Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost fails to properly authentication inviter's permissions to private channel BIT-mattermost-2023-1774, CVE-2023-1774, GHSA-9hj7-v56g-rhf6 | Medium | 0.3% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to information disclosure BIT-mattermost-2023-1775, CVE-2023-1775, GHSA-8jhh-3jf2-pfwr | Medium | 0.5% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to cross-site scripting (XSS) BIT-mattermost-2023-1776, CVE-2023-1776, GHSA-63f2-6959-2pxj | Medium | 0.4% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Mattermost vulnerable to information disclosure BIT-mattermost-2023-1777, CVE-2023-1777, GHSA-3wq5-3f56-v5xc | Medium | 0.5% | 31 Mar, 2023 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v6 |
runc AppArmor bypass with symlinked /proc CVE-2023-28642, GHSA-g2j6-57v7-gm8c, GO-2023-1683 | Medium | 0.3% | 30 Mar, 2023 | Go github.com/opencontainers/runc |
HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File BIT-vault-2023-0620, CVE-2023-0620, GHSA-v3hp-mcj5-pg39, GO-2023-1685 | Medium | 0.4% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
HashiCorp Vault's PKI mount vulnerable to denial of service BIT-vault-2023-0665, CVE-2023-0665, GHSA-hwc3-3qh6-r4gg, GO-2023-1708 | Medium | 0.3% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks BIT-vault-2023-25000, CVE-2023-25000, GHSA-vq4h-9ghm-qmrr, GO-2023-1709 | Medium | 0.2% | 30 Mar, 2023 | Go github.com/hashicorp/vault |
Podman Time-of-check Time-of-use (TOCTOU) Race Condition CVE-2023-0778, GHSA-qwqv-rqgf-8qh8, GO-2023-1681 | Medium | 0.5% | 27 Mar, 2023 | Go github.com/containers/podman/v4 |
OpenShift Assisted Installer leaks image pull secrets as plaintext in installation logs CVE-2021-3684, GHSA-g8xm-p2h4-v6jp | Medium | 0.2% | 24 Mar, 2023 | Go github.com/openshift/assisted-installer |
Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip BIT-grafana-2023-1410, CVE-2023-1410, GHSA-qrrg-gw7w-vp76 | Medium | 1.0% | 23 Mar, 2023 | Go github.com/grafana/grafana |
Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process CVE-2023-28436, GHSA-vfgq-g5x8-g595, GO-2023-1671 | Medium | 0.5% | 23 Mar, 2023 | Go tailscale.com |
Argo CD authenticated but unauthorized users may enumerate Application names via the API CVE-2022-41354, GHSA-2q5c-qw9c-fmvq, GO-2023-1670 | Medium | 0.6% | 23 Mar, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Gophish vulnerable to Cross-site Scripting via crafted landing page CVE-2022-45004, GHSA-55m9-hm92-xm8j | Medium | 0.6% | 22 Mar, 2023 | Go github.com/gophish/gophish |
`cilium-cli` disables etcd authorization for clustermesh clusters CVE-2023-28114, GHSA-6f27-3p6c-p5jc, GO-2023-1653 | Medium | 0.2% | 21 Mar, 2023 | Go github.com/cilium/cilium-cli |
Answer vulnerable to Stored Cross-site Scripting CVE-2023-1535, GHSA-83qr-c7m9-wmgw, GO-2023-1656 | Medium | 0.5% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Stored Cross-site Scripting CVE-2023-1536, GHSA-xvfj-84vc-hrmf, GO-2023-1662 | Medium | 0.5% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Observable Timing Discrepancy CVE-2023-1538, GHSA-rvjp-8qj4-8p29, GO-2023-1661 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Guessable CAPTCHA CVE-2023-1539, GHSA-g44v-6qfm-f6ch, GO-2023-1657 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer has Observable Response Discrepancy CVE-2023-1540, GHSA-6x5v-cxpp-pc5x, GO-2023-1654 | Medium | 0.6% | 21 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Business Logic Errors CVE-2023-1542, GHSA-r95w-7cpx-h5mx, GO-2023-1660 | Medium | 0.8% | 21 Mar, 2023 | Go github.com/answerdev/answer |
imgproxy Cross-site Scripting vulnerability CVE-2023-1496, GHSA-ch9g-x9j7-rcgp, GO-2023-1651 | Medium | 1.6% | 19 Mar, 2023 | Go github.com/imgproxy/imgproxy Go github.com/imgproxy/imgproxy/v2 Go github.com/imgproxy/imgproxy/v3 |
Cilium eBPF filters may be temporarily removed during agent restart BIT-cilium-2023-27595, BIT-cilium-operator-2023-27595, BIT-cilium-proxy-2023-27595, BIT-hubble-2023-27595, BIT-hubble-relay-2023-27595, BIT-hubble-ui-2023-27595, BIT-hubble-ui-backend-2023-27595, CVE-2023-27595, GHSA-r5x6-w42p-jhpp, GO-2023-1644 | Medium | 0.7% | 17 Mar, 2023 | Go github.com/cilium/cilium |
