Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Improper path handling in Kustomization files allows for denial of service BIT-flux-2022-24878, BIT-kustomize-2022-24878, CVE-2022-24878, GHSA-7pwf-jg34-hxwp, GO-2022-0448 | High | 1.0% | 20 May, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/kustomize-controller |
Out of bounds memory access in github.com/open-policy-agent/opa CVE-2022-28946, GHSA-x7f3-62pm-9p38, GO-2022-0587 | High | 1.0% | 20 May, 2022 | Go github.com/open-policy-agent/opa |
gopkg.in/yaml.v3 Denial of Service CVE-2022-28948, GHSA-hp87-p4gw-j4gq, GO-2022-0603 | High | 4.0% | 20 May, 2022 | Go gopkg.in/yaml.v3 |
Panic due to crafted inputs in archive/zip BIT-golang-2021-39293, CVE-2021-39293, GO-2022-0273 | 6.9% | 18 May, 2022 | Go stdlib | |
Misdirected I/O in syscall BIT-golang-2021-44717, CVE-2021-44717, GO-2022-0289 | 2.0% | 18 May, 2022 | Go stdlib | |
HashiCorp Vault improper configuration of multi factor authentication BIT-vault-2022-30689, CVE-2022-30689, GHSA-c5wc-v287-82pc, GO-2022-0590 | Medium | 1.2% | 18 May, 2022 | Go github.com/hashicorp/vault |
Shell command injection in gitea BIT-gitea-2022-30781, CVE-2022-30781, GHSA-p5f9-c9j9-g8qx, GO-2022-0450 | High | 87.9% | 17 May, 2022 | Go code.gitea.io/gitea |
Improper kubeconfig validation allows arbitrary code execution BIT-flux-2022-24817, BIT-kustomize-2022-24817, CVE-2022-24817, GHSA-vvmq-fwmg-2gjc | Critical | 1.1% | 16 May, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/helm-controller Go github.com/fluxcd/kustomize-controller |
HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG CVE-2018-9057, GHSA-r48h-jr2j-9g78 | Critical | 1.9% | 14 May, 2022 | Go github.com/hashicorp/terraform-provider-aws |
Gogs Directory Traversal CVE-2018-20303, GHSA-9hxg-w7qf-hh93 | High | 3.3% | 14 May, 2022 | Go gogs.io/gogs |
HashiCorp Consul can use cleartext agent-to-agent RPC communication CVE-2018-19653, GHSA-4qvx-qq5w-695p, GO-2023-1850 | Medium | 1.2% | 14 May, 2022 | Go github.com/hashicorp/consul |
Helm Path Traversal CVE-2019-1000008, GHSA-xrxm-mvqm-r553, GO-2023-1948 | Medium | 1.5% | 14 May, 2022 | Go helm.sh/helm |
Hydra has Reflected XSS via error_hint parameter CVE-2019-8400, GHSA-7v6r-w4r6-mhch, GO-2026-4861 | Medium | 1.3% | 14 May, 2022 | Go github.com/ory/hydra |
github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error CVE-2018-20744, GHSA-927h-x4qj-r242, GO-2023-1792 | Medium | 0.7% | 14 May, 2022 | Go github.com/gofiber/fiber/v2 Go github.com/rs/cors |
HashiCorp Consul vulnerable to Origin Validation Error CVE-2019-9764, GHSA-q7fx-wm2p-qfj8, GO-2023-1853 | High | 0.6% | 13 May, 2022 | Go github.com/hashicorp/consul |
HashiCorp Consul Access Restriction Bypass CVE-2019-8336, GHSA-fhm8-cxcv-pwvc, GO-2023-1945 | High | 1.3% | 13 May, 2022 | Go github.com/hashicorp/consul |
Gitea Arbitrary File Delete Vulnerability CVE-2019-1000002, GHSA-j99q-rwp6-498g | Medium | 1.1% | 13 May, 2022 | Go code.gitea.io/gitea |
