Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-23648Insecure handling of image volumes in containerd CRI pluginGo · github.com/containerd/containerd · fixed in 1.4.13, 1.5.10, 1.6.1
- CVE-2022-24685HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU Go · github.com/hashicorp/nomad · fixed in 1.0.17, 1.1.12, 1.2.6
- CVE-2022-25328Privilege escalation through command injection in fscryptGo · github.com/google/fscrypt · fixed in 0.3.3
- CVE-2022-25327Local Denial of Service in fscrypt PAM moduleGo · github.com/google/fscrypt · fixed in 0.3.3
- CVE-2022-25326Denial of Service in fscryptGo · github.com/google/fscrypt · fixed in 0.3.3
- CVE-2022-24687HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user withGo · github.com/hashicorp/consul · fixed in 1.9.15, 1.10.8, 1.11.3
- CVE-2021-4070Off-by-one Error in v2fly/v2ray-coreGo · github.com/v2fly/v2ray-core, github.com/v2fly/v2ray-core/v4 · fixed in 4.44.0
- CVE-2022-23635Unauthenticated control plane denial of service attack in IstioGo · istio.io/istio · fixed in 1.13.1, 1.12.4, 1.11.7
- CVE-2022-23652Privilege escalation using hop-by-hop Connection headerGo · github.com/clastix/capsule-proxy · fixed in 0.2.1
- CVE-2022-23650Use of Hard-coded Cryptographic Key in NetmakerGo · github.com/gravitl/netmaker · fixed in 0.8.5, 0.9.4
- CVE-2022-23649Improper Certificate Validation in CosignGo · github.com/sigstore/cosign · fixed in 1.5.2
- CVE-2022-0664Use of Hard-coded Cryptographic Key in gravitl/netmakerGo · github.com/gravitl/netmaker · fixed in 0.8.5, 0.9.4
- CVE-2022-24683HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capGo · github.com/hashicorp/nomad · fixed in 1.0.18, 1.1.12, 1.2.6
- CVE-2022-23632Traefik skips the router TLS configuration when the host header is an FQDNGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 · fixed in 2.6.1
- CVE-2022-24684HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 1.1.11, and 1.2.5 allow operators with job-submit capabilities to use the spread Go · github.com/hashicorp/nomad · fixed in 1.0.18, 1.1.12, 1.2.6
- CVE-2022-21698Uncontrolled Resource Consumption in promhttpGo · github.com/prometheus/client_golang · fixed in 1.11.1
- CVE-2022-24686HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that Go · github.com/hashicorp/nomad · fixed in 1.0.18, 1.1.12, 1.2.6
- CVE-2022-24968In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a Go · mellium.im/xmpp · fixed in 0.21.1
- CVE-2022-23773cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags.Go · toolchain · fixed in 1.16.14, 1.17.7
- CVE-2022-23772Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.Go · stdlib · fixed in 1.16.14, 1.17.7
- CVE-2022-23806Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int vaGo · stdlib · fixed in 1.16.14, 1.17.7
- CVE-2022-0532An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier.Go · github.com/cri-o/cri-o · fixed in 1.23.1
- CVE-2022-23628Array literal misordering in github.com/open-policy-agent/opaGo · github.com/open-policy-agent/opa · fixed in 0.37.2
- CVE-2021-45331An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges.Go · code.gitea.io/gitea · fixed in 1.5.0
- CVE-2021-45330An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and tGo · code.gitea.io/gitea · fixed in 1.6.0
- CVE-2021-45329Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URLGo · github.com/go-gitea/gitea · fixed in 1.5.1
- CVE-2022-21713Exposure of Sensitive Information in GrafanaGo · github.com/grafana/grafana · fixed in 7.5.15, 8.3.5
- CVE-2022-21703Cross Site Request Forgery in GrafanaGo · github.com/grafana/grafana/pkg/web · fixed in 7.5.15, 8.3.5
- CVE-2022-21702Cross site scripting in Grafana proxyGo · github.com/grafana/grafana · fixed in 7.5.15, 8.3.5
- CVE-2021-45328Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.Go · github.com/go-gitea/gitea · fixed in 1.4.3