Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Improper Input Validation in HashiCorp Consul BIT-consul-2020-13170, CVE-2020-13170, GHSA-p2j5-3f4c-224r, GO-2022-0859 | Medium | 1.8% | 18 May, 2021 | Go github.com/hashicorp/consul |
Information Disclosure in HashiCorp Vault BIT-vault-2020-13223, CVE-2020-13223, GHSA-25xj-89g5-fm6h, GO-2022-0778 | High | 1.3% | 18 May, 2021 | Go github.com/hashicorp/vault |
Improper Input Validation in HashiCorp Vault BIT-vault-2020-12757, CVE-2020-12757, GHSA-75pc-qvwc-jf3g, GO-2022-0804 | Critical | 1.6% | 18 May, 2021 | Go github.com/hashicorp/vault-plugin-secrets-gcp |
Improper Certificate Validation in HashiCorp Nomad CVE-2020-7956, GHSA-cj2h-ww36-v932, GO-2022-0821 | High | 1.0% | 18 May, 2021 | Go github.com/hashicorp/nomad |
Allocation of Resources Without Limits or Throttling in HashiCorp Nomad CVE-2020-7218, GHSA-h43v-26r7-7j4c, GO-2022-0840 | High | 1.5% | 18 May, 2021 | Go github.com/hashicorp/nomad |
Denial of Service (DoS) in HashiCorp Consul BIT-consul-2020-7219, CVE-2020-7219, GHSA-23jv-v6qj-3fhh, GO-2022-0776 | High | 2.0% | 18 May, 2021 | Go github.com/hashicorp/consul |
Use of a Broken or Risky Cryptographic Algorithm in Terraform CVE-2019-19316, GHSA-4rvg-555h-r626, GHSA-h3p9-wrgx-82cm, GO-2022-0839 | High | 0.9% | 18 May, 2021 | Go github.com/hashicorp/terraform |
Integer Overflow or Wraparound in NATS Server CVE-2019-13126, GHSA-jp4j-47f9-2vc3, GO-2022-0852 | High | 1.8% | 18 May, 2021 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Insecure Permissions in Gogs CVE-2019-14544, GHSA-5r2v-6gm6-vpvh, GO-2022-0797 | Critical | 1.5% | 18 May, 2021 | Go gogs.io/gogs |
Rancher Vulnerable to Cross-site Request Forgery (CSRF) CVE-2019-13209, GHSA-xhg2-rvm8-w2jh, GO-2022-0755 | High | 1.1% | 18 May, 2021 | Go github.com/rancher/rancher |
Improper Authentication in Apache Traffic Control CVE-2019-12405, GHSA-3f8r-4qwm-r7jf | Critical | 3.5% | 18 May, 2021 | Go github.com/apache/trafficcontrol |
Duplicate Advisory: k8s.io/kube-state-metrics Exposure of Sensitive Information CVE-2019-10223, CVE-2019-17110, GHSA-2v6x-frw8-7r7f, GHSA-c92w-72c5-9x59, GO-2022-0621 | Medium | 1.8% | 18 May, 2021 | Go github.com/kubernetes/kube-state-metrics Go k8s.io/kube-state-metrics |
XML Entity Expansion and Improper Input Validation in Kubernetes API server CVE-2019-11253, GHSA-pmqp-h87c-mr78, GO-2022-0703 | High | 25.9% | 18 May, 2021 | Go k8s.io/kubernetes |
Out-of-bounds read in Apache Thrift CVE-2019-0210, GHSA-jq7p-26h5-w78r, GO-2021-0101 | High | 6.5% | 18 May, 2021 | Go github.com/apache/thrift |
Path Traversal in MHolt Archiver CVE-2019-10743, GHSA-h74j-692g-48mq | Medium | 6.4% | 18 May, 2021 | Go github.com/mholt/archiver |
Cloud Foundry Routing Improper Input Validation vulnerability CVE-2019-11289, GHSA-5796-p3m6-9qj4, GO-2021-0102 | High | 1.5% | 18 May, 2021 | Go code.cloudfoundry.org/gorouter Go github.com/cloudfoundry/gorouter |
Improper Access Control in Lightning Network Daemon CVE-2019-12999, GHSA-78hj-86cr-6j2v, GO-2022-0807 | High | 2.2% | 18 May, 2021 | Go github.com/lightningnetwork/lnd |
