Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Gitops Run insecure communication CVE-2022-23509, GHSA-89qm-wcmw-3mgg, GO-2023-1388 | High | 0.3% | 09 Jan, 2023 | Go github.com/weaveworks/weave-gitops |
GitOps Run allows for Kubernetes workload injection CVE-2022-23508, GHSA-wr3c-g326-486c, GO-2023-1377 | High | 0.3% | 09 Jan, 2023 | Go github.com/weaveworks/weave-gitops |
Elrond-GO processing: fallback search of SCRs when not found in the main cache CVE-2022-46173, GHSA-p228-4mrh-ww7r, GO-2022-1200 | High | 0.8% | 30 Dec, 2022 | Go github.com/ElrondNetwork/elrond-go |
Macaron csrf missing encryption and has sensitive cookies in HTTP session without secure attribute CVE-2018-25060, GHSA-hhxg-px5h-jc32, GO-2022-1213 | High | 0.6% | 30 Dec, 2022 | Go github.com/go-macaron/csrf |
usememos/memos Cross-Site Request Forgery vulnerability CVE-2022-4844, GHSA-5jqp-wmhj-g33f | High | 0.3% | 29 Dec, 2022 | Go github.com/usememos/memos |
Yapscan's report receiver server vulnerable to path traversal and log injection GHSA-9h6h-9g78-86f7, GO-2022-1204 | High | Not scored | 29 Dec, 2022 | Go github.com/fkie-cad/yapscan |
usememos/memos Improper Privilege Management vulnerability CVE-2022-4808, GHSA-r3p3-5f35-h6mf, GO-2023-1449 | High | 0.4% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos Improper Access Control vulnerability CVE-2022-4809, GHSA-6w5w-wx8w-2cq9, GO-2022-1252 | High | 1.0% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos makes Incorrect Use of Privileged APIs CVE-2022-4796, GHSA-ghx2-6v4g-9wmm, GO-2022-1236 | High | 0.8% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos Improper Access Control vulnerability CVE-2022-4803, GHSA-mfmp-8mqg-q4wm, GO-2023-1291 | High | 0.9% | 28 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos Denial of Service vulnerability CVE-2022-4767, GHSA-33m8-f4hw-wm3q, GO-2022-1219 | High | 0.7% | 27 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos Improper Access Control vulnerability CVE-2022-4684, GHSA-qr52-59r6-49f4, GO-2022-1218 | High | 0.6% | 23 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos makes Incorrect Use of Privileged APIs CVE-2022-4687, GHSA-fv6c-rfg3-gvjw, GO-2022-1217 | High | 0.7% | 23 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos vulnerable to improper authorization CVE-2022-4688, GHSA-vwg4-846x-f94v, GO-2022-1190 | High | 0.8% | 23 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos vulnerable to account takeover due to improper access control CVE-2022-4689, GHSA-w57v-6xp4-rm2v, GO-2022-1191 | High | 0.8% | 23 Dec, 2022 | Go github.com/usememos/memos |
destiny.gg chat vulnerable to cross-site request forgery CVE-2020-36625, GHSA-cjcc-46j8-xmr8 | High | 0.4% | 22 Dec, 2022 | Go github.com/destinygg/chat |
kyverno verifyImages rule bypass possible with malicious proxy/registry BIT-kyverno-2022-47633, CVE-2022-47633, GHSA-m3cq-xcx9-3gvm, GO-2022-1180 | High | 1.0% | 21 Dec, 2022 | Go github.com/kyverno/kyverno |
OpenFGA Authorization Bypass CVE-2022-23542, GHSA-m3q4-7qmj-657m, GO-2022-1179 | High | 1.0% | 20 Dec, 2022 | Go github.com/openfga/openfga |
AList vulnerable to Improper Preservation of Permissions CVE-2022-45968, GHSA-4gjr-vgfx-9qvw, GO-2022-1161 | High | 1.0% | 12 Dec, 2022 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |
Amazon CloudWatch Agent for Windows has Privilege Escalation Vector CVE-2022-23511, GHSA-j8x2-2m5w-j939, GO-2022-1160 | High | 0.5% | 12 Dec, 2022 | Go github.com/aws/amazon-cloudwatch-agent |
go-merkledag's ProtoNode may be modified such that common method calls may panic CVE-2022-23495, GHSA-x39j-h85h-3f46, GO-2022-1155 | High | 1.4% | 08 Dec, 2022 | Go github.com/ipfs/go-merkledag |
libp2p DoS vulnerability from lack of resource management CVE-2022-23492, GHSA-j7qp-mfxf-8xjw, GO-2022-1148 | High | 1.1% | 07 Dec, 2022 | Go github.com/libp2p/go-libp2p |
Casdoor arbitrary file deletion vulnerability via uploadFile function CVE-2022-44942, GHSA-f93f-55c2-8c89, GO-2022-1153 | High | 0.9% | 07 Dec, 2022 | Go github.com/casdoor/casdoor |
Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace CVE-2022-46167, GHSA-x45c-cvp8-q4fm, GO-2022-1135 | High | 0.9% | 05 Dec, 2022 | Go github.com/clastix/capsule |
Prometheus vulnerable to basic authentication bypass GHSA-4v48-4q5m-8vx4 | High | Not scored | 05 Dec, 2022 | Go github.com/prometheus/prometheus Go github.com/prometheus/prometheus/v2 |
