Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Gitea vulnerable to Argument Injection BIT-gitea-2022-42968, CVE-2022-42968, GHSA-w8xw-7crf-h23x, GO-2022-1065 | Critical | 1.4% | 16 Oct, 2022 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Remote denial of service in Hyperledger Fabric Gateway BIT-hyperledger-fabric-orderer-2022-36023, BIT-hyperledger-fabric-peer-2022-36023, BIT-hyperledger-fabric-tools-2022-36023, CVE-2022-36023, GHSA-qj6r-fhrc-jj5r | High | 1.2% | 13 Oct, 2022 | Go github.com/hyperledger/fabric |
Nomad Panics On Job Submission With Bad Artifact Stanza Source URL CVE-2022-41606, GHSA-7v3g-4878-5qrf, GO-2022-1062 | Medium | 0.9% | 12 Oct, 2022 | Go github.com/hashicorp/nomad |
Gogs vulnerable to Cross-site Scripting CVE-2022-32174, GHSA-mcjj-2fvq-mc3r, GO-2022-1060 | Critical | 58.2% | 11 Oct, 2022 | Go gogs.io/gogs |
AdGuardHome vulnerable to Cross-Site Request Forgery CVE-2022-32175, GHSA-mwwc-3jv2-62j3 | Medium | 0.3% | 11 Oct, 2022 | Go github.com/AdguardTeam/AdGuardHome |
golang.org/x/text/language Denial of service via crafted Accept-Language header CVE-2022-32149, GHSA-69ch-w2m2-3vjp, GO-2022-1059 | High | 1.8% | 11 Oct, 2022 | Go golang.org/x/text |
Traefik HTTP/2 connections management could cause a denial of service CVE-2022-39271, GHSA-c6hx-pjc3-7fqr | High | 1.4% | 10 Oct, 2022 | Go github.com/traefik/traefik/v2 |
Blst vulnerable to incorrect results for some inputs in blst_fp_eucl_inverse function GHSA-x279-68rr-jp4p, GO-2022-1053 | Medium | Not scored | 07 Oct, 2022 | Go github.com/supranational/blst |
Tendermint Core vulnerable to Uncontrolled Resource Consumption CVE-2021-21271, GHSA-p658-8693-mhvg, GO-2022-1052 | Medium | 1.8% | 07 Oct, 2022 | Go github.com/tendermint/tendermint |
etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery GHSA-9gp7-6833-wv89 | Low | Not scored | 06 Oct, 2022 | Go go.etcd.io/etcd/client/v3 |
etcd user credentials are stored in WAL logs in plaintext GHSA-528j-9r78-wffx | Low | Not scored | 06 Oct, 2022 | Go go.etcd.io/etcd/client/v3 |
etcd has no minimum password length CVE-2020-15115, GHSA-4993-m7g5-r9hh | Medium | 1.3% | 06 Oct, 2022 | Go go.etcd.io/etcd/client/v3 |
etcd vulnerable to TOCTOU of gateway endpoint authentication GHSA-h8g9-6gvh-5mrc | Low | Not scored | 06 Oct, 2022 | Go go.etcd.io/etcd/v3 |
SIF's Digital Signature Hash Algorithms Not Validated CVE-2022-39237, GHSA-m5m3-46gj-wch8, GO-2022-1045 | Medium | 0.7% | 06 Oct, 2022 | Go github.com/sylabs/sif/v2 |
Incorrect sanitization of forwarded query parameters in net/http/httputil BIT-golang-2022-2880, CVE-2022-2880, GO-2022-1038 | 1.4% | 06 Oct, 2022 | Go stdlib | |
Memory exhaustion when compiling regular expressions in regexp/syntax BIT-golang-2022-41715, CVE-2022-41715, GO-2022-1039 | 1.7% | 06 Oct, 2022 | Go stdlib | |
Unbounded memory consumption when reading headers in archive/tar BIT-golang-2022-2879, CVE-2022-2879, GO-2022-1037 | 2.0% | 06 Oct, 2022 | Go stdlib | |
FlyteAdmin's Default OAuth Authorization Server secret must be rotated CVE-2022-39273, GHSA-67x4-qr35-qvrm, GO-2022-1043 | High | 0.9% | 05 Oct, 2022 | Go github.com/flyteorg/flyteadmin |
Dapr Dashboard vulnerable to Incorrect Access Control CVE-2022-38817, GHSA-2w6m-q946-399r, GO-2022-1033 | High | 3.9% | 04 Oct, 2022 | Go github.com/dapr/dashboard |
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code CVE-2022-39222, GHSA-vh7g-p26c-j2cw | Critical | 1.6% | 03 Oct, 2022 | Go github.com/dexidp/dex |
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package CVE-2022-2529, GHSA-9rpw-2h95-666c, GO-2022-1032 | High | 1.0% | 01 Oct, 2022 | Go github.com/cloudflare/goflow Go github.com/cloudflare/goflow/v3 |
Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload CVE-2022-40931, GHSA-pwq7-f7f9-cm2j | Medium | 0.6% | 30 Sep, 2022 | Go github.com/dutchcoders/transfer.sh |
go-resolver's DNSSEC validation not performed correctly CVE-2022-3347, GHSA-jr65-gpj5-cw74, GO-2022-1026 | High | 0.3% | 29 Sep, 2022 | Go github.com/peterzen/goresolver |
go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs CVE-2022-3346, GHSA-87mm-qxm5-cp3f, GO-2022-0979 | High | 0.2% | 29 Sep, 2022 | Go github.com/peterzen/goresolver |
Bytebase does not restrict low privilege user to access admin issues CVE-2022-32169, GHSA-5rc4-v5mj-g8c4 | Medium | 0.7% | 29 Sep, 2022 | Go github.com/bytebase/bytebase |
