Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-17419An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go.Go · github.com/miekg/dns · fixed in 1.0.10
- CVE-2019-8336HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privilegesGo · github.com/hashicorp/consul · fixed in 1.4.3
- CVE-2019-8400ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.Go · github.com/ory/hydra · fixed in 1.4.8
- CVE-2019-1000002Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the Go · code.gitea.io/gitea · fixed in 1.6.3
- CVE-2019-1000008All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('PathGo · helm.sh/helm · fixed in 2.12.2, 2.12.2+incompatible
- CVE-2018-20744The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value,Go · github.com/gofiber/fiber/v2, github.com/rs/cors · fixed in 2.43.0, 1.5.0
- CVE-2019-6486Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CGo · stdlib · fixed in 1.10.8, 1.11.5
- CVE-2018-16886etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control Go · go.etcd.io/etcd, go.etcd.io/etcd/v3 · fixed in 0.5.0-alpha.5.0.20190108173120-83c051b701d3, 3.2.26, 3.3.11
- CVE-2018-1000816Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor thatGo · github.com/grafana/grafana · fixed in 5.3.2
- CVE-2018-20303In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a fiGo · gogs.io/gogs · fixed in 0.11.80-0.20181218063808-ff93d9dbda5c
- CVE-2018-15798Pivotal Concourse allows malicious redirect urls on loginGo · github.com/concourse/concourse · fixed in 5.2.8, 5.5.10, 5.8.1
- CVE-2018-19295Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.Go · github.com/sylabs/singularity · fixed in 2.6.1
- CVE-2018-16873In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag andGo · toolchain · fixed in 1.10.6, 1.11.3
- CVE-2018-16874In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path oGo · toolchain · fixed in 1.10.6, 1.11.3
- CVE-2018-16875The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verificationGo · stdlib · fixed in 1.10.6, 1.11.3
- CVE-2018-19653HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly doGo · github.com/hashicorp/consul · fixed in 1.4.1
- CVE-2018-1002101In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on WiGo · k8s.io/kubernetes · fixed in 1.9.10, 1.10.6, 1.11.2
- CVE-2018-1002103In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000.Go · k8s.io/minikube
- CVE-2018-1002105In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in theGo · github.com/kubernetes/kubernetes · fixed in 1.10.11, 1.11.5, 1.12.3
- CVE-2018-19184cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode.Go · github.com/ethereum/go-ethereum · fixed in 1.8.14
- CVE-2018-19148Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames.Go · github.com/caddyserver/caddy · fixed in 0.11.1
- CVE-2018-18926Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs.Go · code.gitea.io/gitea · fixed in 1.5.2
- CVE-2018-18206In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.Go · github.com/bytom/bytom · fixed in 1.0.6, 1.0.4-0.20180831054840-1ac3c8ac4f2b
- CVE-2018-1000803Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses.Go · github.com/go-gitea/gitea · fixed in 1.5.1
- CVE-2018-17846The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loopGo · golang.org/x/net · fixed in 0.0.0-20190125091013-d26f9f9a57f3
- CVE-2018-17847The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtimeGo · golang.org/x/net · fixed in 0.0.0-20190125002852-4b62a64f59f7
- CVE-2018-17848The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime errorGo · golang.org/x/net · fixed in 0.0.0-20190125002852-4b62a64f59f7
- CVE-2018-17142The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" inGo · golang.org/x/net · fixed in 0.0.0-20180925071336-cf3bd585ca2a
- CVE-2018-17143The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime erroGo · golang.org/x/net · fixed in 0.0.0-20180921000356-2f5d2388922f
- CVE-2018-17075The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for hGo · golang.org/x/net · fixed in 0.0.0-20180816102801-aaf60122140d