Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository GHSA-fvv5-h29g-f6w5, GO-2024-2581 | Medium | Not scored | 22 Feb, 2024 | Go github.com/treeverse/lakefs |
Apache Answer Cross-site Scripting vulnerability CVE-2024-23349, GHSA-8pf2-qj4v-fj64, GO-2024-2578 | Medium | 1.1% | 22 Feb, 2024 | Go github.com/apache/incubator-answer |
Apache Answer Race Condition vulnerability CVE-2024-26578, GHSA-9q24-hwmc-797x, GO-2024-2580 | Medium | 0.9% | 22 Feb, 2024 | Go github.com/apache/incubator-answer |
ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool` GHSA-2557-x9mg-76w8, GO-2024-2571 | Medium | Not scored | 21 Feb, 2024 | Go github.com/cosmos/cosmos-sdk |
ASA-2024-003: Missing `BlockedAddressed` Validation in Vesting Module GHSA-4j93-fm92-rp4m, GO-2024-2572 | Medium | Not scored | 21 Feb, 2024 | Go github.com/cosmos/cosmos-sdk |
Unencrypted traffic between pods when using Wireguard and an external kvstore BIT-cilium-2024-25631, BIT-cilium-operator-2024-25631, BIT-cilium-proxy-2024-25631, BIT-hubble-2024-25631, BIT-hubble-relay-2024-25631, BIT-hubble-ui-2024-25631, BIT-hubble-ui-backend-2024-25631, CVE-2024-25631, GHSA-x989-52fc-4vr4, GO-2024-2569 | Medium | 0.2% | 20 Feb, 2024 | Go github.com/cilium/cilium |
Unencrypted ingress/health traffic when using Wireguard transparent encryption BIT-cilium-2024-25630, BIT-cilium-operator-2024-25630, BIT-cilium-proxy-2024-25630, BIT-hubble-2024-25630, BIT-hubble-relay-2024-25630, BIT-hubble-ui-2024-25630, BIT-hubble-ui-backend-2024-25630, CVE-2024-25630, GHSA-7496-fgv9-xw82, GO-2024-2568 | Medium | 0.2% | 20 Feb, 2024 | Go github.com/cilium/cilium |
Open Redirect in github.com/greenpau/caddy-security CVE-2024-21497, GHSA-8hp3-rmr7-xh88, GO-2024-2560 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Server-Side Request Forgery in github.com/greenpau/caddy-security CVE-2024-21498, GHSA-93x8-66j2-wwr5, GO-2024-2561 | Medium | 0.6% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security CVE-2024-21499, GHSA-r969-783f-6jqr, GO-2024-2562 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security CVE-2024-21500, GHSA-vfph-hjfv-cpv2, GO-2024-2563 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Insufficient Session Expiration in github.com/greenpau/caddy-security CVE-2024-21492, GHSA-vp66-gf7w-9m4x, GO-2024-2557 | Medium | 0.7% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Improper Validation of Array Index in github.com/greenpau/caddy-security CVE-2024-21493, GHSA-8h95-jcp5-pjpr, GO-2024-2564 | Medium | 0.7% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Authentication Bypass by Spoofing in github.com/greenpau/caddy-security CVE-2024-21494, GHSA-vj36-3ccr-6563, GO-2024-2558 | Medium | 0.5% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Use of Insufficiently Random Values in github.com/greenpau/caddy-security CVE-2024-21495, GHSA-c7vf-m394-m4x4, GO-2024-2565 | Medium | 0.7% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Cross-site Scripting in github.com/greenpau/caddy-security CVE-2024-21496, GHSA-ff72-ff42-c3gw, GO-2024-2559 | Medium | 0.6% | 17 Feb, 2024 | Go github.com/greenpau/caddy-security |
