Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-27847A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation.Go · github.com/dexidp/dex, github.com/russellhaering/goxmldsig · fixed in 2.27.0, 1.1.0
- CVE-2020-1701A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler.Go · kubevirt.io/kubevirt · fixed in 0.26.0
- CVE-2021-31525net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReGo · golang.org/x/net, stdlib · fixed in 0.0.0-20210428140749-89ef3d95e781, 1.15.12, 1.16.4
- CVE-2021-30465runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal.Go · github.com/opencontainers/runc · fixed in 1.0.0-rc95
- CVE-2021-33194golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFrGo · golang.org/x/net · fixed in 0.0.0-20210520170846-37e1c6afe023
- CVE-2021-33497Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.Go · github.com/dutchcoders/transfer.sh · fixed in 1.2.4
- CVE-2021-33496Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.Go · github.com/dutchcoders/transfer.sh · fixed in 1.2.4
- CVE-2021-29499Predictable SIF UUID IdentifiersGo · github.com/sylabs/sif · fixed in 1.2.3
- CVE-2020-7731Denial of Service (DoS)Go · github.com/russellhaering/gosaml2, github.com/russellhaering/goxmldsig · fixed in 0.7.0, 1.1.1
- CVE-2021-31232The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used.Go · github.com/cortexproject/cortex · fixed in 1.8.1
- CVE-2021-29482denial of service in github.com/ulikunitz/xzGo · github.com/ulikunitz/xz · fixed in 0.5.8
- CVE-2021-23365Authentication BypassGo · github.com/tyktechnologies/tyk-identity-broker · fixed in 1.1.1
- CVE-2021-29456Authelia allows open redirects on the logout endpointGo · github.com/authelia/authelia/v4 · fixed in 4.28.0
- CVE-2020-25864HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting.Go · github.com/hashicorp/consul · fixed in 1.9.5, 1.8.10, 1.7.14
- CVE-2021-21405BLS Signature "Malleability"Go · github.com/filecoin-project/lotus · fixed in 1.5.0
- CVE-2021-28484An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04).Go · github.com/yubico/yubihsm-connector · fixed in 3.0.1
- CVE-2020-7924Specific command line parameter might result in accepting invalid certificateGo · github.com/mongodb/mongo-tools · fixed in 0.0.0-20200819165540-8c1800b51550, 100.2.0
- CVE-2021-21432Reject unauthorized access with GitHub PATsGo · github.com/go-vela/server · fixed in 0.7.5
- CVE-2021-21404Crash due to malformed relay protocol messageGo · github.com/syncthing/syncthing · fixed in 1.15.0
- CVE-2021-29136Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink travGo · github.com/opencontainers/umoci · fixed in 0.4.7
- CVE-2021-29652Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out processGo · github.com/pomerium/pomerium · fixed in 0.13.4
- CVE-2021-29651Pomerium before 0.13.4 has an Open Redirect (issue 1 of 2).Go · github.com/pomerium/pomerium · fixed in 0.13.4
- CVE-2021-20291A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1.Go · github.com/containers/storage · fixed in 1.28.1
- CVE-2021-22538Privilege escalation in RBAC systemGo · github.com/google/exposure-notifications-verification-server · fixed in 0.23.1
- CVE-2021-29417gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.Go · github.com/liamg/gitjacker · fixed in 0.1.0
- CVE-2021-29272bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanismGo · github.com/microcosm-cc/bluemonday · fixed in 1.0.5
- CVE-2021-20206An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.Go · github.com/containernetworking/cni · fixed in 0.8.1
- CVE-2021-21411Incorrect authorization in OAuth2-ProxyGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.1.0
- CVE-2021-21403Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/serverGo · github.com/kongchuanhujiao/server · fixed in 1.3.21
- CVE-2020-26283Control character injection in console outputGo · github.com/ipfs/go-ipfs · fixed in 0.8.0