Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node CVE-2021-27098, GHSA-h746-rm5q-8mgq | High | 0.6% | 21 May, 2021 | Go github.com/spiffe/spire |
Insufficient Session Expiration in Kiali CVE-2020-1762, GHSA-465w-gg5p-85c9, GO-2022-0626 | High | 1.2% | 18 May, 2021 | Go github.com/kiali/kiali |
Path traversal in u-root CVE-2020-7665, GHSA-58pf-pcwv-qg85, GO-2022-0793 | High | 1.8% | 18 May, 2021 | Go github.com/u-root/u-root |
github.com/tidwall/gjson is vulnerable to Denial of service CVE-2020-36066, GHSA-wjm3-fq3r-5x46, GO-2022-0957 | High | 1.8% | 18 May, 2021 | Go github.com/tidwall/gjson |
Path Traversal in github.com/unknwon/cae/zip CVE-2020-7664, GHSA-vpx7-vm66-qx8r, GO-2021-0228 | High | 1.5% | 18 May, 2021 | Go github.com/unknwon/cae |
Go JOSE Signature Validation Bypass CVE-2016-9122, GHSA-77gc-fj98-665h, GO-2022-0945 | High | 2.0% | 18 May, 2021 | Go gopkg.in/square/go-jose.v1 |
Go Ethereum Improper Input Validation CVE-2018-16733, GHSA-qr2j-wrhx-4829, GO-2022-0871 | High | 1.2% | 18 May, 2021 | Go github.com/ethereum/go-ethereum |
Improper Authorization in github.com/containers/libpod CVE-2021-20188, GHSA-9h63-7qf6-mv6r, GO-2022-0641 | High | 0.3% | 18 May, 2021 | Go github.com/containers/libpod |
Path Traversal in Buildah CVE-2020-10696, GHSA-fx8w-mjvm-hvpc, GO-2022-0828 | High | 2.7% | 18 May, 2021 | Go github.com/containers/buildah |
Predictable SIF UUID Identifiers in github.com/sylabs/sif CVE-2021-29499, GHSA-4gh8-x3vv-phhg, GO-2022-0912 | High | 1.0% | 18 May, 2021 | Go github.com/sylabs/sif |
Hard coded cryptographic key in Kiali CVE-2020-1764, GHSA-64rh-r86q-75ff, GO-2022-0631 | High | 3.5% | 18 May, 2021 | Go github.com/kiali/kiali |
github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2020-7669, GHSA-75qf-wgfj-v652, GO-2022-0805 | High | 1.8% | 18 May, 2021 | Go github.com/u-root/u-root |
Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor CVE-2019-19025, GHSA-gcqm-v682-ccw6, GHSA-rffr-c932-cpxv, GO-2022-0876 | High | 1.0% | 18 May, 2021 | Go github.com/goharbor/harbor |
SQL Injection in Cloud Native Computing Foundation Harbor CVE-2019-19029, GHSA-jr34-mff8-pc6f, GHSA-qcfv-8v29-469w, GO-2022-0853 | High | 2.1% | 18 May, 2021 | Go github.com/goharbor/harbor |
Allocation of Resources Without Limits or Throttling in Hashicorp Consul BIT-consul-2020-13250, CVE-2020-13250, GHSA-rqjq-mrgx-85hp, GO-2022-0879 | High | 2.9% | 18 May, 2021 | Go github.com/hashicorp/consul |
Information Disclosure in HashiCorp Vault BIT-vault-2020-13223, CVE-2020-13223, GHSA-25xj-89g5-fm6h, GO-2022-0778 | High | 1.3% | 18 May, 2021 | Go github.com/hashicorp/vault |
Improper Certificate Validation in HashiCorp Nomad CVE-2020-7956, GHSA-cj2h-ww36-v932, GO-2022-0821 | High | 1.0% | 18 May, 2021 | Go github.com/hashicorp/nomad |
