Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-43785gitoxide-core does not neutralize special characters for terminalscrates.io · gitoxide, gitoxide-core
- CVE-2024-8072Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary usersPyPI · mage-ai
- CVE-2024-6508Openshift-console: oauth2 insufficient state parameter entropyGo · github.com/openshift/console
- CVE-2024-22281Apache Helix Front (UI): Helix front hard-coded secret in the express-sessionMaven · org.apache.helix:helix
- CVE-2024-43403Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalationGo · github.com/kanisterio/kanister
- CVE-2024-41658GHSL-2024-036: Reflected XSS in QrCodePage.jsGo · github.com/casdoor/casdoor
- CVE-2024-41657GHSL-2024-035: Casdoor CORS misconfigurationGo · github.com/casdoor/casdoor
- CVE-2024-7646A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `exGo · github.com/kubernetes/ingress-nginx
- CVE-2024-42850An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.Maven · org.silverpeas.core:silverpeas-core
- CVE-2024-42480Kamaji's RBAC Roles for `etcd` are not disjunctGo · github.com/clastix/kamaji
- CVE-2024-7143Pulpcore: rbac permissions incorrectly assigned in tasks that create objectsPyPI · pulpcore
- CVE-2024-41380microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.Packagist · microweber/microweber
- CVE-2024-41381microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.Packagist · microweber/microweber
- CVE-2024-3056Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attackGo · github.com/containers/podman, github.com/containers/podman/v2 +3
- CVE-2024-7319Openstack-heat: incomplete fix for cve-2023-1625PyPI · openstack-heat
- CVE-2024-4353Stored XSS in Generate Board Name Input FieldPackagist · concrete5/concrete5
- CVE-2024-41259Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account informationGo · github.com/navidrome/navidrome
- CVE-2024-41264An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.Go · github.com/casdoor/casdoor
- CVE-2024-41265A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequeGo · github.com/cortexlabs/cortex, github.com/cortexproject/cortex
- CVE-2024-7300Bolt CMS Showcase Creation showcases cross site scriptingPackagist · bolt/bolt
- CVE-2024-6255Path Traversal in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-41255filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a manGo · github.com/mickael-kerjean/filestash
- CVE-2024-41256Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification Go · github.com/mickael-kerjean/filestash
- CVE-2024-38909Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.Packagist · studio-42/elfinder
- CVE-2024-6578Stored XSS in aimhubio/aimPyPI · aim
- CVE-2024-41637RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also possePackagist · billz/raspap-webgui
- CVE-2024-41373ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php.Packagist · icecoder/icecoder
- CVE-2024-41374ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.phpPackagist · icecoder/icecoder
- CVE-2024-41375ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.phpPackagist · icecoder/icecoder
- CVE-2024-7106Spina CMS media_folders cross-site request forgeryRubyGems · spina