Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses CVE-2020-15233, GHSA-rfq3-w54c-f9q5 | Medium | 0.8% | 24 May, 2021 | Go github.com/ory/fosite |
Redirect URL matching ignores character casing CVE-2020-15234, GHSA-grfp-q2mm-hfp6 | Medium | 0.8% | 24 May, 2021 | Go github.com/ory/fosite |
Authenticated users can exploit an enumeration vulnerability in Harbor BIT-harbor-2020-13794, CVE-2020-13794, GHSA-q9p8-33wc-h432, GO-2022-0865 | Medium | 1.3% | 24 May, 2021 | Go github.com/goharbor/harbor |
Import of incorrectly embargoed keys could cause early publication GHSA-3wxm-m9m4-cprj, GO-2022-0381 | Medium | Not scored | 21 May, 2021 | Go github.com/google/exposure-notifications-server |
JWT leak via Open Redirect in Programmatic access CVE-2021-29651, GHSA-35vc-w93w-75c2, GO-2022-0783 | Medium | 0.7% | 21 May, 2021 | Go github.com/pomerium/pomerium |
pomerium_signature is not verified in middleware in github.com/pomerium/pomerium CVE-2021-29652, GHSA-fv82-r8qv-ch4v, GO-2022-0827 | Medium | 0.7% | 21 May, 2021 | Go github.com/pomerium/pomerium |
BLS Signature "Malleability" CVE-2021-21405, GHSA-4g52-pqcj-phvh, GO-2022-0905 | Medium | 1.0% | 21 May, 2021 | Go github.com/filecoin-project/lotus |
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2 BIT-argo-cd-2021-23347, CVE-2021-23347, GHSA-qq5v-f4c3-395c, GO-2022-0869, SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291 | Medium | 0.6% | 21 May, 2021 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Helm OCI credentials leaked into Argo CD logs GHSA-6w87-g839-9wv7, GO-2022-0387 | Medium | Not scored | 21 May, 2021 | Go github.com/argoproj/argo-cd |
Podman Origin Validation Error CVE-2021-20199, GHSA-grh6-q6m2-rh72 | Medium | 1.2% | 18 May, 2021 | Go github.com/containers/podman/v3 |
github.com/pires/go-proxyproto denial of service vulnerability CVE-2021-23351, GHSA-fqh4-rh59-xhvf, SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1081577 | Medium | 1.9% | 18 May, 2021 | Go github.com/pires/go-proxyproto |
Cross-site scripting in bluemonday CVE-2021-29272, GHSA-3x58-xr87-2fcj, GO-2022-0762 | Medium | 0.9% | 18 May, 2021 | Go github.com/microcosm-cc/bluemonday |
Insecure Permissions in Gogs CVE-2020-14958, GHSA-4c7m-vv47-7c69, GO-2022-0788 | Medium | 0.9% | 18 May, 2021 | Go gogs.io/gogs |
Information Exposure in jaeger BIT-jaeger-2020-10750, CVE-2020-10750, GHSA-gh32-pc56-4c96, GO-2022-0834 | Medium | 0.4% | 18 May, 2021 | Go github.com/jaegertracing/jaeger |
SQL Injection in Cloud Native Computing Foundation Harbor CVE-2019-19026, GHSA-rh89-vvrg-fg64, GHSA-w4x5-jqq4-qc8x, GO-2022-0883 | Medium | 1.4% | 18 May, 2021 | Go github.com/goharbor/harbor |
Privilege Escalation in Cloud Native Computing Foundation Harbor CVE-2019-19023, GHSA-q6cj-6jvq-jwmh, GO-2022-0863 | Medium | 1.6% | 18 May, 2021 | Go github.com/goharbor/harbor |
Improper Input Validation in HashiCorp Consul BIT-consul-2020-13170, CVE-2020-13170, GHSA-p2j5-3f4c-224r, GO-2022-0859 | Medium | 1.8% | 18 May, 2021 | Go github.com/hashicorp/consul |