Bytebase allows low-privilege users to view admin projects CVE-2022-32170, GHSA-9mmc-27gw-w6mq | Medium | 0.7% | 29 Sep, 2022 | Go github.com/bytebase/bytebase |
Hertz contains path traversal via normalizePath function CVE-2022-40082, GHSA-c9qr-f6c8-rgxf, GO-2022-1027 | High | 1.1% | 29 Sep, 2022 | Go github.com/cloudwego/hertz |
Labstack Echo Open Redirect vulnerability CVE-2022-40083, GHSA-crxj-hrmp-4rwf, GO-2022-1031 | Critical | 3.2% | 29 Sep, 2022 | Go github.com/labstack/echo/v4 |
Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication CVE-2022-39219, GHSA-p6fh-xc6r-g5hw, GO-2022-1023 | High | 1.2% | 27 Sep, 2022 | Go github.com/brokercap/Bifrost |
HashiCorp Consul vulnerable to authorization bypass BIT-consul-2022-40716, CVE-2022-40716, GHSA-m69r-9g56-7mv8, GO-2022-1029 | Medium | 1.1% | 25 Sep, 2022 | Go github.com/hashicorp/consul |
Hyperledger Fabric subject to Denial of Service via non-validated request CVE-2022-35253, GHSA-9w7j-q3xw-p9vh | High | Not scored | 25 Sep, 2022 | Go github.com/hyperledger/fabric |
Mattermost subject to Denial of Service via upload of special GIF BIT-mattermost-2022-3257, CVE-2022-3257, GHSA-m7w4-q5vg-5xfp | Medium | 1.3% | 25 Sep, 2022 | Go github.com/mattermost/mattermost-server/v6 |
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions BIT-consul-2021-41803, CVE-2021-41803, GHSA-hr3v-8cp3-68rf, GO-2024-2683 | High | 1.1% | 25 Sep, 2022 | Go github.com/hashicorp/consul |
Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library GHSA-gmhj-xjfh-cf6m | High | Not scored | 23 Sep, 2022 | Go github.com/mohammed90/caddy-ssh |
Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials CVE-2021-36782, GHSA-g7j7-h4q8-8w2f | Critical | 4.2% | 23 Sep, 2022 | Go github.com/rancher/rancher |
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete GHSA-28q9-9c3g-v3f9, GO-2022-1019 | High | Not scored | 23 Sep, 2022 | Go github.com/treeverse/lakefs |
HashiCorp Vault vulnerable to incorrect metadata access BIT-vault-2022-40186, CVE-2022-40186, GHSA-7cgv-v83v-rr87, GO-2022-1021 | Critical | 1.0% | 23 Sep, 2022 | Go github.com/hashicorp/vault |
Grafana folders admin only permission privilege escalation BIT-grafana-2022-36062, CVE-2022-36062, GHSA-p978-56hq-r492, GO-2024-2854 | High | 0.7% | 22 Sep, 2022 | Go github.com/grafana/grafana |
Cross site scripting in Cloudreve CVE-2022-32167, GHSA-fg25-gq9g-32mx | Medium | 0.6% | 21 Sep, 2022 | Go github.com/HFO4/cloudreve Go github.com/cloudreve/Cloudreve/v3 |
SFTPGo WebClient vulnerable to Cross-site Scripting CVE-2022-39220, GHSA-cf7g-cm7q-rq7f, GO-2022-1015 | Medium | 0.6% | 20 Sep, 2022 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure CVE-2022-2995, GHSA-phjr-8j92-w5v7, GO-2022-1014 | High | 0.4% | 20 Sep, 2022 | Go github.com/cri-o/cri-o |
Elrond-go has improper initialization CVE-2022-36061, GHSA-mv8x-668m-53fg, GO-2022-0971 | Critical | 1.3% | 16 Sep, 2022 | Go github.com/ElrondNetwork/elrond-go |
SFTPGo vulnerable to recovery codes abuse CVE-2022-36071, GHSA-54qx-8p8w-xhg8, GO-2022-0964 | High | 0.5% | 16 Sep, 2022 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions CVE-2022-36109, GHSA-rc4r-wh2q-q6c4, GO-2022-0985 | Medium | 1.1% | 16 Sep, 2022 | Go github.com/docker/docker |
Go-CVSS has Out-of-bounds Read vulnerability in ParseVector function CVE-2022-39213, GHSA-xhmf-mmv2-4hhx, GO-2022-1002 | High | 1.7% | 16 Sep, 2022 | Go github.com/pandatix/go-cvss |
Harbor fails to validate the user permissions when updating a robot account BIT-harbor-2022-31667, CVE-2022-31667, GHSA-xx9w-464f-7h6f | Medium | 0.5% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Harbor fails to validate the user permissions when updating tag immutability policies BIT-harbor-2022-31669, CVE-2022-31669, GHSA-8c6p-v837-77f6 | Medium | 0.4% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Harbor fails to validate the user permissions when viewing Webhook policies BIT-harbor-2022-31666, CVE-2022-31666, GHSA-8hwq-5f22-jfr3, GHSA-jf8p-3vjh-pq94 | High | 0.5% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Harbor fails to validate the user permissions when updating tag retention policies BIT-harbor-2022-31670, CVE-2022-31670, GHSA-3637-v6vq-xqqw | High | 0.5% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature BIT-cosign-2022-36056, CVE-2022-36056, GHSA-8gw7-4j42-w388, GO-2022-0998 | Medium | 0.1% | 16 Sep, 2022 | Go github.com/sigstore/cosign |