Kubernetes kubectl cp Vulnerable to Symlink Attack CVE-2019-11251, GHSA-6qfg-8799-r575, GO-2022-0802 | Medium | 2.6% | 18 May, 2021 | Go k8s.io/kubernetes |
Improper Locking in github.com/containers/storage CVE-2021-20291, GHSA-7qw8-847f-pggm, GO-2021-0100 | Medium | 1.6% | 10 May, 2021 | Go github.com/containers/storage |
socks Infinite Loop vulnerability CVE-2013-10005, GHSA-gxgj-xjcw-fv9p, GO-2020-0024 | High | 0.8% | 14 Apr, 2021 | Go github.com/btcsuite/go-socks Go github.com/btcsuitereleases/go-socks |
LZ4 vulnerable to Out-of-bounds Write CVE-2014-125026, GHSA-4wp2-8rm2-jgmh, GO-2020-0022 | Critical | 1.2% | 14 Apr, 2021 | Go github.com/cloudflare/golz4 |
robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison CVE-2015-10004, GHSA-5vw4-v588-pgv8, GO-2020-0023 | High | 0.8% | 14 Apr, 2021 | Go github.com/robbert229/jwt |
Golf may allow attacker to bypass CSRF protections due to weak PRNG CVE-2016-15005, GHSA-q9qr-jwpw-3qvv, GO-2020-0045 | High | 0.4% | 14 Apr, 2021 | Go github.com/dinever/golf |
gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy CVE-2017-20146, GHSA-jcr6-mmjj-pchw, GO-2020-0020 | Critical | 0.8% | 14 Apr, 2021 | Go github.com/gorilla/handlers |
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication CVE-2018-21246, GHSA-gr7w-x2jp-3xgw, GO-2020-0043 | Critical | 2.7% | 14 Apr, 2021 | Go github.com/caddyserver/caddy Go github.com/mholt/caddy |
Cloud Foundry Archiver vulnerable to path traversal CVE-2018-25046, GHSA-32qh-8vg6-9g43, GO-2020-0025 | Critical | 1.3% | 14 Apr, 2021 | Go code.cloudfoundry.org/archiver Go github.com/cloudfoundry/archiver |
Privilege Escalation in fscrypt CVE-2018-6558, GHSA-qj26-7grj-whg3, GO-2020-0027 | Medium | 0.6% | 14 Apr, 2021 | Go github.com/google/fscrypt |
containers/image library Insufficiently Protects Credentials CVE-2019-10214, GHSA-85p9-j7c9-v4gr, GO-2021-0081 | Medium | 1.6% | 14 Apr, 2021 | Go github.com/containers/image |
Kubernetes client-go library logs may disclose credentials to unauthorized users CVE-2019-11250, GHSA-jmrx-5g74-6v2f, GO-2021-0065 | Medium | 1.8% | 14 Apr, 2021 | Go k8s.io/client-go Go k8s.io/kubernetes |
Excessive Platform Resource Consumption within a Loop in Kubernetes CVE-2019-11254, GHSA-wxc4-f4m6-wwqv, GO-2020-0036 | Medium | 3.2% | 14 Apr, 2021 | Go github.com/go-yaml/yaml Go gopkg.in/yaml.v2 |
Golang Facebook Thrift servers vulnerable to denial of service CVE-2019-11939, GHSA-w3r9-r9w7-8h48, GO-2021-0082 | High | 1.6% | 14 Apr, 2021 | Go github.com/facebook/fbthrift |
Hybrid Group Gobot Improper Certificate Validation vulnerability CVE-2019-12496, GHSA-vfxc-r2gx-v2vq, GO-2021-0083 | High | 0.7% | 14 Apr, 2021 | Go github.com/hybridgroup/gobot |
Beego has a file creation race condition CVE-2019-16354, CVE-2019-16355, GHSA-f6px-w8rh-7r89, GHSA-hf4p-4j9r-3cvx, GO-2021-0084 | Medium | 0.4% | 14 Apr, 2021 | Go github.com/astaxie/beego Go github.com/beego/beego |