Helm dependency management path traversal BIT-helm-2024-25620, CVE-2024-25620, GHSA-v53g-5gjp-272r, GO-2024-2554 | Medium | 0.6% | 15 Feb, 2024 | Go helm.sh/helm/v3 |
registry-support: decompress can delete files outside scope via relative paths CVE-2024-1485, GHSA-84xv-jfrm-h4gm, GO-2024-2576 | Medium | 0.9% | 14 Feb, 2024 | Go github.com/devfile/registry-support/registry-library |
Email Validation Bypass And Preventing Sign Up From Email's Owner BIT-grafana-2023-6152, CVE-2023-6152, GHSA-3hv4-r2fm-h27f | Medium | 1.4% | 13 Feb, 2024 | Go github.com/grafana/grafana |
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting CVE-2023-52430, GHSA-xwmv-cx7p-fqfc, GO-2024-2549 | Medium | 0.4% | 13 Feb, 2024 | Go github.com/greenpau/caddy-security |
Mattermost vulnerable to denial of service via large number of emoji reactions BIT-mattermost-2024-1402, CVE-2024-1402, GHSA-32h7-7j94-8fc2, GO-2024-2541 | Medium | 0.5% | 09 Feb, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Jira Plugin does not properly check security levels BIT-mattermost-2024-24774, CVE-2024-24774, GHSA-qr8f-cjw7-838m, GO-2024-2540 | Medium | 0.5% | 09 Feb, 2024 | Go github.com/mattermost/mattermost-plugin-jira |
Etcd Gateway TLS endpoint validation only confirms TCP reachability GHSA-j86v-2vjr-fg8f, GO-2024-2528 | Medium | Not scored | 03 Feb, 2024 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Classic builder cache poisoning CVE-2024-24557, GHSA-xw73-rw38-6vjc, GO-2024-2512 | Medium | 0.3% | 01 Feb, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Hashicorp Vault may expose sensitive log information BIT-vault-2024-0831, CVE-2024-0831, GHSA-vgh3-mwxq-rcp8, GO-2024-2511 | Medium | 0.8% | 01 Feb, 2024 | Go github.com/hashicorp/vault |
Grafana Cross Site Request Forgery (CSRF) BIT-grafana-2022-21703, CVE-2022-21703, GHSA-cmf4-h3xc-jw8w | Medium | 2.3% | 01 Feb, 2024 | Go github.com/grafana/grafana/pkg/web |
Moby (Docker Engine) Insufficiently restricted permissions on data directory CVE-2021-41091, GHSA-3fwx-pjgw-3558, GO-2024-2500 | Medium | 2.8% | 31 Jan, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Grafana Cross-site Scripting (XSS) CVE-2018-12099, GHSA-v5gq-qvjq-8p53, GO-2024-2510 | Medium | 2.1% | 31 Jan, 2024 | Go github.com/grafana/grafana |
containerd environment variable leak CVE-2021-21334, GHSA-6g2q-w5j3-fwh4 | Medium | 1.9% | 31 Jan, 2024 | Go github.com/containerd/containerd |
moby docker daemon crash during image pull of malicious image CVE-2021-21285, GHSA-6fj5-m822-rqx8 | Medium | 3.3% | 31 Jan, 2024 | Go github.com/moby/moby |
moby Access to remapped root allows privilege escalation to real root CVE-2021-21284, GHSA-7452-xqpj-6rpc | Medium | 1.1% | 31 Jan, 2024 | Go github.com/moby/moby |
Path Traversal in Moby builder CVE-2020-27534, GHSA-6hwg-w5jg-9c6x | Medium | 1.8% | 31 Jan, 2024 | Go github.com/docker/docker Go github.com/moby/moby |
Enumeration of users in HashiCorp Vault BIT-vault-2020-35177, CVE-2020-35177, GHSA-rpgp-9hmg-j25x, GO-2024-2508 | Medium | 1.3% | 31 Jan, 2024 | Go github.com/hashicorp/vault |
