Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Path traversal and files overwrite with unsquashfs in singularity CVE-2020-15229, GHSA-7gcp-w6ww-2xv9 | High | 2.0% | 24 May, 2021 | Go github.com/sylabs/singularity |
Signature Validation Bypass GHSA-5684-g483-2249 | Critical | Not scored | 24 May, 2021 | Go github.com/russellhaering/gosaml2 |
Signature Validation Bypass GHSA-rrfw-hg9m-j47h | Critical | Not scored | 24 May, 2021 | Go github.com/russellhaering/goxmldsig |
Authenticated users can exploit an enumeration vulnerability in Harbor BIT-harbor-2020-13794, CVE-2020-13794, GHSA-q9p8-33wc-h432, GO-2022-0865 | Medium | 1.3% | 24 May, 2021 | Go github.com/goharbor/harbor |
Token reuse in Ory fosite CVE-2020-15222, GHSA-v3q9-2p3m-7g43, GO-2021-0110 | High | 0.9% | 24 May, 2021 | Go github.com/ory/fosite |
Ory fosite contains Improper Handling of Exceptional Conditions CVE-2020-15223, GHSA-7mqr-2v3q-v2wm, GO-2021-0109 | High | 1.6% | 24 May, 2021 | Go github.com/ory/fosite |
plugin.yaml file allows for duplicate entries in helm BIT-helm-2020-15187, CVE-2020-15187, GHSA-c52f-pq47-2r9j | Low | 1.5% | 24 May, 2021 | Go helm.sh/helm Go helm.sh/helm/v3 |
Improper Sanitizing of plugin names in helm BIT-helm-2020-15186, CVE-2020-15186, GHSA-m54r-vrmv-hw33 | Low | 1.0% | 24 May, 2021 | Go helm.sh/helm Go helm.sh/helm/v3 |
Repository index file allows for duplicates of the same chart entry in helm BIT-helm-2020-15185, CVE-2020-15185, GHSA-jm56-5h66-w453 | Low | 0.9% | 24 May, 2021 | Go helm.sh/helm Go helm.sh/helm/v3 |
Aliases are never checked in helm BIT-helm-2020-15184, CVE-2020-15184, GHSA-9vp5-m38w-j776 | Low | 1.0% | 24 May, 2021 | Go helm.sh/helm Go helm.sh/helm/v3 |
Local Privilege Escalation in cloudflared CVE-2020-24356, GHSA-hgwp-4vp4-qmm2, GO-2022-0845 | High | 0.3% | 24 May, 2021 | Go github.com/cloudflare/cloudflared |
Insecure permissions on build temporary rootfs in Singularity CVE-2020-25040, GHSA-jv9c-w74q-6762 | High | 2.0% | 24 May, 2021 | Go github.com/sylabs/singularity |
Duplicate Advisory: GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected CVE-2021-4238, GHSA-3839-6r69-m497, GHSA-xg2h-wx96-xgxr, GO-2022-0411 | Critical | 1.4% | 21 May, 2021 | Go github.com/Masterminds/goutils |
A failed upgrade may lead to hung goroutines GHSA-gmq2-39ff-f5qg | Low | Not scored | 21 May, 2021 | Go github.com/cloudflare/tableflip |
Import of incorrectly embargoed keys could cause early publication GHSA-3wxm-m9m4-cprj, GO-2022-0381 | Medium | Not scored | 21 May, 2021 | Go github.com/google/exposure-notifications-server |
JWT leak via Open Redirect in Programmatic access CVE-2021-29651, GHSA-35vc-w93w-75c2, GO-2022-0783 | Medium | 0.7% | 21 May, 2021 | Go github.com/pomerium/pomerium |
pomerium_signature is not verified in middleware in github.com/pomerium/pomerium CVE-2021-29652, GHSA-fv82-r8qv-ch4v, GO-2022-0827 | Medium | 0.7% | 21 May, 2021 | Go github.com/pomerium/pomerium |