Incorrect Authorization in runc CVE-2019-16884, GHSA-fgv8-vj5c-2ppq, GO-2021-0085 | High | 4.4% | 14 Apr, 2021 | Go github.com/opencontainers/runc Go github.com/opencontainers/selinux |
Cross-site Scripting in Documize CVE-2019-19619, GHSA-wmwp-pggc-h4mj, GO-2021-0086 | Medium | 1.2% | 14 Apr, 2021 | Go github.com/documize/community |
miekg/dns insecurely generates random numbers CVE-2019-19794, GHSA-44r7-7p62-q3fr, GO-2020-0008 | Medium | 2.1% | 14 Apr, 2021 | Go github.com/miekg/dns |
opencontainers runc contains procfs race condition with a shared volume mount CVE-2019-19921, GHSA-fh74-hm69-rqjw, GO-2021-0087 | Medium | 0.4% | 14 Apr, 2021 | Go github.com/opencontainers/runc |
Improper Authenication in Pion DTLS CVE-2019-20786, GHSA-7gfg-6934-mqq2, GO-2020-0038 | Critical | 3.0% | 14 Apr, 2021 | Go github.com/pion/dtls |
Tendermint Client package vulnerable to Uncontrolled Resource Consumption CVE-2019-25072, GHSA-3fm3-m23v-5r46, GO-2020-0037 | High | 1.2% | 14 Apr, 2021 | Go github.com/tendermint/tendermint |
Goa vulnerable to path traversal CVE-2019-25073, GHSA-fjgq-224f-fq37, GO-2020-0032 | High | 1.5% | 14 Apr, 2021 | Go github.com/goadesign/goa Go goa.design/goa Go goa.design/goa/v3 |
Improper Input Validation and Excessive Iteration in Go Facebook Thrift CVE-2019-3564, GHSA-x4rg-4545-4w7w, GO-2021-0088 | High | 2.0% | 14 Apr, 2021 | Go github.com/facebook/fbthrift |
Infinite Loop in jsonparser CVE-2020-10675, GHSA-rmh2-65xw-9m6q, GO-2021-0089 | High | 2.6% | 14 Apr, 2021 | Go github.com/buger/jsonparser |
gopkg.in/macaron.v1 Open Redirect vulnerability CVE-2020-12666, GHSA-733f-44f3-3frw, GO-2020-0039 | Medium | 1.4% | 14 Apr, 2021 | Go gopkg.in/macaron.v1 |
golang.org/x/text Infinite loop CVE-2020-14040, GHSA-5rcv-m4m3-hfh7, GO-2020-0015 | Medium | 1.9% | 14 Apr, 2021 | Go golang.org/x/text |
Denial of Service in TenderMint CVE-2020-15091, GHSA-6jqj-f58p-mrw3, GO-2021-0090 | Medium | 0.9% | 14 Apr, 2021 | Go github.com/tendermint/tendermint |
etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic BIT-etcd-2020-15106, BIT-etcd-2020-15112, CVE-2020-15106, CVE-2020-15112, GHSA-m332-53r6-2w93, GHSA-p4g4-wgrh-qrg2, GO-2020-0005 | Medium | 1.3% | 14 Apr, 2021 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
github.com/russellhaering/goxmldsig vulnerable to Signature Validation Bypass CVE-2020-15216, GHSA-q547-gmf8-8jr7, GO-2020-0050 | Medium | 0.9% | 14 Apr, 2021 | Go github.com/russellhaering/goxmldsig |
xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service CVE-2020-25614, GHSA-93m7-c69f-5cfj, GO-2020-0048 | High | 1.9% | 14 Apr, 2021 | Go github.com/antchfx/xmlquery |
Authorization bypass in github.com/dgrijalva/jwt-go CVE-2020-26160, GHSA-w73w-5m7g-f7qc, GO-2020-0017, SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515 | High | 2.2% | 14 Apr, 2021 | Go github.com/dgrijalva/jwt-go Go github.com/dgrijalva/jwt-go/v4 |
Denial of service in github.com/ethereum/go-ethereum CVE-2020-26264, GHSA-r33q-22hv-j29q, GO-2021-0063 | Medium | 1.9% | 14 Apr, 2021 | Go github.com/ethereum/go-ethereum |