Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-45327Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API.Go · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.11.2
- CVE-2021-45326Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state alteGo · github.com/go-gitea/gitea · fixed in 1.5.2
- CVE-2021-45325Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.Go · github.com/go-gitea/gitea · fixed in 1.7.0
- CVE-2022-24450NATS nats-server before 2.7.2 has Incorrect Access Control.Go · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 +1 · fixed in 2.7.2, 0.24.1
- CVE-2022-23206Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauthGo · github.com/apache/trafficcontrol · fixed in 5.1.6+incompatible, 6.1.0+incompatible, 6.1.0 and more
- CVE-2022-0317Improper Input Validation in AKPublic.Verify in go-attestationGo · github.com/google/go-attestation · fixed in 0.4.0
- CVE-2022-23600Limited ability to spoof SAML authentication with missing audience verificationGo · github.com/fleetdm/fleet/v4 · fixed in 4.9.1
- CVE-2022-24348Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repositGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.9, 2.2.4
- CVE-2021-46398A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privileGo · github.com/filebrowser/filebrowser/v2 · fixed in 2.18.0
- CVE-2022-21687Command injection in gh-ostGo · github.com/github/gh-ost · fixed in 1.1.3
- CVE-2020-8562Bypass of Kubernetes API Server proxy TOCTOUGo · k8s.io/kubernetes
- CVE-2022-24124The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/gGo · github.com/casdoor/casdoor · fixed in 1.13.1
- CVE-2022-23857model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists.Go · github.com/navidrome/navidrome · fixed in 0.47.5
- CVE-2021-39293In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can Go · stdlib · fixed in 1.16.8, 1.17.1
- CVE-2022-21708Denial of Service in graphql-goGo · github.com/graph-gophers/graphql-go · fixed in 1.3.0
- CVE-2022-21646Lookup operations do not take into account wildcards in SpiceDBGo · github.com/authzed/spicedb · fixed in 1.4.0
- CVE-2021-25743ANSI escape characters in kubectl output are not being filteredGo · k8s.io/kubernetes · fixed in 1.26.0-alpha.3
- CVE-2021-43816Improper Preservation of Permissions in containerdGo · github.com/containerd/containerd · fixed in 1.5.9
- CVE-2021-44716net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/Go · golang.org/x/net, golang.org/x/net/http2 +1 · fixed in 0.0.0-20211209124913-491a49abca63, 1.16.12, 1.17.5
- CVE-2021-44717Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a conseGo · stdlib · fixed in 1.16.12, 1.17.5
- CVE-2021-42583A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the expoGo · github.com/foxcpp/maddy · fixed in 0.5.2
- CVE-2021-23772Arbitrary File WriteGo · github.com/kataras/iris, github.com/kataras/iris/v12 · fixed in 12.2.0-alpha8
- CVE-2021-4024A flaw was found in podman.Go · github.com/containers/podman, github.com/containers/podman/v2 +1 · fixed in 3.4.3
- CVE-2021-43839Drainage of FeeCollector's Block Transaction FeesGo · github.com/crypto-org-chain/cronos, github.com/tharsis/ethermint +1 · fixed in 0.6.5, 0.10.0, 0.7.3
- CVE-2021-39183Unsafe inline XSS OwncastGo · github.com/owncast/owncast · fixed in 0.0.9
- CVE-2021-43815Grafana directory traversal for `.cvs` filesGo · github.com/grafana/grafana · fixed in 8.3.2
- CVE-2021-22565Insufficient Granularity of Access Control in GAEN Notification ServerGo · github.com/google/exposure-notifications-verification-server · fixed in 1.1.2
- CVE-2021-41090Instance config inline secret exposureGo · github.com/grafana/agent · fixed in 0.21.2
- CVE-2021-43798Grafana path traversalGo · github.com/grafana/grafana · fixed in 8.3.1, 8.2.7, 8.1.8 and more
- CVE-2021-43784Overflow in netlink bytemsg length field allows attacker to override netlink-based container configurationGo · github.com/opencontainers/runc · fixed in 1.1.0, 1.0.3