Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos CVE-2023-4696, GHSA-j2gj-g3p9-7mrr, GO-2023-2038 | Critical | Not scored | 01 Sep, 2023 | Go github.com/usememos/memos |
KubePi Privilege Escalation vulnerability CVE-2023-37917, GHSA-757p-vx43-fp9r, GO-2023-1956 | Critical | Not scored | 21 Jul, 2023 | Go github.com/KubeOperator/kubepi |
CasaOS contains weak JWT secrets CVE-2023-37266, GHSA-m5q5-8mfw-p2hr, GO-2023-1931 | Critical | Not scored | 17 Jul, 2023 | Go github.com/IceWhaleTech/CasaOS |
CasaOS Gateway vulnerable to incorrect identification of source IP addresses CVE-2023-37265, GHSA-vjh7-5r6x-xh6g, GO-2023-1932 | Critical | Not scored | 17 Jul, 2023 | Go github.com/IceWhaleTech/CasaOS-Gateway |
Improper configuration of RBAC permissions obtaining cluster control permissions CVE-2023-33190, GHSA-74j8-w7f9-pp62 | Critical | Not scored | 30 Jun, 2023 | Go github.com/labring/sealos |
Grafana vulnerable to Authentication Bypass by Spoofing BIT-grafana-2023-3128, CVE-2023-3128, GHSA-gxh2-6vvc-rrgp, GHSA-mpv3-g8m3-3fjc | Critical | Not scored | 22 Jun, 2023 | Go github.com/grafana/grafana |
Silver vulnerable to MitM attack against implants due to a cryptography vulnerability CVE-2023-34758, CVE-2023-35170, GHSA-8jxm-xp43-qh3q, GO-2023-1866 | Critical | Not scored | 21 Jun, 2023 | Go github.com/bishopfox/sliver |
Rancher vulnerable to Privilege Escalation via manipulation of Secrets CVE-2023-22647, GHSA-p976-h52c-26p6 | Critical | Not scored | 06 Jun, 2023 | Go github.com/rancher/rancher |
Brook's tproxy server is vulnerable to a drive-by command injection. CVE-2023-33965, GHSA-vfrj-fv6p-3cpf | Critical | Not scored | 06 Jun, 2023 | Go github.com/txthinking/brook |
Signature validation bypass in github.com/moov-io/signedxml CVE-2023-34205, GHSA-jqvr-j2vg-gjrv, GO-2023-1826 | Critical | Not scored | 30 May, 2023 | Go github.com/moov-io/signedxml |
Pomerium vulnerable to Incorrect Authorization with specially crafted requests CVE-2023-33189, GHSA-pvrc-wvj2-f59p, GO-2023-1800 | Critical | Not scored | 26 May, 2023 | Go github.com/pomerium/pomerium |
Wings vulnerable to escape to host from installation container CVE-2023-32080, GHSA-p744-4q6p-hvc2, GO-2023-1768 | Critical | Not scored | 11 May, 2023 | Go github.com/pterodactyl/wings |
Rancher Webhook is misconfigured during upgrade process CVE-2023-22651, GHSA-6m9f-pj6w-w87g | Critical | Not scored | 24 Apr, 2023 | Go github.com/rancher/rancher |
IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication CVE-2023-26556, GHSA-3w84-4mjc-rjw7, GO-2023-1732 | Critical | Not scored | 21 Apr, 2023 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
Etcd-io Improper Authentication vulnerability BIT-etcd-2021-28235, CVE-2021-28235, GHSA-gmph-wf7j-9gcm | Critical | Not scored | 04 Apr, 2023 | Go go.etcd.io/etcd/v3 |
sjqzhang go-fastdfs vulnerable to path traversal CVE-2023-1800, GHSA-xq3x-grrj-fj6x, GO-2023-1713 | Critical | Not scored | 02 Apr, 2023 | Go github.com/sjqzhang/go-fastdfs |
