Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Duplicate Advisory: GoBase Race Condition vulnerability CVE-2022-2583, GHSA-4348-x292-h437, GHSA-h2x7-2ff6-v32p, GO-2022-0400 | Low | 0.4% | 11 Feb, 2022 | Go github.com/ntbosscher/gobase |
Git LFS can execute a Git binary from the current directory BIT-git-lfs-2020-27955, CVE-2020-27955, GHSA-4g4p-42wc-9f3m | Critical | 82.3% | 11 Feb, 2022 | Go github.com/git-lfs/git-lfs |
personnummer/go vulnerable to Improper Input Validation GHSA-hv53-vf5m-8q94 | Low | Not scored | 11 Feb, 2022 | Go github.com/personnummer/go |
containerd v1.2.x can be coerced into leaking credentials during image pull CVE-2020-15157, GHSA-742w-89gc-8m9c, GO-2022-0803 | Medium | 2.3% | 11 Feb, 2022 | Go github.com/containerd/containerd |
CBC padding oracle issue in AWS S3 Crypto SDK for golang CVE-2020-8911, GHSA-f5pg-7wfw-84q9, GO-2022-0646 | Medium | 0.3% | 11 Feb, 2022 | Go github.com/aws/aws-sdk-go |
AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field CVE-2022-2582, GHSA-6jvc-q2x7-pchv, GHSA-76wf-9vgp-pj7w, GO-2022-0391 | Medium | 0.5% | 11 Feb, 2022 | Go github.com/aws/aws-sdk-go |
In-band key negotiation issue in AWS S3 Crypto SDK for golang CVE-2020-8912, GHSA-7f33-f4f5-xwgw, GO-2022-0635 | Low | 0.2% | 11 Feb, 2022 | Go github.com/aws/aws-sdk-go |
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header CVE-2020-15129, GHSA-6qq8-5wq3-86rp | Medium | 8.0% | 11 Feb, 2022 | Go github.com/containous/traefik Go github.com/containous/traefik/api Go github.com/containous/traefik/v2 Go github.com/containous/traefik/v2/pkg/api +4 more |
Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030) CVE-2019-19030, GHSA-q9x4-q76f-5h5j, GO-2022-0704 | Medium | 2.0% | 11 Feb, 2022 | Go github.com/goharbor/harbor |
Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788) BIT-harbor-2020-13788, CVE-2020-13788, GHSA-33p6-fx42-7rf5, GO-2022-0781 | Low | 1.3% | 11 Feb, 2022 | Go github.com/goharbor/harbor |
Incorrect Permission Assignment for Critical Resource in CRI-O CVE-2022-0532, GHSA-jqmc-79gx-7g8p, GO-2022-0608 | Medium | 0.8% | 11 Feb, 2022 | Go github.com/cri-o/cri-o |
Cross-site Scripting in Gitea BIT-gitea-2021-45329, CVE-2021-45329, GHSA-r3gq-wxqf-q4gh, GO-2022-0314 | Medium | 0.8% | 10 Feb, 2022 | Go github.com/go-gitea/gitea |
Reuse of one time passwords allowed in Gitea BIT-gitea-2021-45331, CVE-2021-45331, GHSA-hfmf-q69j-6m5p, GO-2022-0315 | Critical | 1.4% | 10 Feb, 2022 | Go code.gitea.io/gitea |
Improper Privilege Management in Gitea BIT-gitea-2021-45330, CVE-2021-45330, GHSA-pg38-r834-g45j, GO-2022-0982 | Critical | 1.4% | 10 Feb, 2022 | Go code.gitea.io/gitea |
User object created with invalid provider data in GoTrue GHSA-wpfr-6297-9v57, GO-2022-0365 | Medium | Not scored | 09 Feb, 2022 | Go github.com/netlify/gotrue |
Incorrect Calculation in github.com/open-policy-agent/opa CVE-2022-23628, GHSA-hcw3-j74m-qc58, GO-2022-0316 | Medium | 1.0% | 09 Feb, 2022 | Go github.com/open-policy-agent/opa |
Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers CVE-2020-14359, GHSA-jh6m-3pqw-242h | High | 0.9% | 09 Feb, 2022 | Go github.com/keycloak/keycloak-gatekeeper |
Gitea displaying raw OpenID error in UI BIT-gitea-2021-45325, CVE-2021-45325, GHSA-8h8p-x289-vvqr, GO-2022-0308 | Medium | 1.0% | 09 Feb, 2022 | Go github.com/go-gitea/gitea |
Cross Site Request Forgery in Gitea BIT-gitea-2021-45326, CVE-2021-45326, GHSA-4wp3-8q92-mh8w, GO-2022-0309 | High | 0.6% | 09 Feb, 2022 | Go github.com/go-gitea/gitea |
Capture-replay in Gitea BIT-gitea-2021-45327, CVE-2021-45327, GHSA-jrpg-35hw-m4p9, GO-2022-0310 | Critical | 2.1% | 09 Feb, 2022 | Go code.gitea.io/gitea Go github.com/go-gitea/gitea |
Open redirect in Gitea BIT-gitea-2021-45328, CVE-2021-45328, GHSA-36h2-95gj-w488, GO-2022-0579 | Medium | 1.0% | 09 Feb, 2022 | Go github.com/go-gitea/gitea |
Unverified Ownership in Kubernetes CVE-2020-8554, GHSA-j9wf-vvm6-4r9w | Medium | 8.7% | 08 Feb, 2022 | Go k8s.io/kubernetes |
OCI Manifest Type Confusion Issue GHSA-qq97-vm5h-rrhg, GO-2022-0379 | Low | Not scored | 08 Feb, 2022 | Go github.com/docker/distribution |
Incorrect Authorization in NATS nats-server BIT-nats-2022-24450, CVE-2022-24450, GHSA-g6w6-r76c-28j7, GO-2022-0307 | High | 1.3% | 08 Feb, 2022 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 Go github.com/nats-io/nats-streaming-server |
Limited ability to spoof SAML authentication with missing audience verification in Fleet CVE-2022-23600, GHSA-ch68-7cf4-35vr | Medium | 0.9% | 07 Feb, 2022 | Go github.com/fleetdm/fleet/v4 |
Path traversal and dereference of symlinks in Argo CD CVE-2022-24348, GHSA-63qx-x74g-jcr7, GO-2022-0304 | High | 2.8% | 07 Feb, 2022 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Server-Side Request Forgery in Apache Traffic Control CVE-2022-23206, GHSA-wp47-9r3h-xfgq, GO-2022-0585 | High | 2.0% | 07 Feb, 2022 | Go github.com/apache/trafficcontrol |
Cross-Site Request Forgery in Filebrowser CVE-2021-46398, GHSA-72wf-hwcq-65h9, GO-2022-0563 | High | 6.7% | 05 Feb, 2022 | Go github.com/filebrowser/filebrowser/v2 |
Potential proxy IP restriction bypass in Kubernetes CVE-2020-8562, GHSA-qh36-44jv-c8xj, GO-2022-0617 | Low | 1.2% | 02 Feb, 2022 | Go k8s.io/kubernetes |
Command injection in gh-ost CVE-2022-21687, GHSA-rrp4-2xx3-mv29, GO-2022-0298 | Medium | 1.0% | 01 Feb, 2022 | Go github.com/github/gh-ost |
Go-Attestation Improper Input Validation with attacker-controlled TPM Quote CVE-2022-0317, GHSA-99cg-575x-774p, GO-2022-0294 | Medium | 0.1% | 01 Feb, 2022 | Go github.com/google/go-attestation |
SQL Injection in Casdoor CVE-2022-24124, GHSA-m358-g4rp-533r, GO-2022-0303, PYSEC-2022-43189 | High | 55.3% | 29 Jan, 2022 | Go github.com/casdoor/casdoor PyPI casdoor |
SQL injection in github.com/navidrome/navidrome CVE-2022-23857, GHSA-pmcr-2rhp-36hr, GO-2022-0302 | Medium | 0.9% | 27 Jan, 2022 | Go github.com/navidrome/navidrome |
Denial of Service in graphql-go CVE-2022-21708, GHSA-mh3m-8c74-74xh, GO-2022-0300 | Medium | 1.2% | 27 Jan, 2022 | Go github.com/graph-gophers/graphql-go |
Subdomain Takeover in Interactsh server CVE-2023-36474, GHSA-m36x-mgfh-8g78, GO-2022-0372 | Medium | 0.5% | 27 Jan, 2022 | Go github.com/projectdiscovery/interactsh |
Withdrawn Advisory: NULL Pointer Dereference in Protocol Buffers CVE-2021-22570, GHSA-77rm-9x9h-xj3g, PYSEC-2022-48 | High | 2.7% | 26 Jan, 2022 | Go github.com/protocolbuffers/protobuf Maven com.google.protobuf:protobuf-java NuGet Google.Protobuf Packagist google/protobuf +1 more |
Panic when opening certain archives in archive/zip BIT-golang-2021-41772, CVE-2021-41772, GO-2021-0264 | 3.3% | 13 Jan, 2022 | Go stdlib | |
Lookup operations do not take into account wildcards in SpiceDB CVE-2022-21646, GHSA-7p8f-8hjm-wm92, GO-2022-0295 | High | 1.3% | 13 Jan, 2022 | Go github.com/authzed/spicedb |
Panic on invalid symbol tables in debug/macho BIT-golang-2021-41771, CVE-2021-41771, GO-2021-0263 | 4.7% | 13 Jan, 2022 | Go stdlib | |
Cross-site scripting in net/http/cgi and net/http/fcgi BIT-golang-2020-24553, CVE-2020-24553, GO-2021-0226 | 3.6% | 13 Jan, 2022 | Go stdlib | |
Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints GHSA-m7vp-hqwv-7m5x | High | Not scored | 12 Jan, 2022 | Go github.com/spiffe/spire |
kubectl ANSI escape characters not filtered CVE-2021-25743, GHSA-f9jg-8p32-2f55, GO-2022-0983 | Low | 0.8% | 08 Jan, 2022 | Go k8s.io/kubernetes |
Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy CVE-2021-42583, GHSA-5r5w-h76p-m726, GO-2022-0306 | High | 0.7% | 06 Jan, 2022 | Go github.com/foxcpp/maddy |
Link Following in Iris CVE-2021-23772, GHSA-jcxc-rh6w-wf49, GO-2022-0272 | High | 1.9% | 06 Jan, 2022 | Go github.com/kataras/iris Go github.com/kataras/iris/v12 |
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman CVE-2021-4024, GHSA-3cf2-x423-x582, GO-2022-0281 | Medium | 1.1% | 06 Jan, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 |
Drainage of FeeCollector's Block Transaction Fees in cronos CVE-2021-43839, GHSA-f854-hpxv-cw9r | High | 1.4% | 06 Jan, 2022 | Go github.com/crypto-org-chain/cronos Go github.com/tharsis/ethermint Go github.com/tharsis/evmos |
Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme GHSA-gp6j-vx54-5pmf, GO-2022-0367 | Critical | Not scored | 06 Jan, 2022 | Go github.com/keep-network/keep-ecdsa |
Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux CVE-2021-43816, GHSA-mvff-h3cj-wj9c, GO-2022-0278 | High | 1.8% | 06 Jan, 2022 | Go github.com/containerd/containerd |
golang.org/x/net/http2 allows uncontrolled memory consumption BIT-golang-2021-44716, CVE-2021-44716, GHSA-vc3p-29h2-gpcp, GO-2022-0288 | High | 4.3% | 02 Jan, 2022 | Go golang.org/x/net Go golang.org/x/net/http2 Go stdlib |
Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity CVE-2020-25039, GHSA-w6v2-qchm-grj7 | High | 2.0% | 20 Dec, 2021 | Go github.com/sylabs/singularity |