Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Integer overflow in github.com/gorilla/websocket CVE-2020-27813, GHSA-3xh2-74w9-5vxm, GHSA-jf24-p9p9-4rjh, GO-2020-0019 | High | 2.2% | 14 Apr, 2021 | Go github.com/gorilla/websocket |
XML Processing error in github.com/crewjam/saml BIT-grafana-2020-27846, CVE-2020-27846, GHSA-4hq8-gmxx-h6w9, GO-2021-0058 | Critical | 4.9% | 14 Apr, 2021 | Go github.com/crewjam/saml |
Panic during division of very large numbers in math/big BIT-golang-2020-28362, CVE-2020-28362, GO-2021-0069 | 3.9% | 14 Apr, 2021 | Go stdlib | |
Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin CVE-2020-28483, GHSA-h395-qcrw-5vmq, GO-2021-0052, SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736 | High | 1.3% | 14 Apr, 2021 | Go github.com/gin-gonic/gin |
dhowden tag panic due to out-of-bounds read CVE-2020-29242, CVE-2020-29243, CVE-2020-29244, CVE-2020-29245, GHSA-27mh-3343-6hg5, GHSA-9wm7-rc47-g56m, GHSA-9xm8-8qvc-vw3p, GHSA-wg79-2cgp-qrjm, GO-2021-0097 | Medium | 1.1% | 14 Apr, 2021 | Go github.com/dhowden/tag |
Authentication Bypass in github.com/russellhaering/gosaml2 BIT-golang-2020-29509, CVE-2020-29509, GHSA-xhqq-x44f-9fgg, GO-2021-0060 | Critical | 2.1% | 14 Apr, 2021 | Go github.com/russellhaering/gosaml2 |
Unsafe tar unpacking in HashiCorp go-slug CVE-2020-29529, GHSA-2g5j-5x95-r6hr, GO-2021-0094 | High | 2.8% | 14 Apr, 2021 | Go github.com/hashicorp/go-slug |
Denial of service in GJSON CVE-2020-35380, GHSA-w942-gw6m-p62c, GO-2021-0059 | High | 1.5% | 14 Apr, 2021 | Go github.com/tidwall/gjson |
Denial of Service in jsonparser CVE-2020-35381, GHSA-8vrw-m3j9-j27c, GO-2021-0057 | High | 2.3% | 14 Apr, 2021 | Go github.com/buger/jsonparser |
Improper Validation of Array Index in GJSON CVE-2020-36067, GHSA-p64j-r5f4-pwwx, GO-2021-0054 | High | 1.4% | 14 Apr, 2021 | Go github.com/tidwall/gjson |
ahh vulnerable to Path Traversal CVE-2020-36559, GHSA-vp56-r7qv-783v, GO-2020-0033 | High | 1.2% | 14 Apr, 2021 | Go aahframe.work Go github.com/go-aah/aah |
go-unzip vulnerable to Path Traversal CVE-2020-36560, GHSA-rmj9-q58g-9qgg, GO-2020-0034 | Critical | 1.3% | 14 Apr, 2021 | Go github.com/artdarek/go-unzip |
Unzip vulnerable to path traversal CVE-2020-36561, GHSA-f5c5-hmw9-v8hx, GO-2020-0035 | Critical | 1.4% | 14 Apr, 2021 | Go github.com/yi-ge/unzip |
shiyanhui/dht vulnerable to Uncontrolled Resource Consumption CVE-2020-36562, GHSA-p6fg-723f-hgpw, GO-2020-0040 | High | 0.8% | 14 Apr, 2021 | Go github.com/shiyanhui/dht |
go-saml's XML Digital Signatures use SHA-1 CVE-2020-36563, GHSA-5rhg-xhgr-5hfj, GO-2020-0047 | Medium | 0.3% | 14 Apr, 2021 | Go github.com/RobotsAndPencils/go-saml |
nosurf vulnerable to improper input validation CVE-2020-36564, GHSA-5x84-q523-vvwr, GO-2020-0049 | High | 0.8% | 14 Apr, 2021 | Go github.com/justinas/nosurf |
Echo vulnerable to directory traversal CVE-2020-36565, GHSA-j453-hm5x-c46w, GO-2021-0051 | Medium | 1.4% | 14 Apr, 2021 | Go github.com/labstack/echo/v4 |
Gin's default logger allows unsanitized input that can allow remote attackers to inject arbitrary log lines CVE-2020-36567, GHSA-6vm3-jj99-7229, GO-2020-0001 | High | 1.5% | 14 Apr, 2021 | Go github.com/gin-gonic/gin |
revel is vulnerable to resource exhaustion CVE-2020-36568, GHSA-hggr-p7v6-73p5, GO-2020-0003 | Medium | 1.6% | 14 Apr, 2021 | Go github.com/revel/revel |
golang-nanoauth authentication bypass vulnerability CVE-2020-36569, GHSA-hrm3-3xm6-x33h, GO-2020-0004 | Critical | 0.9% | 14 Apr, 2021 | Go github.com/nanobox-io/golang-nanoauth |
github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2020-7667, GHSA-9423-6c93-gpp8, GO-2020-0042, SNYK-GOLANG-GITHUBCOMSASSOFTWAREGORPMUTILSCPIO-570427 | High | 1.6% | 14 Apr, 2021 | Go github.com/sassoftware/go-rpmutils |
github.com/unknwon/cae Path Traversal vulnerability CVE-2020-7668, GHSA-88jf-7rch-32qc, GO-2020-0041 | High | 1.4% | 14 Apr, 2021 | Go github.com/unknwon/cae |
Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures CVE-2020-7711, CVE-2020-7731, GHSA-gq5r-cc4w-g8xf, GHSA-mqqv-chpx-vq25, GHSA-prjq-f4q3-fvfr, GO-2020-0046, SNYK-GOLANG-GITHUBCOMRUSSELLHAERINGGOSAML2-608302 | High | 1.8% | 14 Apr, 2021 | Go github.com/russellhaering/gosaml2 Go github.com/russellhaering/goxmldsig |
Kubernetes Sensitive Information leak via Log File CVE-2020-8564, GHSA-8mjg-8c8g-6h85, GO-2021-0066 | Medium | 0.5% | 14 Apr, 2021 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Kubernetes client-go vulnerable to Sensitive Information Leak via Log File CVE-2020-8565, GHSA-8cfg-vx93-jvxw, GO-2021-0064 | Medium | 0.5% | 14 Apr, 2021 | Go k8s.io/client-go Go k8s.io/kubernetes |