BLS Signature "Malleability" CVE-2021-21405, GHSA-4g52-pqcj-phvh, GO-2022-0905 | Medium | 1.0% | 21 May, 2021 | Go github.com/filecoin-project/lotus |
Crash due to malformed relay protocol message BIT-syncthing-2021-21404, CVE-2021-21404, GHSA-x462-89pf-6r5h, GO-2022-0888 | Low | 2.0% | 21 May, 2021 | Go github.com/syncthing/syncthing |
nats-io/jwt not enforcing checking of Import token permissions BIT-nats-2021-3127, CVE-2021-3127, GHSA-62mh-w5cv-p88c, GHSA-9r5x-fjv3-q6h4, GHSA-j756-f273-xhp4, GO-2022-0386 | Critical | 1.4% | 21 May, 2021 | Go github.com/nats-io/jwt Go github.com/nats-io/jwt/v2 Go github.com/nats-io/nats-server/v2 |
Import loops in account imports, nats-server DoS GHSA-gwj5-3vfq-q992, GO-2022-0398 | Low | Not scored | 21 May, 2021 | Go github.com/nats-io/nats-server Go github.com/nats-io/nats-server/v2 |
Nil dereference in NATS JWT, DoS of nats-server CVE-2020-26521, GHSA-h2fg-54x9-5qhq, GHSA-hmm9-r2m2-qg9w, GO-2022-0402 | High | 2.2% | 21 May, 2021 | Go github.com/nats-io/jwt Go github.com/nats-io/nats-server/v2 |
Incorrect handling of credential expiry by /nats-io/nats-server CVE-2020-26892, GHSA-2c64-vj8g-vwrq, GHSA-4w5x-x539-ppf5, GO-2022-0380 | Critical | 2.3% | 21 May, 2021 | Go github.com/nats-io/jwt Go github.com/nats-io/nats-server/v2 |
Privilege escalation in rbac CVE-2021-22538, GHSA-5v95-v8c8-3rh6, GO-2022-0798 | High | 0.7% | 21 May, 2021 | Go github.com/google/exposure-notifications-verification-server |
Network policy may be bypassed by some ICMP Echo Requests GHSA-c66w-hq56-4q97, GO-2022-0393 | Low | Not scored | 21 May, 2021 | Go github.com/cilium/cilium |
Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2 BIT-argo-cd-2021-23347, CVE-2021-23347, GHSA-qq5v-f4c3-395c, GO-2022-0869, SNYK-GOLANG-GITHUBCOMARGOPROJARGOCDCMD-1078291 | Medium | 0.6% | 21 May, 2021 | Go github.com/argoproj/argo-cd Go github.com/argoproj/argo-cd/v2 |
Helm OCI credentials leaked into Argo CD logs GHSA-6w87-g839-9wv7, GO-2022-0387 | Medium | Not scored | 21 May, 2021 | Go github.com/argoproj/argo-cd |
Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node CVE-2021-27098, GHSA-h746-rm5q-8mgq | High | 0.6% | 21 May, 2021 | Go github.com/spiffe/spire |
Local directory executable lookup in sops (Windows-only) GHSA-x5c7-x7m2-rhmf, GO-2022-0410 | Low | Not scored | 20 May, 2021 | Go go.mozilla.org/sops Go go.mozilla.org/sops/v3 |
Insufficient Session Expiration in Kiali CVE-2020-1762, GHSA-465w-gg5p-85c9, GO-2022-0626 | High | 1.2% | 18 May, 2021 | Go github.com/kiali/kiali |
Path traversal in u-root CVE-2020-7665, GHSA-58pf-pcwv-qg85, GO-2022-0793 | High | 1.8% | 18 May, 2021 | Go github.com/u-root/u-root |
github.com/tidwall/gjson is vulnerable to Denial of service CVE-2020-36066, GHSA-wjm3-fq3r-5x46, GO-2022-0957 | High | 1.8% | 18 May, 2021 | Go github.com/tidwall/gjson |
Podman Origin Validation Error CVE-2021-20199, GHSA-grh6-q6m2-rh72 | Medium | 1.2% | 18 May, 2021 | Go github.com/containers/podman/v3 |
