Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-18876An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used.Go · github.com/mattermost/mattermost-server · fixed in 4.3.0+incompatible, 4.1.2-0.20171004201910-6be8113eb60c, 4.2.1-0.20171004194140-6d3cb2ce07fc and more
- CVE-2017-18875An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used.Go · github.com/mattermost/mattermost-server · fixed in 4.3.0+incompatible, 4.1.2-0.20171004201910-6be8113eb60c, 4.2.1-0.20171004194140-6d3cb2ce07fc and more
- CVE-2017-18870An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4.Go · github.com/mattermost/mattermost-server
- CVE-2018-21258An issue was discovered in Mattermost Server before 5.1.Go · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 · fixed in 5.1.0
- CVE-2020-14457An issue was discovered in Mattermost Server before 5.20.0.Go · github.com/mattermost/mattermost, github.com/mattermost/mattermost-server +1 · fixed in 5.20.0
- CVE-2020-14040The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loGo · golang.org/x/text · fixed in 0.3.3
- CVE-2020-7668Arbitrary File Write via Archive Extraction (Zip Slip)Go · github.com/unknwon/cae · fixed in 1.0.1
- CVE-2020-7664Arbitrary File Write via Archive Extraction (Zip Slip)Go · github.com/unknwon/cae · fixed in 1.0.1
- CVE-2020-4053Path Traversal in Helm Plugin ArchiveGo · helm.sh/helm/v3 · fixed in 3.2.4
- CVE-2018-21246Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMGo · github.com/caddyserver/caddy, github.com/mholt/caddy · fixed in 0.10.13
- CVE-2020-13170HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replicatiGo · github.com/hashicorp/consul · fixed in 1.6.6, 1.7.4
- CVE-2020-12797HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers.Go · github.com/hashicorp/consul · fixed in 1.6.6, 1.7.4
- CVE-2020-12758HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry.Go · github.com/hashicorp/consul · fixed in 1.6.6, 1.7.4
- CVE-2020-13250HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnGo · github.com/hashicorp/consul · fixed in 1.6.6, 1.7.4
- CVE-2020-12757HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials Go · github.com/hashicorp/vault-plugin-secrets-gcp · fixed in 0.6.2
- CVE-2020-13223HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials.Go · github.com/hashicorp/vault · fixed in 1.3.6, 1.4.2
- CVE-2020-2023Kata Containers - Containers have access to the guest root filesystem deviceGo · github.com/kata-containers/agent, github.com/kata-containers/runtime · fixed in 1.9.1, 1.10.5, 1.11.1
- CVE-2020-2026Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host pathGo · github.com/kata-containers/runtime · fixed in 1.9.1, 1.10.6, 1.11.1
- CVE-2020-8555Kubernetes kube-controller-manager SSRFGo · k8s.io/kubernetes · fixed in 1.18.1, 1.17.4, 1.16.9 and more
- CVE-2020-11091Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisementsGo · github.com/weaveworks/weave · fixed in 2.6.3+incompatible, 2.6.3
- CVE-2020-13379The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue.Go · github.com/grafana/grafana · fixed in 6.7.4, 7.0.2
- CVE-2020-7010Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator.Go · github.com/elastic/cloud-on-k8s · fixed in 1.1.0
- CVE-2020-13597Calico nodes IPv6 traffic redirection from route advertismentGo · github.com/projectcalico/calico · fixed in 3.14.1, 3.13.4, 3.12.2 and more
- CVE-2020-10749A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in KuberneteGo · github.com/containernetworking/plugins · fixed in 0.8.6
- CVE-2018-18625Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen.Go · github.com/grafana/grafana · fixed in 6.0.0-beta1+incompatible, 6.0.0-beta1
- CVE-2018-18624Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen.Go · github.com/grafana/grafana · fixed in 7.0.0
- CVE-2018-18623Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen.Go · github.com/grafana/grafana · fixed in 6.0.0-beta1+incompatible, 6.0.0-beta1
- CVE-2020-13401An issue was discovered in Docker Engine before 19.03.11.Go · github.com/docker/docker-ce · fixed in 19.03.11
- CVE-2020-13430Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.Go · github.com/grafana/grafana · fixed in 7.0.0
- CVE-2020-13246An issue was discovered in Gitea through 1.11.5.Go · code.gitea.io/gitea, github.com/go-gitea/gitea · fixed in 1.12.0