Duplicate Advisory: k8s.io/kube-state-metrics Exposure of Sensitive Information CVE-2019-10223, CVE-2019-17110, GHSA-2v6x-frw8-7r7f, GHSA-c92w-72c5-9x59, GO-2022-0621 | Medium | 1.8% | 18 May, 2021 | Go github.com/kubernetes/kube-state-metrics Go k8s.io/kube-state-metrics |
Path Traversal in MHolt Archiver CVE-2019-10743, GHSA-h74j-692g-48mq | Medium | 6.4% | 18 May, 2021 | Go github.com/mholt/archiver |
Kubernetes kubectl cp Vulnerable to Symlink Attack CVE-2019-11251, GHSA-6qfg-8799-r575, GO-2022-0802 | Medium | 2.6% | 18 May, 2021 | Go k8s.io/kubernetes |
Improper Locking in github.com/containers/storage CVE-2021-20291, GHSA-7qw8-847f-pggm, GO-2021-0100 | Medium | 1.6% | 10 May, 2021 | Go github.com/containers/storage |
Openshift Enterprise source-to-image vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2018-1103, GHSA-w55j-f7vx-6q37, GO-2020-0026 | Medium | 1.3% | 14 Apr, 2021 | Go github.com/openshift/source-to-image |
Privilege Escalation in fscrypt CVE-2018-6558, GHSA-qj26-7grj-whg3, GO-2020-0027 | Medium | 0.6% | 14 Apr, 2021 | Go github.com/google/fscrypt |
containers/image library Insufficiently Protects Credentials CVE-2019-10214, GHSA-85p9-j7c9-v4gr, GO-2021-0081 | Medium | 1.6% | 14 Apr, 2021 | Go github.com/containers/image |
Kubernetes client-go library logs may disclose credentials to unauthorized users CVE-2019-11250, GHSA-jmrx-5g74-6v2f, GO-2021-0065 | Medium | 1.8% | 14 Apr, 2021 | Go k8s.io/client-go Go k8s.io/kubernetes |
Excessive Platform Resource Consumption within a Loop in Kubernetes CVE-2019-11254, GHSA-wxc4-f4m6-wwqv, GO-2020-0036 | Medium | 3.2% | 14 Apr, 2021 | Go github.com/go-yaml/yaml Go gopkg.in/yaml.v2 |
Beego has a file creation race condition CVE-2019-16354, CVE-2019-16355, GHSA-f6px-w8rh-7r89, GHSA-hf4p-4j9r-3cvx, GO-2021-0084 | Medium | 0.4% | 14 Apr, 2021 | Go github.com/astaxie/beego Go github.com/beego/beego |
Cross-site Scripting in Documize CVE-2019-19619, GHSA-wmwp-pggc-h4mj, GO-2021-0086 | Medium | 1.2% | 14 Apr, 2021 | Go github.com/documize/community |
miekg/dns insecurely generates random numbers CVE-2019-19794, GHSA-44r7-7p62-q3fr, GO-2020-0008 | Medium | 2.1% | 14 Apr, 2021 | Go github.com/miekg/dns |
opencontainers runc contains procfs race condition with a shared volume mount CVE-2019-19921, GHSA-fh74-hm69-rqjw, GO-2021-0087 | Medium | 0.4% | 14 Apr, 2021 | Go github.com/opencontainers/runc |
gopkg.in/macaron.v1 Open Redirect vulnerability CVE-2020-12666, GHSA-733f-44f3-3frw, GO-2020-0039 | Medium | 1.4% | 14 Apr, 2021 | Go gopkg.in/macaron.v1 |
golang.org/x/text Infinite loop CVE-2020-14040, GHSA-5rcv-m4m3-hfh7, GO-2020-0015 | Medium | 1.9% | 14 Apr, 2021 | Go golang.org/x/text |
Denial of Service in TenderMint CVE-2020-15091, GHSA-6jqj-f58p-mrw3, GO-2021-0090 | Medium | 0.9% | 14 Apr, 2021 | Go github.com/tendermint/tendermint |
etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic BIT-etcd-2020-15106, BIT-etcd-2020-15112, CVE-2020-15106, CVE-2020-15112, GHSA-m332-53r6-2w93, GHSA-p4g4-wgrh-qrg2, GO-2020-0005 | Medium | 1.3% | 14 Apr, 2021 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
github.com/russellhaering/goxmldsig vulnerable to Signature Validation Bypass CVE-2020-15216, GHSA-q547-gmf8-8jr7, GO-2020-0050 | Medium | 0.9% | 14 Apr, 2021 | Go github.com/russellhaering/goxmldsig |
Denial of service in github.com/ethereum/go-ethereum CVE-2020-26264, GHSA-r33q-22hv-j29q, GO-2021-0063 | Medium | 1.9% | 14 Apr, 2021 | Go github.com/ethereum/go-ethereum |
dhowden tag panic due to out-of-bounds read CVE-2020-29242, CVE-2020-29243, CVE-2020-29244, CVE-2020-29245, GHSA-27mh-3343-6hg5, GHSA-9wm7-rc47-g56m, GHSA-9xm8-8qvc-vw3p, GHSA-wg79-2cgp-qrjm, GO-2021-0097 | Medium | 1.1% | 14 Apr, 2021 | Go github.com/dhowden/tag |
go-saml's XML Digital Signatures use SHA-1 CVE-2020-36563, GHSA-5rhg-xhgr-5hfj, GO-2020-0047 | Medium | 0.3% | 14 Apr, 2021 | Go github.com/RobotsAndPencils/go-saml |
Echo vulnerable to directory traversal CVE-2020-36565, GHSA-j453-hm5x-c46w, GO-2021-0051 | Medium | 1.4% | 14 Apr, 2021 | Go github.com/labstack/echo/v4 |
revel is vulnerable to resource exhaustion CVE-2020-36568, GHSA-hggr-p7v6-73p5, GO-2020-0003 | Medium | 1.6% | 14 Apr, 2021 | Go github.com/revel/revel |
Kubernetes Sensitive Information leak via Log File CVE-2020-8564, GHSA-8mjg-8c8g-6h85, GO-2021-0066 | Medium | 0.5% | 14 Apr, 2021 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Kubernetes client-go vulnerable to Sensitive Information Leak via Log File CVE-2020-8565, GHSA-8cfg-vx93-jvxw, GO-2021-0064 | Medium | 0.5% | 14 Apr, 2021 | Go k8s.io/client-go Go k8s.io/kubernetes |
YAML Go package vulnerable to denial of service CVE-2021-4235, GHSA-r88r-gmrh-7j83, GO-2021-0061 | Medium | 0.4% | 14 Apr, 2021 | Go github.com/go-yaml/yaml Go gopkg.in/yaml.v2 |
Information Exposure in Kubernetes CVE-2015-7528, GHSA-mqf3-28j7-3mj6, GO-2022-0857 | Medium | 2.1% | 11 Apr, 2016 | Go github.com/kubernetes/kubernetes |
Directory Traversal in Kubernetes CVE-2015-5305, GHSA-jp32-vmm6-3vf5, GO-2022-0701 | Medium | 1.8% | 06 Nov, 2015 | Go github.com/kubernetes/kubernetes Go k8s.io/kubernetes |
Denial of Service in OpenShift Origin CVE-2015-5250, GHSA-rf3m-mhv7-x39f, GO-2022-0875 | Medium | 2.0% | 08 Sep, 2015 | Go github.com/openshift/origin |
Arbitrary File Override in Docker Engine CVE-2015-3631, GHSA-v4h8-794j-g8mm, GO-2022-0708 | Medium | 0.6% | 18 May, 2015 | Go github.com/docker/docker |
Directory Traversal in Docker CVE-2014-9358, GHSA-qmmc-jppf-32wv, GO-2022-0705 | Medium | 2.5% | 16 Dec, 2014 | Go github.com/docker/docker |
Access Restriction Bypass in Docker CVE-2014-6408, GHSA-44gg-pmqr-4669, GO-2022-0625 | Medium | 3.1% | 12 Dec, 2014 | Go github.com/docker/docker |
Cross-site Scripting in Gogs CVE-2014-8683, GHSA-9hx4-qm7h-x84j, GO-2022-0642 | Medium | 1.9% | 21 Nov, 2014 | Go gogs.io/gogs |