Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
S3 storage write is not aborted on errors leading to unbounded memory usage GHSA-m6m5-pp4g-fcc8, GO-2022-0374 | High | Not scored | 06 Oct, 2021 | Go github.com/foxcpp/maddy |
Authentication bypass for viewing and deletions of snapshots BIT-grafana-2021-39226, CVE-2021-39226, GHSA-69j6-29vr-p3j9 | HighExploited | 99.9% | 05 Oct, 2021 | Go github.com/grafana/grafana |
Insufficiently restricted permissions on plugin directories CVE-2021-41103, GHSA-c2h3-6mxw-7mvq, GO-2022-0938 | Medium | 0.5% | 04 Oct, 2021 | Go github.com/containerd/containerd |
Cross-site Scripting in Gitea BIT-gitea-2021-28378, CVE-2021-28378, GHSA-g95p-88p4-76cm, GO-2022-0832 | Medium | 8.8% | 27 Sep, 2021 | Go code.gitea.io/gitea |
Elvish vulnerable to remote code execution via the web UI backend CVE-2021-41088, GHSA-fpv6-f8jw-rc3r, GO-2022-0937 | High | 0.5% | 23 Sep, 2021 | Go github.com/elves/elvish |
Cross-site Scripting in Mattermost CVE-2021-37860, GHSA-hv5f-73mr-7vvj, GO-2022-0604 | Medium | 0.6% | 23 Sep, 2021 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 |
Improperly Implemented path matching for in-toto-golang CVE-2021-41087, GHSA-vrxp-mg9f-hwf3, GO-2022-0936 | Medium | 0.4% | 22 Sep, 2021 | Go github.com/in-toto/in-toto-golang |
Confused Deputy in Kubernetes CVE-2021-25740, GHSA-vw47-mr44-3jf9 | Low | 2.0% | 21 Sep, 2021 | Go k8s.io/kubernetes |
Confused Deputy in Kubernetes CVE-2020-8561, GHSA-74j8-88mm-7496 | Medium | 2.1% | 21 Sep, 2021 | Go k8s.io/kubernetes |
Cross-site Scripting in Beego CVE-2021-39391, GHSA-c77f-4rgj-jfr4 | Medium | 0.8% | 15 Sep, 2021 | Go github.com/beego/beego/v2 |
Incorrect Authorization with specially crafted requests BIT-envoy-2021-39206, CVE-2021-39206, GHSA-cfc2-wjcm-c8fm | High | 1.5% | 10 Sep, 2021 | Go github.com/pomerium/pomerium |
Excessive CPU usage BIT-envoy-2021-39204, CVE-2021-39204, GHSA-5wjf-62hw-q78r | High | 1.7% | 10 Sep, 2021 | Go github.com/pomerium/pomerium |
Incorrect handling of H2 GOAWAY + SETTINGS frames BIT-envoy-2021-39162, CVE-2021-39162, GHSA-gjcg-vrxg-xmgv, GO-2022-0933 | High | 1.6% | 10 Sep, 2021 | Go github.com/pomerium/pomerium |
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. BIT-consul-2021-38698, CVE-2021-38698, GHSA-6hw5-6gcx-phmw, GO-2022-0559 | Medium | 1.4% | 08 Sep, 2021 | Go github.com/hashicorp/consul |
HashiCorp Consul Privilege Escalation Vulnerability BIT-consul-2021-37219, CVE-2021-37219, GHSA-ccw8-7688-vqx4, GO-2022-0593 | High | 1.1% | 08 Sep, 2021 | Go github.com/hashicorp/consul |
Privilege escalation in Hashicorp Nomad CVE-2021-37218, GHSA-c8x3-rg72-fwwg, GO-2022-0591 | High | 0.7% | 08 Sep, 2021 | Go github.com/hashicorp/nomad |
Incomplete List of Disallowed Inputs in Kubernetes CVE-2021-25737, GHSA-mfv7-gq43-w965, GO-2022-0908 | Medium | 1.3% | 07 Sep, 2021 | Go k8s.io/kubernetes |
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values CVE-2021-3761, GHSA-c8xp-8mf3-62h9, GO-2022-0246 | High | 1.2% | 07 Sep, 2021 | Go github.com/cloudflare/cfrpki |