Answer vulnerable to Authentication Bypass by Capture-replay CVE-2023-1537, GHSA-hwj7-frgj-7829, GO-2023-1659 | Critical | Not scored | 21 Mar, 2023 | Go github.com/answerdev/answer |
Ansible Semaphore mishandles authentication CVE-2023-28609, GHSA-pmhg-cmjc-3875 | Critical | Not scored | 18 Mar, 2023 | Go github.com/ansible-semaphore/semaphore |
Full authentication bypass if SASL authorization username is specified CVE-2023-27582, GHSA-4g76-w3xw-2x6w, GO-2023-1630 | Critical | Not scored | 14 Mar, 2023 | Go github.com/foxcpp/maddy |
Gogs OS Command Injection vulnerability CVE-2022-2024, GHSA-pfvh-p8qp-9ww9, GO-2023-1596 | Critical | Not scored | 28 Feb, 2023 | Go gogs.io/gogs |
Privilege escalation in MOSN CVE-2021-32163, GHSA-5vx9-j5cw-47vq, GO-2023-1582 | Critical | Not scored | 17 Feb, 2023 | Go mosn.io/mosn |
Users with any cluster secret update access may update out-of-bounds cluster secrets CVE-2023-23947, GHSA-3jfq-742w-xg8j, GO-2023-1577 | Critical | Not scored | 16 Feb, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system CVE-2023-25168, GHSA-66p8-j459-rq63, GO-2023-1555 | Critical | Not scored | 10 Feb, 2023 | Go github.com/pterodactyl/wings |
Cross-site scripting vulnerability found in answerdev/answer CVE-2023-0740, GHSA-65px-4cpf-697r, GO-2023-1541 | Critical | Not scored | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer has Cross-site Scripting vulnerability CVE-2023-0741, GHSA-p7wj-c85f-xq9h, GO-2023-1552 | Critical | Not scored | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer contains Cross-site Scripting vulnerability CVE-2023-0742, GHSA-rmw8-7823-wp7f, GO-2023-1554 | Critical | Not scored | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer subject to Cross-site Scripting vulnerability CVE-2023-0743, GHSA-hjmr-xm25-36mh, GO-2023-1551 | Critical | Not scored | 08 Feb, 2023 | Go github.com/answerdev/answer |
Answer contains Improper Access Control vulnerability CVE-2023-0744, GHSA-4cwh-8w4g-jxxh, GO-2023-1550 | Critical | Not scored | 08 Feb, 2023 | Go github.com/answerdev/answer |
JWT audience claim is not verified CVE-2023-22482, GHSA-q9hr-j4rf-8fjc, GO-2023-1520 | Critical | Not scored | 25 Jan, 2023 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Squalor SQL Injection vulnerability CVE-2020-36645, GHSA-3hc7-2xcc-7p8f, GO-2023-1295 | Critical | Not scored | 07 Jan, 2023 | Go github.com/square/squalor |
gosqljson SQL Injection vulnerability CVE-2014-125064, GHSA-g7mw-9pf9-p2pm, GO-2023-1494 | Critical | Not scored | 07 Jan, 2023 | Go github.com/elgs/gosqljson |
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys CVE-2023-22463, GHSA-vjhf-8vqx-vqpq, GO-2023-1283 | Critical | Not scored | 06 Jan, 2023 | Go github.com/KubeOperator/kubepi |
usememos/memos Cross-site Scripting vulnerability CVE-2022-4865, GHSA-8w5q-5fpq-v4pm | Critical | Not scored | 31 Dec, 2022 | Go github.com/usememos/memos |
usememos/memos vulnerable to Cross-site Scripting CVE-2022-4866, GHSA-x9p9-v3x6-68mq | Critical | Not scored | 31 Dec, 2022 | Go github.com/usememos/memos |
