Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-54083DoS via lack of type validation in CallsGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.13+incompatible, 9.11.5+incompatible, 10.0.3+incompatible and more
- CVE-2024-48872Bypass of "Max failed attempts" restriction via race conditionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.5.13+incompatible, 9.11.5+incompatible, 10.0.3+incompatible and more
- CVE-2024-12289Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of ServiceGo · github.com/hashicorp/boundary · fixed in 0.18.2
- CVE-2024-55885Beego Vulnerable to Collision Hazards of MD5 in Cache Key FilenamesGo · github.com/beego/beego, github.com/beego/beego/v2 · fixed in 2.3.4
- CVE-2024-12401Cert-manager: potential dos when parsing specially crafted pem inputsGo · github.com/cert-manager/cert-manager · fixed in 1.12.14, 1.15.4, 1.16.2
- CVE-2024-55660SiYuan has an SSTI via /api/template/renderSprigGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55659SiYuan has an arbitrary file write in the host via /api/asset/uploadGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55658SiYuan has an arbitrary file read and path traversal via /api/export/exportResourcesGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55657SiYuan has an arbitrary file read via /api/template/renderGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-45337Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptoGo · golang.org/x/crypto · fixed in 0.31.0
- CVE-2024-55601Hugo does not escape some attributes in internal templatesGo · github.com/gohugoio/hugo · fixed in 0.139.4
- CVE-2024-46455unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.Go · github.com/unstructured-io/unstructured
- CVE-2024-6219Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restGo · github.com/canonical/lxd · fixed in 0.0.0-20240403103450-0e7f2b5bf4d2
- CVE-2024-6156Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust storGo · github.com/canonical/lxd · fixed in 0.0.0-20240708073652-5a492a3f0036
- CVE-2024-54132GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerabilityGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.63.1
- CVE-2024-54131Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)Go · github.com/kolide/launcher · fixed in 1.12.3
- CVE-2024-53257Vitess allows HTML injection in /debug/querylogz & /debug/envGo · vitess.io/vitess · fixed in 0.21.1, 0.20.4, 0.19.8
- CVE-2024-50948mochiMQTT v2.6.3 is vulnerable to Denial of Service (DoS) due to improper resource management.Go · github.com/mochi-mqtt/server
- CVE-2024-53259quic-go affected by an ICMP Packet Too Large Injection Attack on LinuxGo · github.com/quic-go/quic-go · fixed in 0.48.2
- CVE-2024-53862Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` modeGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +1 · fixed in 3.5.13, 3.6.2
- CVE-2024-52801Brute force takeover of OpenID Connect session cookies in sftpgoGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.6.4
- CVE-2024-52003X-Forwarded-Prefix Header still allows for Open Redirect in traefikGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.14, 3.2.1
- CVE-2024-36620moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.Go · github.com/moby/moby · fixed in 26.1.0, 26.1.0+incompatible
- CVE-2024-36621moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go.Go · github.com/moby/moby · fixed in 26.0.0, 26.0.0+incompatible
- CVE-2024-36623moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent writGo · github.com/moby/moby · fixed in 26.0.0+incompatible, 25.0.4
- CVE-2024-53858Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cliGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.63.0
- CVE-2024-53859go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespaceGo · github.com/cli/go-gh, github.com/cli/go-gh/v2 · fixed in 2.11.1
- CVE-2024-53264Open Redirect Vulnerability in Loading Page in bunkerwebGo · github.com/bunkerity/bunkerweb · fixed in 1.5.11
- CVE-2024-43784Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletionGo · github.com/treeverse/lakefs · fixed in 1.33.0
- CVE-2024-8676Cri-o: checkpoint restore can be triggered from different namespacesGo · github.com/cri-o/cri-o · fixed in 1.29.11, 1.30.8, 1.31.3