Potential network policy bypass when routing IPv6 traffic BIT-cilium-2023-27594, BIT-cilium-operator-2023-27594, BIT-cilium-proxy-2023-27594, BIT-hubble-2023-27594, BIT-hubble-relay-2023-27594, BIT-hubble-ui-2023-27594, BIT-hubble-ui-backend-2023-27594, CVE-2023-27594, GHSA-8fg8-jh2h-f2hc, GO-2023-1643 | Medium | 0.6% | 17 Mar, 2023 | Go github.com/cilium/cilium |
cilium-agent container can access the host via `hostPath` mount BIT-cilium-2023-27593, BIT-cilium-operator-2023-27593, BIT-cilium-proxy-2023-27593, BIT-hubble-2023-27593, BIT-hubble-relay-2023-27593, BIT-hubble-ui-2023-27593, BIT-hubble-ui-backend-2023-27593, CVE-2023-27593, GHSA-4hc4-pgfx-3mrx | Medium | 0.2% | 17 Mar, 2023 | Go github.com/cilium/cilium |
Authorization Bypass Through User-Controlled Key play-with-docker CVE-2023-28109, GHSA-vq59-5x26-h639 | Medium | 0.7% | 17 Mar, 2023 | Go github.com/play-with-docker/play-with-docker |
Authelia allows open redirects on the logout endpoint CVE-2021-29456, GHSA-36f2-fcrx-fp4j | Medium | 0.5% | 16 Mar, 2023 | Go github.com/authelia/authelia/v4 |
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime CVE-2023-27483, GHSA-vfvj-3m3g-m532, GO-2023-1623 | Medium | 0.8% | 13 Mar, 2023 | Go github.com/crossplane/crossplane-runtime |
Crossplane-runtime contains Improper Input Validation via Compositions CVE-2023-27484, GHSA-v829-x6hh-cqfq | Medium | 0.7% | 10 Mar, 2023 | Go github.com/crossplane/crossplane |
Consul Server Panic when Ingress and API Gateways Configured with Peering Connections BIT-consul-2023-0845, CVE-2023-0845, GHSA-wj6x-hcc2-f32j, GO-2023-1639 | Medium | 1.0% | 09 Mar, 2023 | Go github.com/hashicorp/consul |
Buildkit credentials inlined to Git URLs could end up in provenance attestation CVE-2023-26054, GHSA-gc89-7gcr-jxqc | Medium | 1.0% | 07 Mar, 2023 | Go github.com/moby/buildkit |
Answer vulnerable to Cross-site Scripting CVE-2023-1237, GHSA-9v4v-9fj5-p982, GO-2023-1616 | Medium | 0.4% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1238, GHSA-5w78-v688-cx9q, GO-2023-1614 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1239, GHSA-vxhr-p2vp-7gf8, GO-2023-1620 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1240, GHSA-55vm-3vq3-4jpc, GO-2023-1613 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1241, GHSA-ff27-hrmr-ggpj, GO-2023-1617 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1242, GHSA-qrwm-xqfr-4vhv, GO-2023-1619 | Medium | 0.6% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1243, GHSA-8jh8-33f5-cgfp, GO-2023-1615 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1244, GHSA-h85v-cx5m-78wj, GO-2023-1618 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
Answer vulnerable to Cross-site Scripting CVE-2023-1245, GHSA-6c32-3x46-m9rh, GO-2023-1612 | Medium | 0.5% | 07 Mar, 2023 | Go github.com/answerdev/answer |
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints CVE-2022-2835, GHSA-ch7v-37xg-75ph | Medium | 0.2% | 03 Mar, 2023 | Go github.com/coredns/coredns |
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints CVE-2022-2837, GHSA-h828-v5pv-33qx | Medium | 0.4% | 03 Mar, 2023 | Go github.com/coredns/coredns |
gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb CVE-2023-26483, GHSA-6gc3-crp7-25w5, GO-2023-1602 | Medium | 1.0% | 02 Mar, 2023 | Go github.com/russellhaering/gosaml2 |
Kubernetes vulnerable to path traversal CVE-2022-3162, GHSA-2394-5535-8j88, GO-2023-1628 | Medium | 1.4% | 01 Mar, 2023 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Grafana vulnerable to Stored Cross-site Scripting in Text plugin BIT-grafana-2023-22462, CVE-2023-22462, GHSA-7rqg-hjwc-6mjf | Medium | 1.6% | 01 Mar, 2023 | Go github.com/grafana/grafana |
teler-waf contains detection rule bypass via Entities payload CVE-2023-26047, GHSA-p2pf-g8cq-3gq5, GO-2023-1600 | Medium | 0.5% | 01 Mar, 2023 | Go github.com/kitabisa/teler-waf |
teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload CVE-2023-26046, GHSA-9f95-hhg4-pg4f, GO-2023-1597 | Medium | 0.5% | 01 Mar, 2023 | Go github.com/kitabisa/teler-waf |
Juju controller - Arbitrary file reading vulnerability CVE-2023-0092, GHSA-x5rv-w9pm-8qp8 | Medium | 0.6% | 01 Mar, 2023 | Go github.com/juju/juju |
Grafana vulnerable to Cross-site Scripting BIT-grafana-2023-0594, CVE-2023-0594, GHSA-xw5p-hw8j-xg4q | Medium | 9.2% | 01 Mar, 2023 | Go github.com/grafana/grafana |
Grafana vulnerable to Cross-site Scripting BIT-grafana-2023-0507, CVE-2023-0507, GHSA-hjv9-hm2f-rpcj | Medium | 15.5% | 01 Mar, 2023 | Go github.com/grafana/grafana |