Path traversal in Grafana Loki CVE-2021-36156, GHSA-grj5-8x6q-hc9q | Medium | 1.5% | 02 Sep, 2021 | Go github.com/grafana/loki |
Improper Authentication CVE-2019-20894, GHSA-q9mp-79cp-9g8j, GO-2022-0774 | High | 1.6% | 02 Sep, 2021 | Go github.com/containous/traefik Go github.com/containous/traefik/v2 Go github.com/traefik/traefik/v2 |
Traefik has an Improper Certificate Handling issue CVE-2020-9321, GHSA-7h6j-2268-fhcm, GO-2022-0808 | Medium | 0.7% | 02 Sep, 2021 | Go github.com/containous/traefik Go github.com/containous/traefik/v2 Go github.com/traefik/traefik |
Path traversal in Grafana Cortex CVE-2021-36157, GHSA-jphm-g89m-v42p | Medium | 1.4% | 02 Sep, 2021 | Go github.com/cortexproject/cortex |
Improper use of cryptographic key in wal-g CVE-2021-38599, GHSA-vrmr-f2qh-3hhf | High | 0.8% | 02 Sep, 2021 | Go github.com/wal-g/wal-g |
Path traversal in ServiceCenter CVE-2021-21501, GHSA-x6jv-5vfg-gm7x | High | 4.4% | 01 Sep, 2021 | Go github.com/apache/servicecomb-service-center |
Tarslip in go-unarr CVE-2021-38197, GHSA-v9j4-cp63-qv62, GO-2022-0929 | Critical | 2.1% | 01 Sep, 2021 | Go github.com/gen2brain/go-unarr |
HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 BIT-vault-2021-38553, CVE-2021-38553, GHSA-23fq-q7hc-993r, GO-2022-0620 | Critical | 0.3% | 30 Aug, 2021 | Go github.com/hashicorp/vault |
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault BIT-vault-2021-38554, CVE-2021-38554, GHSA-6239-28c2-9mrm, GO-2022-0632 | Medium | 0.9% | 30 Aug, 2021 | Go github.com/hashicorp/vault |
ExternalName Services can be used to gain access to Envoy's admin interface BIT-contour-2021-32783, CVE-2021-32783, GHSA-5ph6-qq5x-7jwc, GO-2022-0922 | High | 1.2% | 30 Aug, 2021 | Go github.com/projectcontour/contour |
Istio Fragments in Path May Lead to Authorization Policy Bypass CVE-2021-39156, GHSA-hqxw-mm44-gc4r | High | 1.2% | 30 Aug, 2021 | Go istio.io/istio |
Authorization Policy Bypass Due to Case Insensitive Host Comparison CVE-2021-39155, GHSA-7774-7vr3-cc8j | High | 1.2% | 30 Aug, 2021 | Go istio.io/istio |
Ethereum Contains Consensus Flaw During Block Processing CVE-2021-39137, GHSA-9856-9gg9-qcmq, GO-2022-0254 | Medium | 1.3% | 30 Aug, 2021 | Go github.com/ethereum/go-ethereum |
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` GHSA-prqf-xr2j-xf65, GO-2022-0405 | Low | Not scored | 23 Aug, 2021 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Argo Server TLS requests could be forged by attacker with network access GHSA-6c73-2v8x-qpvm, GO-2022-0388 | Medium | Not scored | 23 Aug, 2021 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Workflow re-write vulnerability using input parameter BIT-argo-workflows-2021-37914, CVE-2021-37914, GHSA-h563-xh25-x54q, GO-2022-0928 | Medium | 1.0% | 09 Aug, 2021 | Go github.com/argoproj/argo-workflows Go github.com/argoproj/argo-workflows/v2 Go github.com/argoproj/argo-workflows/v3 |
