Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-24817Improper kubeconfig validation allows arbitrary code executionGo · github.com/fluxcd/flux2, github.com/fluxcd/helm-controller +1 · fixed in 0.29.0, 0.19.0, 0.23.0
- CVE-2022-29164Privilege Escalation in argo-workflowsGo · github.com/argoproj/argo-workflows/v3 · fixed in 3.2.11, 3.3.5
- CVE-2022-29173No protection against rollback attacks in go-tufGo · github.com/theupdateframework/go-tuf · fixed in 0.3.0
- CVE-2022-1464Stored xss bug in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.7
- CVE-2022-27313An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configurationGo · code.gitea.io/gitea · fixed in 1.16.4
- CVE-2021-4200Write access to the Catalog for any user when restricted-admin role is enabledGo · github.com/rancher/rancher · fixed in 2.6.4, 2.5.13
- CVE-2021-36784Privilege escalation for users with create/update permissions in Global RolesGo · github.com/rancher/rancher · fixed in 2.6.4, 2.5.13
- CVE-2021-36778Exposure of repository credentials to external third-party sourcesGo · github.com/rancher/rancher · fixed in 2.6.3, 2.5.12
- CVE-2022-25850Server-side Request Forgery (SSRF)Go · github.com/hoppscotch/proxyscotch · fixed in 1.0.0
- CVE-2022-29947Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.Go · github.com/woodpecker-ci/woodpecker · fixed in 0.15.1
- CVE-2022-1227A privilege escalation flaw was found in Podman.Go · github.com/containers/podman/v3, github.com/containers/psgo · fixed in 3.4, 1.7.2
- CVE-2022-29810The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.Go · github.com/hashicorp/go-getter · fixed in 1.5.11
- CVE-2022-24675encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.Go · stdlib · fixed in 1.17.9, 1.18.1
- CVE-2022-27536Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificaGo · stdlib · fixed in 1.18.1
- CVE-2022-28327The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.Go · stdlib · fixed in 1.17.9, 1.18.1
- CVE-2022-24826Git LFS can execute a binary from the current directory on WindowsGo · github.com/git-lfs/git-lfs, github.com/git-lfs/git-lfs/v3 · fixed in 3.1.3
- CVE-2022-1384Authorized users are allowed to install old plugin versions from the MarketplaceGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 6.5.0
- CVE-2022-1385Invitation Email is resent as a Reminder after invalidating pending email invitesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 6.5.0
- CVE-2022-24825Smokescreen SSRF via deny list bypassGo · github.com/stripe/smokescreen · fixed in 0.0.3
- CVE-2022-29153HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent fGo · github.com/hashicorp/consul · fixed in 1.9.17, 1.10.10, 1.11.5
- CVE-2022-24863Denial of service in http-swaggerGo · github.com/swaggo/http-swagger · fixed in 1.2.6
- CVE-2022-27652A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions.Go · github.com/cri-o/cri-o · fixed in 1.24.0
- CVE-2022-1332Restricted custom admin role can bypass the restrictions and view the server logs and server config.json file contentsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 5.37.9, 6.4.2, 6.3.5 and more
- CVE-2022-1337OOM DoS in Mattermost image proxyGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +1 · fixed in 6.4.2
- CVE-2021-30080An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control.Go · github.com/astaxie/beego, github.com/beego/beego +1 · fixed in 2.0.3
- CVE-2021-27116An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.Go · github.com/beego/beego, github.com/beego/beego/v2 · fixed in 2.0.2
- CVE-2021-27117An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locaGo · github.com/beego/beego, github.com/beego/beego/v2 · fixed in 2.0.2
- CVE-2022-27651A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.Go · github.com/containers/buildah · fixed in 1.25.0
- CVE-2022-27649A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.Go · github.com/containers/podman, github.com/containers/podman/v2 +2 · fixed in 4.0.3
- CVE-2022-21235Command InjectionGo · github.com/masterminds/vcs · fixed in 1.13.3, 1.13.2