Privilege Escalation in HashiCorp Consul BIT-consul-2020-28053, CVE-2020-28053, GHSA-6m72-467w-94rh, GO-2024-2505 | Medium | 1.5% | 31 Jan, 2024 | Go github.com/hashicorp/consul |
Grafana Arbitrary File Read CVE-2019-19499, GHSA-4pwp-cx67-5cpx, GO-2024-2661 | Medium | 3.5% | 31 Jan, 2024 | Go github.com/grafana/grafana |
BuildKit vulnerable to possible panic when incorrect parameters sent from frontend CVE-2024-23650, GHSA-9p26-698r-w4hx, GO-2024-2492 | Medium | 1.1% | 31 Jan, 2024 | Go github.com/moby/buildkit |
stereoscope vulnerable to tar path traversal when processing OCI tar archives CVE-2024-24579, GHSA-hpxr-w9w7-g4gv, GO-2024-2490 | Medium | 0.4% | 31 Jan, 2024 | Go github.com/anchore/stereoscope |
Apache ServiceComb Service-Center Exposure of Sensitive Information to an Unauthorized Actor vulnerability CVE-2023-44312, GHSA-r8xp-52mq-rmm8, GO-2024-2496 | Medium | 0.8% | 31 Jan, 2024 | Go github.com/apache/servicecomb-service-center |
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records CVE-2020-15136, GHSA-wr2v-9rpq-c35q | Medium | 1.7% | 31 Jan, 2024 | Go go.etcd.io/etcd |
Improper Preservation of Permissions in etcd BIT-etcd-2020-15113, CVE-2020-15113, GHSA-chh6-ppwq-jh92 | Medium | 0.2% | 30 Jan, 2024 | Go github.com/etcd-io/etcd |
Grafana XSS via adding a link in General feature CVE-2018-18625, GHSA-6wh2-8hw7-jw94, GO-2024-2483 | Medium | 1.4% | 30 Jan, 2024 | Go github.com/grafana/grafana |
Grafana XSS in Dashboard Text Panel CVE-2018-18623, GHSA-cmq2-j8v8-2q44, GO-2022-0342 | Medium | 1.8% | 30 Jan, 2024 | Go github.com/grafana/grafana |
HashiCorp Vault Improper Privilege Management BIT-vault-2020-10660, CVE-2020-10660, GHSA-m979-w9wj-qfj9, GO-2024-2486 | Medium | 0.8% | 30 Jan, 2024 | Go github.com/hashicorp/vault |
`goreleaser release --debug` shows secrets CVE-2024-23840, GHSA-h3q2-8whx-c29h, GO-2024-2482 | Medium | 0.3% | 30 Jan, 2024 | Go github.com/goreleaser/goreleaser |
OpenFGA denial of service CVE-2024-23820, GHSA-rxpw-85vw-fx87, GO-2024-2477 | Medium | 0.7% | 26 Jan, 2024 | Go github.com/openfga/openfga |
Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry CVE-2024-23332, GHSA-57wx-m636-g3g8, GO-2024-2472 | Medium | 0.3% | 19 Jan, 2024 | Go github.com/notaryproject/notation |
CRI-O's pods can break out of resource confinement on cgroupv2 CVE-2023-6476, GHSA-p4rx-7wvg-fwrc, GO-2024-2458 | Medium | 0.9% | 10 Jan, 2024 | Go github.com/cri-o/cri-o |
quic-go's path validation mechanism can be exploited to cause denial of service CVE-2023-49295, GHSA-ppxx-5m9h-6vxf, GO-2024-2459 | Medium | 1.2% | 10 Jan, 2024 | Go github.com/quic-go/quic-go |
Parsing JSON serialized payload without protected field can lead to segfault CVE-2024-21664, GHSA-pvcr-v8j8-j5q3, GO-2024-2454 | Medium | 0.9% | 09 Jan, 2024 | Go github.com/lestrrat-go/jwx Go github.com/lestrrat-go/jwx/v2 |
Kruise allows leveraging the kruise-daemon pod to list all secrets in the entire cluster CVE-2023-30617, GHSA-437m-7hj5-9mpw | Medium | 0.5% | 05 Jan, 2024 | Go github.com/openkruise/kruise |