Kubernetes DoS Vulnerability CVE-2019-1002100, GHSA-q4rr-64r9-fwgf, GO-2023-1946 | Medium | 16.9% | 13 May, 2022 | Go k8s.io/kubernetes |
Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them CVE-2019-6287, GHSA-6r7x-4q7g-h83j, GO-2024-2764 | High | 1.0% | 13 May, 2022 | Go github.com/rancher/rancher |
Improper Input Validation in k8s.io/ingress-nginx CVE-2021-25745, GHSA-pvmg-xgmx-9mxh | High | 1.2% | 07 May, 2022 | Go k8s.io/ingress-nginx |
Improper path handling in kustomization files allows path traversal BIT-flux-2022-24877, BIT-kustomize-2022-24877, CVE-2022-24877, GHSA-j77r-2fxf-5jrw, GO-2022-0447 | Critical | 1.2% | 04 May, 2022 | Go github.com/fluxcd/flux2 Go github.com/fluxcd/kustomize-controller |
Arbitrary file deletion in gitea BIT-gitea-2022-27313, CVE-2022-27313, GHSA-g7p7-x6w7-w6qg, GO-2022-0442 | High | 1.0% | 04 May, 2022 | Go code.gitea.io/gitea |
ProxyScotch is vulnerable to a server-side Request Forgery (SSRF) CVE-2022-25850, GHSA-5hjh-c26m-xw8w, SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228 | High | 1.4% | 03 May, 2022 | Go github.com/hoppscotch/proxyscotch |
Privilege escalation for users with create/update permissions in Global Roles in Rancher CVE-2021-36784, GHSA-jwvr-vv7p-gpwq | Medium | 0.9% | 02 May, 2022 | Go github.com/rancher/rancher |
Exposure of repository credentials to external third-party sources in Rancher CVE-2021-36778, GHSA-4fc7-hc63-7fjg | High | 0.8% | 02 May, 2022 | Go github.com/rancher/rancher |
Write access to the catalog for any user when restricted-admin role is enabled in Rancher CVE-2021-4200, GHSA-hx8w-ghh8-r4xf | High | 0.6% | 02 May, 2022 | Go github.com/rancher/rancher |
Podman publishes a malicious image to public registries CVE-2022-1227, GHSA-66vw-v2x9-hw75, GO-2022-0558 | High | 4.2% | 30 Apr, 2022 | Go github.com/containers/podman/v3 Go github.com/containers/psgo |
Woodpecker allows cross-site scripting (XSS) via build logs CVE-2022-29947, GHSA-vmp5-c5hp-6c65, GO-2022-0440 | Medium | 0.7% | 30 Apr, 2022 | Go github.com/woodpecker-ci/woodpecker |
Insertion of Sensitive Information into Log File in Hashicorp go-getter CVE-2022-29810, GHSA-27rq-4943-qcwp, GO-2022-0438 | Medium | 0.4% | 28 Apr, 2022 | Go github.com/hashicorp/go-getter |
Exposure of SSH credentials in Rancher/Fleet GHSA-wm2r-rp98-8pmh | Low | Not scored | 27 Apr, 2022 | Go github.com/rancher/rancher |
http-swagger XSS via PUT requests CVE-2022-24863, CVE-2024-25712, GHSA-49w7-5r33-jm9m, GHSA-xg75-q3q5-cqmv, GO-2022-0427 | High | 2.4% | 22 Apr, 2022 | Go github.com/swaggo/http-swagger |
Incorrect Default Permissions in CRI-O CVE-2022-27652, GHSA-4hj2-r2pm-3hc6, GO-2022-0426 | Medium | 0.2% | 22 Apr, 2022 | Go github.com/cri-o/cri-o |
Git LFS can execute a binary from the current directory on Windows BIT-git-lfs-2022-24826, CVE-2022-24826, GHSA-6rw3-3whw-jvjj | Critical | 2.2% | 22 Apr, 2022 | Go github.com/git-lfs/git-lfs Go github.com/git-lfs/git-lfs/v3 |
Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector BIT-consul-2022-29153, CVE-2022-29153, GHSA-q6h7-4qgw-2j9p, GO-2022-0615 | High | 8.7% | 20 Apr, 2022 | Go github.com/hashicorp/consul |
Insecure plugin handling in Mattermost BIT-mattermost-2022-1384, CVE-2022-1384, GHSA-32rp-q37p-jg6w, GO-2022-0576 | High | 0.7% | 20 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Improper Control of a Resource Through its Lifetime in Mattermost BIT-mattermost-2022-1385, CVE-2022-1385, GHSA-fxwj-v664-wv5g, GO-2022-0599 | Medium | 0.8% | 20 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Improper Privilege Management in Mattermost BIT-mattermost-2022-1332, CVE-2022-1332, GHSA-qggc-pj29-j27m, GO-2022-0616 | Medium | 0.7% | 14 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Resource exhaustion in Mattermost BIT-mattermost-2022-1337, CVE-2022-1337, GHSA-f37q-q7p2-ccfc, GO-2022-0595 | Medium | 0.9% | 14 Apr, 2022 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 |
Daemon panics when processing certain blocks GHSA-mcq2-w56r-5w2w | High | Not scored | 08 Apr, 2022 | Go github.com/ipld/go-ipfs |
Duplicate Advisory: go-codec-dagpb vulnerable to panic when decoding invalid blocks CVE-2022-2584, GHSA-967g-cjx4-h7j6, GHSA-g3vv-g2j5-45f2, GO-2022-0422 | High | 0.8% | 08 Apr, 2022 | Go github.com/ipld/go-codec-dagpb |
Smokescreen SSRF via deny list bypass CVE-2022-24825, GHSA-gcj7-j438-hjj2, GO-2022-0429 | Medium | 0.9% | 07 Apr, 2022 | Go github.com/stripe/smokescreen |
Privilege escalation in beego CVE-2021-27116, GHSA-ffjp-66mx-3qpj | High | 0.4% | 06 Apr, 2022 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
Privilege escalation in beego CVE-2021-27117, GHSA-2v6v-q994-xvxx | High | 0.4% | 06 Apr, 2022 | Go github.com/beego/beego Go github.com/beego/beego/v2 |
Access control bypass in Beego CVE-2021-30080, GHSA-28r6-jm5h-mrgg, GO-2022-0572 | High | 1.3% | 06 Apr, 2022 | Go github.com/astaxie/beego Go github.com/beego/beego Go github.com/beego/beego/v2 |
Opened exploitable ports in default docker-compose.yaml in go-ipfs GHSA-fx5p-f64h-93xc, GO-2022-0418 | Medium | Not scored | 04 Apr, 2022 | Go github.com/ipfs/go-ipfs |
Podman's default inheritable capabilities for linux container not empty CVE-2022-27649, GHSA-qvf8-p83w-v58j, GO-2022-0416 | High | 1.4% | 01 Apr, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 |
Command Injection Vulnerability with Mercurial in VCS CVE-2022-21235, GHSA-6635-c626-vj4r, GO-2022-0414, SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078 | Critical | 1.6% | 01 Apr, 2022 | Go github.com/Masterminds/vcs |
Non-empty default inheritable capabilities for linux container in Buildah CVE-2022-27651, GHSA-c3g4-w6cv-6v7h, GO-2022-0417 | Medium | 1.3% | 01 Apr, 2022 | Go github.com/containers/buildah |
Incorrect Authorization in imgcrypt CVE-2022-24778, GHSA-8v99-48m9-c8pm, GO-2021-0412 | High | 2.7% | 28 Mar, 2022 | Go github.com/containerd/imgcrypt |
Unrestricted Upload of File with Dangerous Type in Gogs CVE-2022-0415, GHSA-5gjh-5j4f-cpwv, GO-2022-0554 | High | 65.9% | 28 Mar, 2022 | Go gogs.io/gogs |