Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site scripting in Dutchcoders transfer.sh CVE-2021-33496, GHSA-w3jx-wv97-67ph, GO-2022-0924 | Medium | 1.0% | 29 Jun, 2021 | Go github.com/dutchcoders/transfer.sh |
CRLF vulnerability in Fiber CVE-2020-15111, GHSA-9cx9-x2gp-9qvh, GO-2021-0108 | Medium | 0.9% | 29 Jun, 2021 | Go github.com/gofiber/fiber |
Consensus flaw during block processing in github.com/ethereum/go-ethereum CVE-2020-26265, GHSA-xw37-57qp-9mm4, GO-2021-0105 | Medium | 0.9% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Denial of service in go-ethereum due to CVE-2020-28362 GHSA-m6gx-rhvj-fh52, GO-2022-0392 | Critical | Not scored | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Denial of service in geth CVE-2020-26242, GHSA-jm5c-rv3w-w83m, GO-2021-0103 | Medium | 1.5% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum Go github.com/holiman/uint256 |
Shallow copy bug in geth CVE-2020-26241, GHSA-69v6-xc2j-r2jf, GO-2022-0771 | Medium | 1.2% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Erroneous Proof of Work calculation in geth CVE-2020-26240, GHSA-v592-xf75-856p, GO-2022-0775 | Medium | 1.9% | 29 Jun, 2021 | Go github.com/ethereum/go-ethereum |
Improper Privilege Management in HashiCorp Nomad CVE-2021-3283, GHSA-35qp-xq9f-2rjx, GO-2022-0622 | High | 1.5% | 24 Jun, 2021 | Go github.com/hashicorp/nomad |
Improper network isolation in Hashicorp Nomad CVE-2021-32575, GHSA-vf6q-9f2f-mwhv, GO-2022-0709 | Medium | 0.5% | 24 Jun, 2021 | Go github.com/hashicorp/nomad |
Improper Neutralization of Special Elements in Output in helm.sh/helm/v3 BIT-helm-2021-21303, CVE-2021-21303, GHSA-c38g-469g-cmgx, GO-2022-1040 | Medium | 1.1% | 23 Jun, 2021 | Go helm.sh/helm/v3 |
Plugin archive directory traversal in Helm BIT-helm-2020-4053, CVE-2020-4053, GHSA-qq3j-xp49-j73f | Low | 1.5% | 23 Jun, 2021 | Go helm.sh/helm/v3 |
Helm passes repository credentials to alternate domain BIT-helm-2021-32690, CVE-2021-32690, GHSA-56hp-xqp3-w2jf, GHSA-7jr6-prv4-5wf5, GO-2022-0384 | Medium | 1.4% | 23 Jun, 2021 | Go helm.sh/helm/v3 |
Unchecked hostname resolution could allow access to local network resources by users outside the local network GHSA-6rg3-8h8x-5xfv, GO-2022-0389 | Medium | Not scored | 23 Jun, 2021 | Go github.com/pterodactyl/wings |
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings CVE-2021-32699, GHSA-jj6m-r8jc-2gp7, GO-2022-0919 | Medium | 0.3% | 23 Jun, 2021 | Go github.com/pterodactyl/wings |
Helm uses crypto package vulnerable to panic from malformed X.509 certificate BIT-golang-2020-7919, CVE-2020-7919, GHSA-cjjc-xp8v-855w, GO-2022-0229 | High | 2.6% | 23 Jun, 2021 | Go github.com/helm/helm Go golang.org/x/crypto Go helm.sh/helm/v3 Go stdlib |
Possible bypass of token claim validation when OAuth2 Introspection caching is enabled CVE-2021-32701, GHSA-qvp4-rpmr-xwrr, GHSA-vfvf-6gx5-mqv6, GO-2022-0406, GO-2022-0920 | High | 1.6% | 23 Jun, 2021 | Go github.com/ory/oathkeeper |
Access Control Bypass CVE-2018-20321, GHSA-9qq2-xhmc-h9qr, GO-2022-0644 | Medium | 1.8% | 23 Jun, 2021 | Go github.com/rancher/rancher |
Incorrect Permission Assignment for Critical Resource in Hashicorp Consul BIT-consul-2020-12797, CVE-2020-12797, GHSA-hwqm-x785-qh8p, GO-2022-0847 | Medium | 1.5% | 23 Jun, 2021 | Go github.com/hashicorp/consul |
Auth bypass in SAML provider GHSA-433w-mm6h-rv9p | Critical | Not scored | 23 Jun, 2021 | Go github.com/netlify/gotrue |
Hugo can execute a binary from the current directory on Windows CVE-2020-26284, GHSA-8j34-9876-pvfq | High | 1.5% | 23 Jun, 2021 | Go github.com/gohugoio/hugo |
Path traversal in github.com/ipfs/go-ipfs CVE-2020-26279, GHSA-27pv-q55r-222g, GO-2022-0779 | High | 1.7% | 23 Jun, 2021 | Go github.com/ipfs/go-ipfs |
Control character injection in console output in github.com/ipfs/go-ipfs CVE-2020-26283, GHSA-r4gv-vj59-cccm, GO-2022-0873 | Medium | 1.5% | 23 Jun, 2021 | Go github.com/ipfs/go-ipfs |
Websocket requests did not call AuthenticateMethod CVE-2021-4236, GHSA-5gjg-jgh4-gppm, GHSA-jpgg-cp2x-qrw3, GO-2021-0107 | Critical | 1.2% | 23 Jun, 2021 | Go github.com/ecnepsnai/web |
Authentication Bypass in tyk-identity-broker CVE-2021-23365, GHSA-599h-8wpj-75xj, GO-2022-0906, SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720 | Critical | 1.0% | 23 Jun, 2021 | Go github.com/TykTechnologies/tyk-identity-broker Go github.com/tyktechnologies/tyk-identity-broker |