github.com/pires/go-proxyproto denial of service vulnerability CVE-2021-23351, GHSA-fqh4-rh59-xhvf, SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1081577 | Medium | 1.9% | 18 May, 2021 | Go github.com/pires/go-proxyproto |
Cross-site scripting in bluemonday CVE-2021-29272, GHSA-3x58-xr87-2fcj, GO-2022-0762 | Medium | 0.9% | 18 May, 2021 | Go github.com/microcosm-cc/bluemonday |
Insecure Permissions in Gogs CVE-2020-14958, GHSA-4c7m-vv47-7c69, GO-2022-0788 | Medium | 0.9% | 18 May, 2021 | Go gogs.io/gogs |
Path Traversal in github.com/unknwon/cae/zip CVE-2020-7664, GHSA-vpx7-vm66-qx8r, GO-2021-0228 | High | 1.5% | 18 May, 2021 | Go github.com/unknwon/cae |
Information Exposure in jaeger BIT-jaeger-2020-10750, CVE-2020-10750, GHSA-gh32-pc56-4c96, GO-2022-0834 | Medium | 0.4% | 18 May, 2021 | Go github.com/jaegertracing/jaeger |
Information Disclosure in go.elastic.co/apm CVE-2021-22133, GHSA-qqc5-rgcc-cjqh, GO-2022-0706 | Low | 0.5% | 18 May, 2021 | Go go.elastic.co/apm |
Improper Authorization in github.com/containers/libpod CVE-2021-20188, GHSA-9h63-7qf6-mv6r, GO-2022-0641 | High | 0.3% | 18 May, 2021 | Go github.com/containers/libpod |
Path Traversal in Buildah CVE-2020-10696, GHSA-fx8w-mjvm-hvpc, GO-2022-0828 | High | 2.7% | 18 May, 2021 | Go github.com/containers/buildah |
Predictable SIF UUID Identifiers in github.com/sylabs/sif CVE-2021-29499, GHSA-4gh8-x3vv-phhg, GO-2022-0912 | High | 1.0% | 18 May, 2021 | Go github.com/sylabs/sif |
Hard coded cryptographic key in Kiali CVE-2020-1764, GHSA-64rh-r86q-75ff, GO-2022-0631 | High | 3.5% | 18 May, 2021 | Go github.com/kiali/kiali |
github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2020-7669, GHSA-75qf-wgfj-v652, GO-2022-0805 | High | 1.8% | 18 May, 2021 | Go github.com/u-root/u-root |
Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor CVE-2019-19025, GHSA-gcqm-v682-ccw6, GHSA-rffr-c932-cpxv, GO-2022-0876 | High | 1.0% | 18 May, 2021 | Go github.com/goharbor/harbor |
SQL Injection in Cloud Native Computing Foundation Harbor CVE-2019-19026, GHSA-rh89-vvrg-fg64, GHSA-w4x5-jqq4-qc8x, GO-2022-0883 | Medium | 1.4% | 18 May, 2021 | Go github.com/goharbor/harbor |
SQL Injection in Cloud Native Computing Foundation Harbor CVE-2019-19029, GHSA-jr34-mff8-pc6f, GHSA-qcfv-8v29-469w, GO-2022-0853 | High | 2.1% | 18 May, 2021 | Go github.com/goharbor/harbor |
Privilege Escalation in Cloud Native Computing Foundation Harbor CVE-2019-19023, GHSA-q6cj-6jvq-jwmh, GO-2022-0863 | Medium | 1.6% | 18 May, 2021 | Go github.com/goharbor/harbor |
Improper Authentication in InfluxDB CVE-2019-20933, GHSA-2rmp-fw5r-j5qv, GO-2022-0780 | Critical | 30.9% | 18 May, 2021 | Go github.com/influxdata/influxdb |
Allocation of Resources Without Limits or Throttling in Hashicorp Consul BIT-consul-2020-13250, CVE-2020-13250, GHSA-rqjq-mrgx-85hp, GO-2022-0879 | High | 2.9% | 18 May, 2021 | Go github.com/hashicorp/consul |