Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-52529Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in CiliumGo · github.com/cilium/cilium · fixed in 1.16.4
- CVE-2024-6538Openshift-console: openshift console: server-side request forgeryGo · github.com/openshift/console
- CVE-2024-10220Arbitrary command execution through gitRepo volumeGo · k8s.io/kubernetes · fixed in 1.28.12, 1.29.7, 1.30.3
- CVE-2024-45719Apache Answer: Predictable Authorization Token Using UUIDv1Go · github.com/apache/incubator-answer · fixed in 1.4.1
- CVE-2024-52309SFTPGo allows administrators to restrict command execution from the EventManagerGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 +1 · fixed in 2.6.3
- CVE-2024-28892An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3.Go · github.com/mayuresh82/gocast
- CVE-2024-9526Stored XSS in Kubeflow Pipeline ViewGo · github.com/kubeflow/pipelines
- CVE-2024-0793Kube-controller-manager: malformed hpa v1 manifest causes crashGo · k8s.io/kubernetes · fixed in 1.27.0-alpha.1
- CVE-2024-52522Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataGo · github.com/rclone/rclone · fixed in 1.68.2
- CVE-2023-0109Stored XSS in usememos/memosGo · github.com/usememos/memos · fixed in 0.10.0
- CVE-2022-1884Remote Command Execution in gogs/gogsGo · gogs.io/gogs · fixed in 0.12.8
- CVE-2024-24425Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amGo · github.com/magma/magma
- CVE-2024-24426Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackeGo · github.com/magma/magma
- CVE-2024-44625Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.Go · gogs.io/gogs · fixed in 0.13.2
- CVE-2024-52308Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computerGo · github.com/cli/cli, github.com/cli/cli/v2 · fixed in 2.62.0
- CVE-2022-31668User permission validation failure and disclosure of P2P preheat execution logsGo · github.com/goharbor/harbor, github.com/goharbor/harbor/src · fixed in 2.4.3, 2.5.2, 2.4.3+incompatible and more
- CVE-2022-31667Harbor fails to validate the user permissions when updating a robot accountGo · github.com/goharbor/harbor · fixed in 1.10.13, 2.4.3, 2.5.2
- CVE-2022-31669Harbor fails to validate the user permissions when updating tag immutability policiesGo · github.com/goharbor/harbor · fixed in 1.10.13, 2.4.3, 2.5.2
- CVE-2022-31670Harbor fails to validate the user permissions when updating tag retention policiesGo · github.com/goharbor/harbor · fixed in 1.10.13, 2.4.3, 2.5.2
- CVE-2022-31671Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logsGo · github.com/goharbor/harbor · fixed in 1.10.13, 2.4.3, 2.5.2
- CVE-2022-31666Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policiesGo · github.com/goharbor/harbor · fixed in 1.10.13, 2.4.3, 2.5.2
- CVE-2022-45157Exposure of vSphere's CPI and CSI credentials in RancherGo · github.com/rancher/rancher · fixed in 2.9.3, 2.8.9
- CVE-2024-52010Zoraxy has an authenticated command injection in the Web SSH featureGo · github.com/tobychui/zoraxy · fixed in 3.1.3, 3.1.3+incompatible
- CVE-2024-52009Git credentials are exposed in atlantis logsGo · github.com/runatlantis/atlantis · fixed in 0.30.0
- CVE-2024-10975Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write PermissionGo · github.com/hashicorp/nomad · fixed in 1.9.2
- CVE-2024-45794SQL Injection in CreateUser API in devtronGo · github.com/devtron-labs/devtron · fixed in 0.7.2
- CVE-2024-51746Use of incorrect Rekor entries during verification in gitsignGo · github.com/sigstore/gitsign · fixed in 0.11.0
- CVE-2024-51735Stored Cross-site Scripting to RCE on Osmedeus Web ServerGo · github.com/j3ssie/osmedeus
- CVE-2024-51744Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwtGo · github.com/golang-jwt/jwt/v4 · fixed in 4.5.1
- CVE-2024-10389Path Traversal in SafearchiveGo · github.com/google/safearchive · fixed in 0.0.0-20241025131057-f7ce9d7b6f9c