mellium.im/sasl authentication failure due to insufficient nonce randomness CVE-2022-48195, GHSA-gvfj-fxx3-j323, GO-2023-1268 | Critical | Not scored | 31 Dec, 2022 | Go mellium.im/sasl |
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability CVE-2022-4686, GHSA-68gw-r2x5-7r5r, GO-2022-1215 | Critical | Not scored | 23 Dec, 2022 | Go github.com/usememos/memos |
Collision of hash values in github.com/bnb-chain/tss-lib CVE-2022-47931, GHSA-cvcx-g7wh-x8rf, GO-2023-1904 | Critical | Not scored | 23 Dec, 2022 | Go github.com/binance-chain/tss-lib Go github.com/bnb-chain/tss-lib |
docconv OS Command Injection vulnerability CVE-2022-4643, GHSA-6m4h-hfpp-x8cx, GO-2022-1184 | Critical | Not scored | 22 Dec, 2022 | Go code.sajari.com/docconv Go github.com/sajari/docconv |
Alist vulnerable to Path Traversal CVE-2022-45969, GHSA-pmg2-rph8-p8r6, GO-2022-1171 | Critical | Not scored | 16 Dec, 2022 | Go github.com/alist-org/alist Go github.com/alist-org/alist/v3 |
owncast is vulnerable to SQL Injection CVE-2022-3751, GHSA-cvh4-cjc9-84qm, GO-2022-1138 | Critical | Not scored | 29 Nov, 2022 | Go github.com/owncast/owncast |
crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication CVE-2022-41912, GHSA-j2jp-wvqg-wc2g, GO-2022-1129 | Critical | Not scored | 29 Nov, 2022 | Go github.com/crewjam/saml |
KubeView vulnerable to full cluster takeover due to improper authentication CVE-2022-45933, GHSA-22vc-5pgw-644q | Critical | Not scored | 27 Nov, 2022 | Go github.com/benc-uk/kubeview |
Tailscale Windows daemon is vulnerable to RCE via CSRF CVE-2022-41924, GHSA-vqp6-rc3h-83cp, GO-2022-1120 | Critical | Not scored | 21 Nov, 2022 | Go tailscale.com |
Vela Insecure Defaults CVE-2022-39395, GHSA-2w78-ffv6-p46w, GHSA-5m7g-pj8w-7593, GHSA-xf39-98m2-889v, GO-2022-1100 | Critical | Not scored | 09 Nov, 2022 | Go github.com/go-vela/server Go github.com/go-vela/worker |
btcd mishandles witness size checking CVE-2022-44797, GHSA-2chg-86hq-7w38, GO-2022-1098 | Critical | Not scored | 07 Nov, 2022 | Go github.com/btcsuite/btcd Go github.com/lightningnetwork/lnd |
TiDB vulnerable to Use of Externally-Controlled Format String CVE-2022-3023, GHSA-7fxj-fr3v-r9gj | Critical | Not scored | 04 Nov, 2022 | Go github.com/pingcap/tidb |
Gin-vue-admin subject to Remote Code Execution via file upload vulnerability CVE-2022-39345, GHSA-7gc4-r5jr-9hxv | Critical | Not scored | 25 Oct, 2022 | Go github.com/flipped-aurora/gin-vue-admin/server |
Skipper vulnerable to SSRF via X-Skipper-Proxy CVE-2022-38580, GHSA-f2rj-m42r-6jm2, GO-2022-1086 | Critical | Not scored | 25 Oct, 2022 | Go github.com/zalando/skipper |
Gitea vulnerable to Argument Injection BIT-gitea-2022-42968, CVE-2022-42968, GHSA-w8xw-7crf-h23x, GO-2022-1065 | Critical | Not scored | 16 Oct, 2022 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Gogs vulnerable to Cross-site Scripting CVE-2022-32174, GHSA-mcjj-2fvq-mc3r, GO-2022-1060 | Critical | Not scored | 11 Oct, 2022 | Go gogs.io/gogs |