Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-30632Stack exhaustion on crafted paths in path/filepathGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-28131Stack exhaustion from deeply nested XML documents in encoding/xmlGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-29804Path traversal via Clean on Windows in path/filepathGo · stdlib · fixed in 1.17.11, 1.18.3
- CVE-2022-37450Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulationGo · github.com/ethereum/go-ethereum
- CVE-2022-35936Ethermint DoS through Unintended Contract SelfdestructGo · github.com/crypto-org-chain/cronos, github.com/evmos/ethermint +8 · fixed in 0.7.1-rc2, 0.18.0, 7.0.0
- CVE-2022-35930Ability to bypass attestation verification in sigstore PolicyControllerGo · github.com/sigstore/policy-controller · fixed in 0.2.1
- CVE-2022-35929False positive signature verification in cosignGo · github.com/sigstore/cosign · fixed in 1.10.1
- CVE-2022-37315graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.Go · github.com/graphql-go/graphql · fixed in 0.8.1
- CVE-2022-24912Timing AttackGo · github.com/runatlantis/atlantis · fixed in 0.19.7
- CVE-2022-25891Denial of Service (DoS)Go · github.com/containrrr/shoutrrr · fixed in 0.6.0
- CVE-2022-30634Indefinite hang with large buffers on Windows in crypto/randGo · stdlib · fixed in 1.17.11, 1.18.3
- CVE-2022-31107Grafana account takeover via OAuth vulnerabilityGo · github.com/grafana/grafana · fixed in 8.3.10, 8.4.10, 8.5.9 and more
- CVE-2022-31097Stored XSS in Grafana's Unified AlertingGo · github.com/grafana/grafana · fixed in 9.0.3, 8.5.9, 8.4.10 and more
- CVE-2022-2401Team members could access sensitive information of other users via an API callGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 6.3.9, 6.5.2, 6.6.2 and more
- CVE-2022-31145Insufficient AccessToken Expiration Check in FlyteAdminGo · github.com/flyteorg/flyteadmin · fixed in 1.1.31
- CVE-2022-31102Cross-site Scripting for Argo CD single sign on usersGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.3.6, 2.4.5
- CVE-2022-31105Argo CD's certificate verification is skipped for connections to OIDC providersGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.2.11, 2.3.6, 2.4.5
- CVE-2022-1025All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.14, 2.2.8, 2.3.2
- CVE-2022-2385AccessKeyID validation bypassGo · sigs.k8s.io/aws-iam-authenticator · fixed in 0.5.9
- CVE-2022-31080KubeEdge Websocket Client in package Viaduct: DoS from large response messageGo · github.com/kubeedge/kubeedge · fixed in 1.9.4, 1.10.2, 1.11.1
- CVE-2022-31079KubeEdge Cloud Stream and Edge Stream DoS from large stream messageGo · github.com/kubeedge/kubeedge · fixed in 1.11.1, 1.10.2, 1.9.4
- CVE-2022-31078KubeEdge CloudCore Router memory exhaustionGo · github.com/kubeedge/kubeedge · fixed in 1.9.4, 1.10.2, 1.11.1
- CVE-2022-31075KubeEdge DoS when signing the CSR from EdgeCoreGo · github.com/kubeedge/kubeedge · fixed in 1.9.4, 1.10.2, 1.11.1
- CVE-2022-31074KubeEdge Cloud AdmissionController component DoSGo · github.com/kubeedge/kubeedge · fixed in 1.11.1, 1.10.2, 1.9.4
- CVE-2022-31073KubeEdge Edge ServiceBus module DoSGo · github.com/kubeedge/kubeedge · fixed in 1.9.4, 1.10.2, 1.11.1
- CVE-2022-31121Improper Input Validation in fabric hyperledgerGo · github.com/hyperledger/fabric · fixed in 2.2.7, 2.4.5
- CVE-2015-3207In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.Go · github.com/openshift/origin · fixed in 1.0.0
- CVE-2022-2321Improper Restriction of Excessive Authentication Attempts in heroiclabs/nakamaGo · github.com/heroiclabs/nakama/v3
- CVE-2022-2306Insufficient Session Expiration in heroiclabs/nakamaGo · github.com/heroiclabs/nakama
- CVE-2022-31836The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.Go · github.com/astaxie/beego, github.com/beego/beego +1 · fixed in 1.12.11, 2.0.4