Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-3346Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolverGo · github.com/peterzen/goresolver
- CVE-2020-36563Weak hash (SHA-1) in github.com/RobotsAndPencils/go-samlGo · github.com/robotsandpencils/go-saml
- CVE-2020-36562Uncontrolled Resource Consumption in github.com/shiyanhui/dhtGo · github.com/shiyanhui/dht
- CVE-2019-25088ytti Oxidized Web conf_search.haml cross site scriptingRubyGems · oxidized-web
- CVE-2018-25049email-existence index.js redosnpm · email-existence
- CVE-2022-44381Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.Packagist · snipe/snipe-it
- CVE-2022-4728Graphite Web Cookie cross site scriptingPyPI · graphite-web
- CVE-2022-4729Graphite Web Template Name cross site scriptingPyPI · graphite-web
- CVE-2022-4730Graphite Web Absolute Time Range cross site scriptingPyPI · graphite-web
- CVE-2020-26302is.js is a general-purpose check library.npm · is_js
- CVE-2020-36625destiny.gg chat main.go websocket.Upgrader cross-site request forgeryGo · github.com/destinygg/chat
- CVE-2022-4647Cross-site Scripting (XSS) - Stored in microweber/microweberPackagist · microweber/microweber
- CVE-2022-24431Command Injectionnpm · abacus-ext-cmdline
- CVE-2022-25895Directory Traversalnpm · lite-dev-server
- CVE-2022-25904Prototype Pollutionnpm · safe-eval
- CVE-2022-25931Directory Traversalnpm · easy-static-server
- CVE-2022-25940Denial of Service (DoS)npm · lite-server
- CVE-2021-4263leanote history.js define cross site scriptingGo · github.com/leanote/leanote
- CVE-2021-4272studygolang topics.js cross site scriptingGo · github.com/studygolang/studygolang
- CVE-2022-4617Cross-site Scripting (XSS) - Reflected in microweber/microweberPackagist · microweber/microweber
- CVE-2022-4640Mingsoft MCMS Article save cross site scriptingMaven · net.mingsoft:ms-mcms
- CVE-2021-4262laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injectionPackagist · mgallegos/laravel-jqgrid
- CVE-2022-4609Cross-site Scripting (XSS) - Stored in usememos/memosGo · github.com/usememos/memos
- CVE-2020-20589Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tPackagist · feehi/feehicms
- CVE-2020-36607Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tPackagist · feehi/feehicms
- CVE-2021-36572Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the loginPackagist · feehi/feehicms
- CVE-2021-36573File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.Packagist · feehi/feehicms
- CVE-2022-40000Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the adminPackagist · feehi/feehicms
- CVE-2022-40001Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create aPackagist · feehi/feehicms
- CVE-2022-40002Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/Packagist · feehi/feehicms