TPM 1.2 key authorization values vulnerable to TPM transport eavesdropper in go-tpm CVE-2020-8918, GHSA-5x29-3hr9-6wpw, GO-2021-0095 | High | 0.2% | 14 Apr, 2021 | Go github.com/google/go-tpm |
GPGME Go wrapper contains Use After Free CVE-2020-8945, GHSA-m6wg-2mwg-4rfq, GO-2021-0096 | High | 5.1% | 14 Apr, 2021 | Go github.com/proglottis/gpgme |
Improper Verification of Cryptographic Signature in golang.org/x/crypto CVE-2020-9283, GHSA-ffhg-7mh4-33c4, GO-2020-0012 | High | 21.1% | 14 Apr, 2021 | Go golang.org/x/crypto |
Git LFS can execute a Git binary from the current directory on Windows BIT-git-lfs-2021-21237, CVE-2021-21237, GHSA-cx3w-xqmc-84g5, GO-2021-0098 | High | 0.5% | 14 Apr, 2021 | Go github.com/git-lfs/git-lfs |
Zip slip directory exploit in github.com/deislabs/oras BIT-oras-2021-21272, CVE-2021-21272, GHSA-g5v4-5x39-vwhx, GO-2021-0099 | High | 1.5% | 14 Apr, 2021 | Go github.com/deislabs/oras |
Panic when opening archives in archive/zip BIT-golang-2021-27919, CVE-2021-27919, GO-2021-0067 | 1.5% | 14 Apr, 2021 | Go stdlib | |
github.com/ulikunitz/xz fixes readUvarint Denial of Service (DoS) CVE-2021-29482, GHSA-25xm-hr59-7c27, GO-2020-0016 | High | 1.4% | 14 Apr, 2021 | Go github.com/ulikunitz/xz |
Arbitrary code injection via the go command with cgo on Windows in cmd/go BIT-golang-2021-3115, CVE-2021-3115, GO-2021-0068 | 6.9% | 14 Apr, 2021 | Go toolchain | |
Improper Input Validation in GoGo Protobuf BIT-consul-2021-3121, BIT-protobuf-2021-3121, CVE-2021-3121, GHSA-c3h9-896r-86jm, GO-2021-0053 | High | 3.4% | 14 Apr, 2021 | Go github.com/gogo/protobuf |
YAML Go package vulnerable to denial of service CVE-2021-4235, GHSA-r88r-gmrh-7j83, GO-2021-0061 | Medium | 0.4% | 14 Apr, 2021 | Go github.com/go-yaml/yaml Go gopkg.in/yaml.v2 |
Integer overflow in the bundled Brotli C library BIT-brotli-2020-8927, BIT-dotnet-2020-8927, BIT-dotnet-sdk-2020-8927, BIT-powershell-2020-8927, CVE-2020-36846, CVE-2020-8927, GHSA-5v8v-66v8-mwm7, GO-2025-3726, PYSEC-2020-29, RUSTSEC-2021-0131, RUSTSEC-2021-0132 | Critical | 3.2% | 15 Sep, 2020 | Go github.com/google/brotli NuGet Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm NuGet Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-arm64 NuGet Microsoft.NETCore.App.Runtime.AOT.linux-x64.Cross.android-x64 +115 more |
Mattermost Server does not restrict SAML certificate path for System Administrators CVE-2017-18918, GHSA-5ghq-28r7-qwfj, GO-2026-4460 | Medium | 0.5% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations CVE-2017-18917, GHSA-jxc4-w54c-qv5r, GO-2026-4463 | High | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has Improper Authorization for Integration Requests CVE-2017-18916, GHSA-x33g-375j-jhf7, GO-2026-4467 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server server restarts may provide attackers with API access CVE-2017-18915, GHSA-hxxj-8phw-74vw, GO-2026-4462 | Critical | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server password reset email requests can be sent to attacker-provided email addresses CVE-2017-18908, GHSA-34cx-hvm4-vx7j, GO-2026-4476 | Critical | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to XSS through channel headers CVE-2017-18907, GHSA-42x9-rr3c-gr59, GO-2026-4459 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used CVE-2017-18906, GHSA-fpcr-4rr5-hpcp, GO-2026-4477 | High | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider CVE-2017-18905, GHSA-g24c-fx4v-xg9w, GO-2026-4306 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows XSS via CSRF CVE-2016-11084, GHSA-vw57-55f8-c73q, GO-2025-4066 | Medium | 0.3% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution CVE-2016-11083, GHSA-rm24-25xm-9454, GO-2025-4065 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through crafted links CVE-2016-11082, GHSA-m78r-2x6w-qqjp, GO-2025-4064 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes information stored by a web browser CVE-2016-11081, GHSA-5q37-9874-qxcw, GO-2025-4062 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes account details to any Team Administrator CVE-2016-11080, GHSA-g3f3-p9rc-775p, GO-2025-4063 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows XSS via redirect URL CVE-2016-11079, GHSA-2j9c-76pp-xc5q, GO-2025-4053 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |