Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-36776Steve API proxy impersonationGo · github.com/rancher/rancher · fixed in 2.5.10
- CVE-2021-36775Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindingsGo · github.com/rancher/rancher · fixed in 2.4.18, 2.5.12, 2.6.3
- CVE-2022-24797Exposure of Sensitive Information in PomeriumGo · github.com/pomerium/pomerium · fixed in 0.17.1
- CVE-2022-26245Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.Go · github.com/open-falcon/falcon-plus
- CVE-2022-24778Incorrect Authorization in imgcryptGo · github.com/containerd/imgcrypt · fixed in 1.1.4
- CVE-2022-1058Open Redirect on login in go-gitea/giteaGo · code.gitea.io/gitea · fixed in 1.16.5
- CVE-2022-24769Default inheritable capabilities for linux container should be emptyGo · github.com/docker/docker, github.com/moby/moby · fixed in 20.10.14, 20.10.14+incompatible
- CVE-2022-24768Improper access control allows admin privilege escalation in Argo CDGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.14, 2.2.8, 2.3.2
- CVE-2022-24731Path traversal allows leaking out-of-bound files from Argo CD repo-serverGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.11, 2.2.6, 2.3.0
- CVE-2022-24730Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-serverGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.11, 2.2.6, 2.3.0
- CVE-2022-0415Remote Command Execution in uploading repository file in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.6
- CVE-2022-27191The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstGo · golang.org/x/crypto · fixed in 0.0.0-20220314234659-1baeb1ce4c0b
- CVE-2022-21221Directory TraversalGo · github.com/valyala/fasthttp · fixed in 1.34.0
- CVE-2021-42219Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amGo · github.com/ethereum/go-ethereum
- CVE-2022-0811A flaw was found in CRI-O in the way it set kernel options for a pod.Go · github.com/cri-o/cri-o · fixed in 1.19.6, 1.20.7, 1.21.6 and more
- CVE-2021-29134The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.Go · code.gitea.io/gitea · fixed in 1.13.6
- CVE-2022-26533Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.Go · github.com/xhofe/alist · fixed in 2.1.1
- CVE-2022-0870Server-Side Request Forgery (SSRF) in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.5
- CVE-2022-0871Missing Authorization in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.5
- CVE-2022-26652NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams.Go · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 +1 · fixed in 2.7.4, 0.24.3
- CVE-2022-0905Missing Authorization in go-gitea/giteaGo · code.gitea.io/gitea · fixed in 1.16.4
- CVE-2022-24753Code injection in Stripe CLI on windowsGo · github.com/stripe/stripe-cli · fixed in 1.7.13
- CVE-2022-24732Maddy Mail Server does not implement account expiryGo · github.com/foxcpp/maddy · fixed in 0.5.4
- CVE-2022-24738Account compromise in EvmosGo · github.com/tharsis/evmos, github.com/tharsis/evmos/v2 · fixed in 2.0.1
- CVE-2022-24193CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.Go · github.com/icewhaletech/casaos · fixed in 0.2.8
- CVE-2022-24921regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.Go · stdlib · fixed in 1.16.15, 1.17.8
- CVE-2022-23328A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account Go · github.com/ethereum/go-ethereum
- CVE-2022-23327A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in onGo · github.com/ethereum/go-ethereum
- CVE-2021-3762A directory traversal vulnerability was found in the ClairCore engine of Clair.Go · github.com/quay/claircore · fixed in 0.4.8, 1.1.0, 0.5.5
- CVE-2021-3602An information disclosure flaw was found in Buildah, when building containers using chroot isolation.Go · github.com/containers/buildah · fixed in 1.22.0, 1.16.8, 1.17.2 and more