Header dropping in traefik CVE-2021-32813, GHSA-m697-4v8f-55qg, GO-2022-0923 | Medium | 1.1% | 05 Aug, 2021 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 |
Attack on Kubernetes via Misconfigured Argo Workflows GHSA-rc7p-gmvh-xfx2 | Medium | Not scored | 02 Aug, 2021 | Go github.com/argoproj/argo-workflows |
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault BIT-vault-2020-16250, CVE-2020-16250, GHSA-fp52-qw33-mfmw, GO-2022-0825 | High | 1.5% | 02 Aug, 2021 | Go github.com/hashicorp/vault |
tar-utils Path Traversal vulnerability CVE-2020-36566, GHSA-jpf8-h7h7-3ppm, GO-2021-0106 | Critical | 1.1% | 28 Jul, 2021 | Go github.com/whyrusleeping/tar-utils |
Incorrect Authorization in HashiCorp Consul BIT-consul-2020-7955, CVE-2020-7955, GHSA-r9w6-rhh9-7v53, GO-2022-0874 | Medium | 1.4% | 28 Jul, 2021 | Go github.com/hashicorp/consul |
Improper Resource Shutdown or Release in HashiCorp Vault BIT-vault-2020-7220, CVE-2020-7220, GHSA-9vh5-r4qw-v3vv, GO-2022-0816 | High | 1.4% | 28 Jul, 2021 | Go github.com/hashicorp/vault |
github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion CVE-2021-23409, GHSA-xcf7-q56x-78gh, GO-2022-0233, SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439 | High | 1.6% | 26 Jul, 2021 | Go github.com/pires/go-proxyproto |
Improper Restriction of Excessive Authentication Attempts in Argo API BIT-argo-cd-2020-8827, CVE-2020-8827, GHSA-xcqr-9h24-vrgw, GO-2022-0892 | High | 2.2% | 26 Jul, 2021 | Go github.com/argoproj/argo-cd |
Argo CD Insecure default administrative password BIT-argo-cd-2020-8828, CVE-2020-8828, GHSA-h8jc-jmrf-9h8f | High | 1.8% | 26 Jul, 2021 | Go github.com/argoproj/argo-cd |
Archive package allows chmod of file outside of unpack target directory CVE-2021-32760, GHSA-c72p-9xmj-rx3w, GO-2022-0921 | Medium | 1.6% | 26 Jul, 2021 | Go github.com/containerd/containerd |
HashiCorp Consul L7 deny intention results in an allow action BIT-consul-2021-36213, CVE-2021-36213, GHSA-8h2g-r292-j8xh, GO-2022-0895 | High | 1.7% | 19 Jul, 2021 | Go github.com/hashicorp/consul |
Hashicorp Consul Missing SSL Certificate Validation BIT-consul-2021-32574, CVE-2021-32574, GHSA-25gf-8qrr-g78r, GO-2022-0894 | High | 1.5% | 19 Jul, 2021 | Go github.com/hashicorp/consul |
Buildah processes using chroot isolation may leak environment values to intermediate processes CVE-2021-3602, GHSA-7638-r9r3-rmjj, GO-2022-0345 | Medium | 0.3% | 19 Jul, 2021 | Go github.com/containers/buildah |
Open Redirect in github.com/AndrewBurian/powermux CVE-2021-32721, GHSA-mj9r-wwm8-7q52, GO-2021-0237 | Medium | 0.6% | 01 Jul, 2021 | Go github.com/AndrewBurian/powermux |
Incorrect Default Permissions in Binance tss-lib CVE-2020-12118, GHSA-399h-cmvp-qgx5, GO-2022-0769 | High | 1.3% | 29 Jun, 2021 | Go github.com/binance-chain/tss-lib |
Path Traversal in Dutchcoders transfer.sh CVE-2021-33497, GHSA-cf55-rq8x-hm6f, GO-2022-0925 | Critical | 2.0% | 29 Jun, 2021 | Go github.com/dutchcoders/transfer.sh |