Improper input validation in CNCF Cortex CVE-2021-31232, GHSA-m45g-f45x-vv22, GO-2022-0915 | Medium | 0.4% | 23 Jun, 2021 | Go github.com/cortexproject/cortex |
Cache Manipulation Attack in Apache Traffic Control CVE-2020-17522, GHSA-pw59-4qgf-jxr8 | Medium | 4.0% | 18 Jun, 2021 | Go github.com/apache/trafficcontrol |
go.mongodb.org/mongo-driver improperly validates cstrings when marshalling Go objects into BSON CVE-2021-20329, GHSA-f6mq-5m25-4r72, GO-2021-0112 | Medium | 0.9% | 15 Jun, 2021 | Go go.mongodb.org/mongo-driver |
Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone BIT-rclone-2020-28924, CVE-2020-28924, GHSA-rmw5-xpg9-jr29, GO-2022-0878 | High | 1.4% | 10 Jun, 2021 | Go github.com/rclone/rclone |
Improper Input Validation CVE-2021-3499, GHSA-57v4-m9jx-mh8r | Medium | 0.8% | 08 Jun, 2021 | Go github.com/ovn-org/ovn-kubernetes |
Access control flaw in Kiali CVE-2021-3495, GHSA-mv55-23xp-3wp8, GO-2022-0645 | High | 1.0% | 08 Jun, 2021 | Go github.com/kiali/kiali |
Invalid session token expiration BIT-vault-2021-32923, CVE-2021-32923, GHSA-38j9-7pp9-2hjw, GO-2022-0623 | High | 1.4% | 08 Jun, 2021 | Go github.com/hashicorp/vault |
Kiali Authentication Bypass vulnerability CVE-2021-20278, GHSA-ggjr-2f7v-vhq4, GO-2022-0700 | Medium | 0.8% | 01 Jun, 2021 | Go github.com/kiali/kiali |
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint CVE-2021-32635, GHSA-5mv9-q7fq-9394 | Medium | 1.4% | 01 Jun, 2021 | Go github.com/sylabs/singularity |
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint GHSA-jq42-hfch-42f3 | Medium | Not scored | 01 Jun, 2021 | Go github.com/hpcng/singularity |
Permissions bypass in KubeVirt CVE-2020-1701, GHSA-849r-8wvp-4wwg, GO-2024-2765 | Medium | 0.7% | 01 Jun, 2021 | Go kubevirt.io/kubevirt |
Access Restriction Bypass in kube-apiserver CVE-2021-25735, GHSA-g42g-737j-qx6j, GO-2022-0907 | Medium | 5.4% | 28 May, 2021 | Go k8s.io/kubernetes |
Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements CVE-2020-11091, GHSA-59qg-grp7-5r73, GO-2022-0794 | Medium | 0.9% | 27 May, 2021 | Go github.com/weaveworks/weave |
Lookup function information discolosure in helm BIT-helm-2020-11013, CVE-2020-11013, GHSA-q8q8-93cv-v6h8 | High | 1.4% | 27 May, 2021 | Go helm.sh/helm/v3 |
Denial of service in Tendermint CVE-2020-5303, GHSA-v24h-pjjv-mcp6 | Low | 1.4% | 27 May, 2021 | Go github.com/tendermint/tendermint |
Authentication Bypass in hydra CVE-2020-5300, GHSA-3p3g-vpw6-4w66, GO-2022-0786 | Medium | 1.0% | 27 May, 2021 | Go github.com/ory/hydra |
Listing of upload directory contents possible GHSA-qmfx-75ff-8mw6, GO-2022-0407 | High | Not scored | 27 May, 2021 | Go github.com/ThomasLeister/prosody-filer |
mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs CVE-2021-30465, GHSA-c3xm-pvg7-gh7r, GO-2022-0914 | High | 10.2% | 25 May, 2021 | Go github.com/opencontainers/runc |
Arbitrary code execution due to an uncontrolled search path for the git binary CVE-2021-28955, GHSA-m898-h4pm-pqfr | Critical | 1.7% | 25 May, 2021 | Go github.com/MichaelMure/git-bug |
In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication CVE-2021-28681, GHSA-74xm-qj29-cq8p, GO-2021-0104 | Medium | 0.7% | 25 May, 2021 | Go github.com/pion/webrtc/v3 |
Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy BIT-oauth2-proxy-2021-21291, CVE-2021-21291, GHSA-4mf2-f3wh-gvf2, GO-2022-0790 | Low | 1.6% | 25 May, 2021 | Go github.com/oauth2-proxy/oauth2-proxy Go github.com/oauth2-proxy/oauth2-proxy/v7 |
Denial-of-Service within Docker container CVE-2020-26213, GHSA-jhj6-5mh6-4pvf, GO-2022-0903 | Medium | 1.4% | 24 May, 2021 | Go ktbs.dev/teler |
accounts: Hash account number using Salt GHSA-g636-q5fc-4pr7 | Low | Not scored | 24 May, 2021 | Go github.com/moov-io/customers |
containerd-shim API Exposed to Host Network Containers CVE-2020-15257, GHSA-36xw-fx78-c5r4, GO-2022-0784 | Medium | 3.1% | 24 May, 2021 | Go github.com/containerd/containerd |
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses CVE-2020-15233, GHSA-rfq3-w54c-f9q5 | Medium | 0.8% | 24 May, 2021 | Go github.com/ory/fosite |
Redirect URL matching ignores character casing CVE-2020-15234, GHSA-grfp-q2mm-hfp6 | Medium | 0.8% | 24 May, 2021 | Go github.com/ory/fosite |