Lancet vulnerable to path traversal when unzipping files CVE-2022-41920, GHSA-pp3f-xrw5-q5j4, GO-2022-1114 | High | 0.9% | 21 Nov, 2022 | Go github.com/duke-git/lancet Go github.com/duke-git/lancet/v2 |
Free5gc vulnerable to uncontrolled resource consumption CVE-2022-38871, GHSA-m74x-fxjh-3qh9 | High | 0.8% | 19 Nov, 2022 | Go github.com/free5gc/free5gc |
Witness Block Parsing DoS Vulnerability CVE-2022-39389, GHSA-hc82-w9v8-83pr | High | 1.1% | 18 Nov, 2022 | Go github.com/lightningnetwork/lnd |
Missing Authorization in HashiCorp Consul BIT-consul-2022-3920, CVE-2022-3920, GHSA-gw2g-hhc9-wgjh, GO-2022-1121 | High | 0.7% | 16 Nov, 2022 | Go github.com/hashicorp/consul |
MessagePack for Golang subject to DoS via Unmarshal panic CVE-2022-41719, GHSA-jr77-8gx4-h5qh, GO-2022-0972 | High | 1.1% | 10 Nov, 2022 | Go github.com/shamaton/msgpack/v2 |
Istio may allow identity impersonation if user has localhost access CVE-2022-39388, GHSA-6c6p-h79f-g6p4 | High | 0.5% | 09 Nov, 2022 | Go github.com/istio/istio |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3798, GHSA-mgqh-3qm7-gx82, GO-2024-2777 | High | 0.6% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3799, GHSA-fcgf-j8cf-h2rm, GO-2024-2759 | High | 0.8% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3800, GHSA-rwcf-gq22-ph83, GO-2024-2783 | High | 3.1% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3801, GHSA-m738-584h-26p6, GO-2024-2775 | High | 30.1% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
IBAX go-ibax vulnerable to SQL injection CVE-2022-3802, GHSA-g23g-mw97-65c8, GO-2024-2770 | High | 0.6% | 01 Nov, 2022 | Go github.com/IBAX-io/go-ibax |
Bifrost vulnerable to authentication check flaw that leads to authentication bypass CVE-2022-39267, GHSA-mxrx-fg8p-5p5j, GO-2022-1067 | High | 0.9% | 18 Oct, 2022 | Go github.com/brokercap/Bifrost |
Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd GHSA-j92c-mmf7-j5x5, GO-2022-1066 | High | Not scored | 18 Oct, 2022 | Go github.com/cheqd/cheqd-node |
Remote denial of service in Hyperledger Fabric Gateway BIT-hyperledger-fabric-orderer-2022-36023, BIT-hyperledger-fabric-peer-2022-36023, BIT-hyperledger-fabric-tools-2022-36023, CVE-2022-36023, GHSA-qj6r-fhrc-jj5r | High | 1.2% | 13 Oct, 2022 | Go github.com/hyperledger/fabric |
golang.org/x/text/language Denial of service via crafted Accept-Language header CVE-2022-32149, GHSA-69ch-w2m2-3vjp, GO-2022-1059 | High | 1.8% | 11 Oct, 2022 | Go golang.org/x/text |
Traefik HTTP/2 connections management could cause a denial of service CVE-2022-39271, GHSA-c6hx-pjc3-7fqr | High | 1.4% | 10 Oct, 2022 | Go github.com/traefik/traefik/v2 |
FlyteAdmin's Default OAuth Authorization Server secret must be rotated CVE-2022-39273, GHSA-67x4-qr35-qvrm, GO-2022-1043 | High | 0.9% | 05 Oct, 2022 | Go github.com/flyteorg/flyteadmin |
Dapr Dashboard vulnerable to Incorrect Access Control CVE-2022-38817, GHSA-2w6m-q946-399r, GO-2022-1033 | High | 3.9% | 04 Oct, 2022 | Go github.com/dapr/dashboard |
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package CVE-2022-2529, GHSA-9rpw-2h95-666c, GO-2022-1032 | High | 1.0% | 01 Oct, 2022 | Go github.com/cloudflare/goflow Go github.com/cloudflare/goflow/v3 |
go-resolver's DNSSEC validation not performed correctly CVE-2022-3347, GHSA-jr65-gpj5-cw74, GO-2022-1026 | High | 0.3% | 29 Sep, 2022 | Go github.com/peterzen/goresolver |
go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs CVE-2022-3346, GHSA-87mm-qxm5-cp3f, GO-2022-0979 | High | 0.2% | 29 Sep, 2022 | Go github.com/peterzen/goresolver |
Hertz contains path traversal via normalizePath function CVE-2022-40082, GHSA-c9qr-f6c8-rgxf, GO-2022-1027 | High | 1.1% | 29 Sep, 2022 | Go github.com/cloudwego/hertz |
Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication CVE-2022-39219, GHSA-p6fh-xc6r-g5hw, GO-2022-1023 | High | 1.2% | 27 Sep, 2022 | Go github.com/brokercap/Bifrost |
Hyperledger Fabric subject to Denial of Service via non-validated request CVE-2022-35253, GHSA-9w7j-q3xw-p9vh | High | Not scored | 25 Sep, 2022 | Go github.com/hyperledger/fabric |
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions BIT-consul-2021-41803, CVE-2021-41803, GHSA-hr3v-8cp3-68rf, GO-2024-2683 | High | 1.1% | 25 Sep, 2022 | Go github.com/hashicorp/consul |