Allocation of Resources Without Limits or Throttling in HashiCorp Nomad CVE-2020-7218, GHSA-h43v-26r7-7j4c, GO-2022-0840 | High | 1.5% | 18 May, 2021 | Go github.com/hashicorp/nomad |
Denial of Service (DoS) in HashiCorp Consul BIT-consul-2020-7219, CVE-2020-7219, GHSA-23jv-v6qj-3fhh, GO-2022-0776 | High | 2.0% | 18 May, 2021 | Go github.com/hashicorp/consul |
Use of a Broken or Risky Cryptographic Algorithm in Terraform CVE-2019-19316, GHSA-4rvg-555h-r626, GHSA-h3p9-wrgx-82cm, GO-2022-0839 | High | 0.9% | 18 May, 2021 | Go github.com/hashicorp/terraform |
Integer Overflow or Wraparound in NATS Server CVE-2019-13126, GHSA-jp4j-47f9-2vc3, GO-2022-0852 | High | 1.8% | 18 May, 2021 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Rancher Vulnerable to Cross-site Request Forgery (CSRF) CVE-2019-13209, GHSA-xhg2-rvm8-w2jh, GO-2022-0755 | High | 1.1% | 18 May, 2021 | Go github.com/rancher/rancher |
XML Entity Expansion and Improper Input Validation in Kubernetes API server CVE-2019-11253, GHSA-pmqp-h87c-mr78, GO-2022-0703 | High | 25.9% | 18 May, 2021 | Go k8s.io/kubernetes |
Out-of-bounds read in Apache Thrift CVE-2019-0210, GHSA-jq7p-26h5-w78r, GO-2021-0101 | High | 6.5% | 18 May, 2021 | Go github.com/apache/thrift |
Cloud Foundry Routing Improper Input Validation vulnerability CVE-2019-11289, GHSA-5796-p3m6-9qj4, GO-2021-0102 | High | 1.5% | 18 May, 2021 | Go code.cloudfoundry.org/gorouter Go github.com/cloudfoundry/gorouter |
Improper Access Control in Lightning Network Daemon CVE-2019-12999, GHSA-78hj-86cr-6j2v, GO-2022-0807 | High | 2.2% | 18 May, 2021 | Go github.com/lightningnetwork/lnd |
socks Infinite Loop vulnerability CVE-2013-10005, GHSA-gxgj-xjcw-fv9p, GO-2020-0024 | High | 0.8% | 14 Apr, 2021 | Go github.com/btcsuite/go-socks Go github.com/btcsuitereleases/go-socks |
robbert229/jwt's token validation methods vulnerable to a timing side-channel during HMAC comparison CVE-2015-10004, GHSA-5vw4-v588-pgv8, GO-2020-0023 | High | 0.8% | 14 Apr, 2021 | Go github.com/robbert229/jwt |
Golf may allow attacker to bypass CSRF protections due to weak PRNG CVE-2016-15005, GHSA-q9qr-jwpw-3qvv, GO-2020-0045 | High | 0.4% | 14 Apr, 2021 | Go github.com/dinever/golf |
Privilege Elevation in runc CVE-2016-3697, GHSA-q3j5-32m5-58c2, GO-2021-0070 | High | 0.4% | 14 Apr, 2021 | Go github.com/opencontainers/runc |
Integer Overflow in go-jose CVE-2016-9123, GHSA-3fx4-7f69-5mmg, GO-2020-0009 | High | 2.1% | 14 Apr, 2021 | Go github.com/square/go-jose |
Docker Registry has Allocation of Resources Without Limits or Throttling CVE-2017-11468, GHSA-h62f-wm92-2cmw, GO-2021-0072 | High | 3.2% | 14 Apr, 2021 | Go github.com/docker/distribution |
Denial of Service in miekg-dns CVE-2017-15133, GHSA-p55x-7x9v-q8m4, GO-2020-0006 | High | 1.9% | 14 Apr, 2021 | Go github.com/miekg/dns |
