Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-11053Open Redirect in OAuth2 ProxyGo · github.com/oauth2-proxy/oauth2-proxy · fixed in 5.1.1
- CVE-2020-12666macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.Go · gopkg.in/macaron.v1 · fixed in 1.3.7
- CVE-2020-12283Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontGo · github.com/sourcegraph/sourcegraph · fixed in 3.14.4, 3.15.1
- CVE-2020-12458An information-disclosure flaw was found in Grafana through 6.7.3.Go · github.com/grafana/grafana · fixed in 7.2.1
- CVE-2020-12459In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (whicGo · github.com/grafana/grafana · fixed in 7.2.1
- CVE-2020-1762An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a reGo · github.com/kiali/kiali · fixed in 1.15.1
- CVE-2020-12245Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.Go · github.com/grafana/grafana · fixed in 6.7.3
- CVE-2020-11013lookup Function Information Discolosure in HelmGo · helm.sh/helm/v3 · fixed in 3.1.3
- CVE-2020-12118The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to comGo · github.com/binance-chain/tss-lib · fixed in 1.2.0
- CVE-2019-20786handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to Go · github.com/pion/dtls · fixed in 1.5.2
- CVE-2020-5303Denial of service in TendermintGo · github.com/tendermint/tendermint · fixed in 0.33.3, 0.31.12, 0.32.10
- CVE-2018-21034In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifesGo · github.com/argoproj/argo-cd · fixed in 1.5.0-rc1
- CVE-2020-8828As of v1.5.0, the default admin password is set to the argocd-server pod name.Go · github.com/argoproj/argo-cd
- CVE-2020-8827As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce meaGo · github.com/argoproj/argo-cd · fixed in 1.5.1
- CVE-2020-11576Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames oGo · github.com/argoproj/argo-cd · fixed in 1.5.1
- CVE-2020-5300Disallow replay of `private_key_jwt` by blacklisting JTIs in HydraGo · github.com/ory/hydra · fixed in 1.4.0
- CVE-2019-11254Kubernetes API Server denial of service vulnerability from malicious YAML payloadsGo · github.com/go-yaml/yaml, gopkg.in/yaml.v2 · fixed in 2.2.8
- CVE-2020-10696A path traversal flaw was found in Buildah in versions before 1.14.5.Go · github.com/containers/buildah · fixed in 1.14.4
- CVE-2020-8552Kubernetes API server denial of serviceGo · k8s.io/apiserver · fixed in 0.15.10, 0.16.7, 0.17.3
- CVE-2020-8551Kubernetes kubelet denial of serviceGo · k8s.io/kubernetes · fixed in 1.15.10, 1.16.6, 1.17.2
- CVE-2020-1764A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1.Go · github.com/kiali/kiali · fixed in 1.15.1
- CVE-2020-10661HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies granGo · github.com/hashicorp/vault · fixed in 1.3.4
- CVE-2020-10660HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadveGo · github.com/hashicorp/vault · fixed in 1.3.4
- CVE-2019-19023Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container ReGo · github.com/goharbor/harbor · fixed in 1.8.6, 1.9.3
- CVE-2019-19029Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container RegistGo · github.com/goharbor/harbor · fixed in 1.8.6, 1.9.3
- CVE-2019-19026Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container RegGo · github.com/goharbor/harbor · fixed in 1.8.6, 1.9.3
- CVE-2019-19025Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal PlatfoGo · github.com/goharbor/harbor · fixed in 1.8.6, 1.9.3
- CVE-2020-10675The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.Go · github.com/buger/jsonparser · fixed in 1.0.0
- CVE-2019-11939Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload.Go · github.com/facebook/fbthrift · fixed in 0.31.1-0.20200311080807-483ed864d69f
- CVE-2020-7919Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attackGo · github.com/helm/helm, golang.org/x/crypto +2 · fixed in 2.16.8, 0.0.0-20200124225646-8b5121be2f68, 3.1.0 and more