/v3, github.com/hfo4/cloudreve · fixed in 3.6.0-beta1
- CVE-2022-35957Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server adminGo · github.com/grafana/grafana · fixed in 9.1.6, 9.0.9, 8.5.13
- CVE-2022-2995Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible dataGo · github.com/cri-o/cri-o · fixed in 1.25.0
- CVE-2022-39213Out-of-bounds Read in go-cvssGo · github.com/pandatix/go-cvss · fixed in 0.4.0
- CVE-2022-1798Path Traversal vulnerability in KubevirtGo · kubevirt.io/kubevirt · fixed in 0.55.1
- CVE-2022-40365Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname Go · github.com/ouqiang/gocron
- CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosignGo · github.com/sigstore/cosign · fixed in 1.12.0
- CVE-2022-32190Failure to strip relative path components in net/urlGo · stdlib · fixed in 1.19.1
- CVE-2022-36103Talos worker join token can be used to get elevated access level to the Talos APIGo · github.com/talos-systems/talos · fixed in 1.2.2
- CVE-2022-2990An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possGo · github.com/containers/buildah · fixed in 1.27.1
- CVE-2022-2989An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possiGo · github.com/containers/podman/v3, github.com/containers/podman/v4 · fixed in 3.0.1, 4.2.0
- CVE-2022-39200Signature checks not applied to some retrieved missing eventsGo · github.com/matrix-org/dendrite · fixed in 0.9.8
- CVE-2022-25295Open RedirectGo · github.com/gophish/gophish · fixed in 0.12.0
- CVE-2022-38638Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.Go · github.com/casdoor/casdoor · fixed in 1.103.1
- CVE-2022-36110Netmaker vulnerable to Insufficient Granularity of Access ControlGo · github.com/gravitl/netmaker · fixed in 0.15.1
- CVE-2022-36109Moby vulnerability relating to supplementary group permissionsGo · github.com/docker/docker · fixed in 20.10.18+incompatible, 20.10.18