Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-14144The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the doGo · code.gitea.io/gitea · fixed in 1.12.6
- CVE-2020-15229Path traversal and files overwrite with unsquashfsGo · github.com/sylabs/singularity · fixed in 3.6.4
- CVE-2020-15233OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addressesGo · github.com/ory/fosite · fixed in 0.34.1
- CVE-2020-15234Redirect URL matching ignores character casingGo · github.com/ory/fosite · fixed in 0.34.1
- CVE-2020-24356Local Privilege Escalation in cloudflaredGo · github.com/cloudflare/cloudflared · fixed in 0.0.0-20200820025921-9323844ea773
- CVE-2020-16844In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcaGo · istio.io/istio · fixed in 1.5.9, 1.6.8
- CVE-2020-25816HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiratioGo · github.com/hashicorp/vault · fixed in 1.5.4
- CVE-2020-26160jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is alGo · github.com/dgrijalva/jwt-go, github.com/dgrijalva/jwt-go/v4 · fixed in 4.0.0-preview1
- CVE-2020-13794Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.Go · github.com/goharbor/harbor · fixed in 2.0.3, 2.0.3+incompatible
- CVE-2020-15216Signature Validation Bypass in goxmldsigGo · github.com/russellhaering/goxmldsig · fixed in 1.1.0
- CVE-2020-15222Replay of private_key_jwt possible in ORY FositeGo · github.com/ory/fosite · fixed in 0.31.0
- CVE-2020-15223Ignored storage errors on token revokation in ORY FositeGo · github.com/ory/fosite · fixed in 0.34.0
- CVE-2020-14370An information disclosure vulnerability was found in containers/podman in versions before 2.0.5.Go · github.com/containers/libpod, github.com/containers/libpod/v2 +1 · fixed in 2.0.5
- CVE-2020-15187Duplicate plugin entries in HelmGo · helm.sh/helm, helm.sh/helm/v3 · fixed in 2.16.11, 3.3.2
- CVE-2020-15186Improper sanitization of plugin names in HelmGo · helm.sh/helm, helm.sh/helm/v3 · fixed in 2.16.11, 3.3.2
- CVE-2020-15185Duplicated chart entries in HelmGo · helm.sh/helm, helm.sh/helm/v3 · fixed in 2.16.11, 3.3.2
- CVE-2020-15184Aliases are never checked in HelmGo · helm.sh/helm, helm.sh/helm/v3 · fixed in 2.16.11, 3.3.2
- CVE-2020-25040Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations,Go · github.com/sylabs/singularity · fixed in 3.6.3
- CVE-2020-25039Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container executGo · github.com/sylabs/singularity · fixed in 3.6.3
- CVE-2020-25614xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of serviceGo · github.com/antchfx/xmlquery · fixed in 1.3.1
- CVE-2020-8927Buffer overflow in Brotli libraryGo · github.com/google/brotli
- CVE-2020-24553Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.Go · stdlib · fixed in 1.14.8, 1.15.1
- CVE-2020-7669Arbitrary File Write via Archive Extraction (Zip Slip)Go · github.com/u-root/u-root · fixed in 0.9.0
- CVE-2020-7666Arbitrary File Write via Archive Extraction (Zip Slip)Go · github.com/u-root/u-root/pkg/cpio
- CVE-2020-7665Arbitrary File Write via Archive Extraction (Zip Slip)Go · github.com/u-root/u-root · fixed in 0.9.0
- CVE-2019-19499Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modiGo · github.com/grafana/grafana · fixed in 6.4.4
- CVE-2020-16251HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authenticaGo · github.com/hashicorp/vault · fixed in 1.2.5, 1.3.8, 1.4.4 and more
- CVE-2020-16250HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authenticaGo · github.com/hashicorp/vault · fixed in 1.2.5, 1.3.8, 1.4.4 and more
- CVE-2020-7711Denial of Service (DoS)Go · github.com/russellhaering/gosaml2, github.com/russellhaering/goxmldsig · fixed in 0.7.0, 1.1.1
- CVE-2020-24359HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's netGo · github.com/hashicorp/vault-ssh-helper · fixed in 0.2.0