GitHub Git LFS Arbitrary command execution vulnerability CVE-2017-17831, GHSA-w4xh-w33p-4v29, GO-2021-0073 | High | 3.7% | 14 Apr, 2021 | Go github.com/git-lfs/git-lfs |
Improper Input Validation in libseccomp-golang CVE-2017-18367, GHSA-58v3-j75h-xr49, GO-2020-0007 | High | 2.4% | 14 Apr, 2021 | Go github.com/seccomp/libseccomp-golang |
golang.org/x/crypto/ssh Man-in-the-Middle attack CVE-2017-3204, GHSA-xhjq-w7xm-p8qj, GO-2020-0013 | High | 3.2% | 14 Apr, 2021 | Go golang.org/x/crypto |
Go Ethereum LES protocol implementation vulnerable to Denial of Service CVE-2018-12018, GHSA-p5gc-957x-gfw9, GO-2021-0075 | High | 4.3% | 14 Apr, 2021 | Go github.com/ethereum/go-ethereum |
JSON-Patch Out-of-bounds Write vulnerability CVE-2018-14632, GHSA-gxhv-3hwf-wjp9, GO-2021-0076 | High | 2.2% | 14 Apr, 2021 | Go github.com/evanphx/json-patch |
go.etcd.io/etcd Authentication Bypass CVE-2018-16886, GHSA-h6xx-pmxh-3wgp, GO-2021-0077 | High | 4.1% | 14 Apr, 2021 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
golang.org/x/net/html NULL Pointer Dereference vulnerability CVE-2018-17075, GHSA-5p4h-3377-7w67, GO-2021-0078 | High | 2.8% | 14 Apr, 2021 | Go golang.org/x/net |
miekg/dns parsing error leads to nil pointer dereference and DoS CVE-2018-17419, GHSA-9jcx-pr2f-qvq5, GO-2020-0028 | High | 1.8% | 14 Apr, 2021 | Go github.com/miekg/dns |
x/net/html Vulnerable to DoS During HTML Parsing CVE-2018-17846, GHSA-vfw5-hrgq-h5wf, GO-2020-0014 | High | 2.5% | 14 Apr, 2021 | Go golang.org/x/net |
Denial of Service in Bytom CVE-2018-18206, GHSA-vc3x-gx6c-g99f, GO-2021-0079 | High | 1.4% | 14 Apr, 2021 | Go github.com/bytom/bytom |
Golang Facebook Thrift servers vulnerable to denial of service CVE-2019-11939, GHSA-w3r9-r9w7-8h48, GO-2021-0082 | High | 1.6% | 14 Apr, 2021 | Go github.com/facebook/fbthrift |
Hybrid Group Gobot Improper Certificate Validation vulnerability CVE-2019-12496, GHSA-vfxc-r2gx-v2vq, GO-2021-0083 | High | 0.7% | 14 Apr, 2021 | Go github.com/hybridgroup/gobot |
Incorrect Authorization in runc CVE-2019-16884, GHSA-fgv8-vj5c-2ppq, GO-2021-0085 | High | 4.4% | 14 Apr, 2021 | Go github.com/opencontainers/runc Go github.com/opencontainers/selinux |
Tendermint Client package vulnerable to Uncontrolled Resource Consumption CVE-2019-25072, GHSA-3fm3-m23v-5r46, GO-2020-0037 | High | 1.2% | 14 Apr, 2021 | Go github.com/tendermint/tendermint |
Goa vulnerable to path traversal CVE-2019-25073, GHSA-fjgq-224f-fq37, GO-2020-0032 | High | 1.5% | 14 Apr, 2021 | Go github.com/goadesign/goa Go goa.design/goa Go goa.design/goa/v3 |
Improper Input Validation and Excessive Iteration in Go Facebook Thrift CVE-2019-3564, GHSA-x4rg-4545-4w7w, GO-2021-0088 | High | 2.0% | 14 Apr, 2021 | Go github.com/facebook/fbthrift |
Infinite Loop in jsonparser CVE-2020-10675, GHSA-rmh2-65xw-9m6q, GO-2021-0089 | High | 2.6% | 14 Apr, 2021 | Go github.com/buger/jsonparser |