Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-1010314Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS).Go · code.gitea.io/gitea · fixed in 1.7.4
- CVE-2019-13068public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).Go · github.com/grafana/grafana · fixed in 6.2.5
- CVE-2019-9039In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements Go · github.com/couchbase/sync_gateway · fixed in 2.5.0
- CVE-2018-15747The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supportsGo · github.com/prasmussen/glot-code-runner
- CVE-2019-11881A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary conGo · github.com/rancher/rancher
- CVE-2019-12291HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control.Go · github.com/hashicorp/consul · fixed in 1.5.1
- CVE-2019-12274In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane becaGo · github.com/rancher/rancher · fixed in 1.6.27, 2.2.4+incompatible, 2.2.4
- CVE-2019-12303In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside thGo · github.com/rancher/rancher · fixed in 2.2.4, 2.2.4+incompatible
- CVE-2019-12243Istio 1.1.x through 1.1.6 has Incorrect Access Control.Go · istio.io/istio · fixed in 1.1.7
- CVE-2019-12496An issue was discovered in Hybrid Group Gobot before 1.13.0.Go · github.com/hybridgroup/gobot · fixed in 1.12.1-0.20190521122906-c1aa4f867846
- CVE-2019-12452types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed withoutGo · github.com/traefik/traefik · fixed in 1.7.12
- CVE-2019-11841A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25.Go · golang.org/x/crypto · fixed in 0.0.0-20190424203555-c05e17bb3b2d
- CVE-2019-11328An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g.Go · github.com/sylabs/singularity · fixed in 3.2.0
- CVE-2019-11840An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576.Go · golang.org/x/crypto · fixed in 0.0.0-20190320223903-b7391e95e576
- CVE-2019-3564Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type.Go · github.com/facebook/fbthrift · fixed in 0.31.1-0.20190225164308-c461c1bd1a3e
- CVE-2019-11576Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment.Go · code.gitea.io/gitea · fixed in 1.8.0
- CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL paths.Go · github.com/envoyproxy/envoy · fixed in 1.9.1
- CVE-2017-18367libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them.Go · github.com/seccomp/libseccomp-golang · fixed in 0.9.1, 0.9.1-0.20170424173420-06e7a29f36a3
- CVE-2015-1340chmod race in doUidshiftIntoContainerGo · github.com/lxc/lxd · fixed in 0.0.0-20151004155856-19c6961cc101
- CVE-2019-11243In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials rGo · k8s.io/kubernetes · fixed in 1.12.5, 1.13.1
- CVE-2019-11244kubectl creates world-writeable cached schema filesGo · k8s.io/client-go · fixed in 1.12.9
- CVE-2019-11229models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.Go · github.com/go-gitea/gitea · fixed in 1.7.6
- CVE-2019-11228repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.Go · github.com/go-gitea/gitea · fixed in 1.7.6
- CVE-2019-6287In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after theyGo · github.com/rancher/rancher · fixed in 2.1.6, 2.1.6+incompatible
- CVE-2018-20321An issue was discovered in Rancher 2 through 2.1.5.Go · github.com/rancher/rancher · fixed in 2.1.6, 2.1.6+incompatible
- CVE-2019-3792Concourse 5.0.0 SQL Injection vulnerabilityGo · github.com/concourse/concourse · fixed in 5.0.1
- CVE-2019-1002101kubectl cp path traversalGo · k8s.io/kubernetes · fixed in 1.11.9, 1.12.7, 1.13.5
- CVE-2019-1002100In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API SeGo · k8s.io/kubernetes · fixed in 1.11.8, 1.12.6, 1.13.4
- CVE-2019-9764HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication.Go · github.com/hashicorp/consul · fixed in 1.4.4
- CVE-2019-9634Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.Go · stdlib · fixed in 1.11.10, 1.12.2