Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-26279Path traversalGo · github.com/ipfs/go-ipfs · fixed in 0.8.0
- CVE-2021-28955git-bug before 0.7.2 has an Uncontrolled Search Path Element.Go · github.com/michaelmure/git-bug · fixed in 0.7.2
- CVE-2021-27358The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remotGo · github.com/grafana/grafana · fixed in 7.4.2
- CVE-2021-28681Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed.Go · github.com/pion/webrtc/v3 · fixed in 3.0.15
- CVE-2021-3127NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.Go · github.com/nats-io/jwt, github.com/nats-io/jwt/v2 +1 · fixed in 1.2.3-0.20210314221642-a826c77dc9d2, 2.0.1, 2.2.0
- CVE-2021-28378Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.Go · code.gitea.io/gitea · fixed in 1.13.4
- CVE-2021-27919archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for aGo · stdlib · fixed in 1.16.1
- CVE-2021-27918encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOFGo · stdlib · fixed in 1.15.9, 1.16.1
- CVE-2021-21334environment variable leakGo · github.com/containerd/containerd · fixed in 1.4.4, 1.3.10
- CVE-2021-23351Denial of Service (DoS)Go · github.com/pires/go-proxyproto · fixed in 0.5.0
- CVE-2020-28466Denial of Service (DoS)Go · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.2.0
- CVE-2021-27098In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPGo · github.com/spiffe/spire · fixed in 0.8.5, 0.9.4, 0.10.2 and more
- CVE-2021-25313Rancher: XSS on /v3/cluster/Go · github.com/rancher/rancher · fixed in 2.5.6, 2.4.14, 2.3.11
- CVE-2021-27940resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.Go · github.com/openark/orchestrator · fixed in 3.2.4
- CVE-2021-23347Cross-site Scripting (XSS)Go · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 1.7.13, 1.8.6
- CVE-2020-14359A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass oGo · github.com/keycloak/keycloak-gatekeeper
- CVE-2021-20188A flaw was found in podman before 1.7.0.Go · github.com/containers/libpod · fixed in 1.7.0
- CVE-2021-22133The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an applicatioGo · go.elastic.co/apm · fixed in 1.11.0
- CVE-2021-25835Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module.Go · github.com/cosmos/ethermint · fixed in 0.4.1
- CVE-2021-25834Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module.Go · github.com/cosmos/ethermint · fixed in 0.4.1
- CVE-2021-21303Injection attack in HelmGo · helm.sh/helm/v3 · fixed in 3.5.2
- CVE-2021-3382Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors rGo · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.13.2
- CVE-2020-29662In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.Go · github.com/goharbor/harbor · fixed in 2.0.5, 2.1.2, 2.0.5+incompatible and more
- CVE-2021-21291Subdomain checking of whitelisted domains could allow unintended redirectsGo · github.com/oauth2-proxy/oauth2-proxy, github.com/oauth2-proxy/oauth2-proxy/v7 · fixed in 7.0.0
- CVE-2021-20199Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts).Go · github.com/containers/podman/v3 · fixed in 3.0.0
- CVE-2021-21284privilege escalation in MobyGo · github.com/moby/moby · fixed in 19.3.15, 20.10.3
- CVE-2021-21285Docker daemon crash during image pull of malicious imageGo · github.com/moby/moby · fixed in 19.3.15, 20.10.3
- CVE-2021-3282HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without autheGo · github.com/hashicorp/vault · fixed in 1.6.2
- CVE-2021-3283HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same noGo · github.com/hashicorp/nomad · fixed in 1.0.3, 0.12.10
- CVE-2021-21271Denial of service in TenderMint CoreGo · github.com/tendermint/tendermint · fixed in 0.34.3