Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Pimcore 2FA Vulnerable to Brute Forcing CVE-2019-18985, GHSA-hf62-5vxh-jpwj | Critical | 1.4% | 15 Nov, 2019 | Packagist pimcore/pimcore |
Pimcore Access Control Issues CVE-2019-18981, GHSA-jhcf-j4hg-v64r | Critical | 1.4% | 15 Nov, 2019 | Packagist pimcore/pimcore |
Typo3 Authentication Bypass CVE-2011-4628, GHSA-79gv-5cgx-x6rx | Critical | 1.6% | 06 Nov, 2019 | Packagist typo3/cms |
Magento 2 Community Edition XML Injection CVE-2019-8158, GHSA-8p5c-f836-m4h7 | Critical | 1.3% | 06 Nov, 2019 | Packagist magento/community-edition |
Magento Broken authentication and session managememt CVE-2019-8149, GHSA-8mwx-wpp4-5xh4 | Critical | 2.1% | 06 Nov, 2019 | Packagist magento/community-edition |
Magento 2 Community Edition RCE Vulnerability CVE-2019-8144, GHSA-vpg9-gq7j-mxqg | Critical | 2.8% | 06 Nov, 2019 | Packagist magento/community-edition |
Magento 2 Community Edition Insecure Component CVE-2019-8136, GHSA-xgcp-59g2-wm8g | Critical | 1.2% | 06 Nov, 2019 | Packagist magento/community-edition |
Remote code execution via vulnerable Symphony dependecy injection CVE-2019-8135, GHSA-3q5x-7mxp-rp6j | Critical | 2.5% | 06 Nov, 2019 | Packagist magento/community-edition |
Using JS libraries with known security vulnerabilities CVE-2019-8121, GHSA-89ch-hqf9-rgp3 | Critical | 1.2% | 05 Nov, 2019 | Packagist magento/community-edition Packagist magento/product-community-edition |
SQL Injection in medoo CVE-2019-10762, GHSA-q9p4-qfc8-fvpp, SNYK-PHP-CATFANMEDOO-474562 | Critical | 1.4% | 30 Oct, 2019 | Packagist catfan/medoo |
Zend Framework Allows SQL Injection CVE-2015-0270, GHSA-v59p-p692-v382 | Critical | 1.1% | 25 Oct, 2019 | Packagist zendframework/zend-db Packagist zendframework/zendframework |
Craft CMS possibility of brute force attempts CVE-2019-15929, GHSA-wvr4-w6cw-4px8 | Critical | 1.8% | 24 Oct, 2019 | Packagist craftcms/cms |
slub_events for Typo3 Arbitrary File Upload CVE-2019-16700, GHSA-5pww-3mfc-g8vr | Critical | 2.5% | 16 Oct, 2019 | Packagist slub/slub-events |
sr_freecap for Typo3 RCE Vulnerability CVE-2019-16699, GHSA-598p-rv6p-g7qc | Critical | 2.4% | 16 Oct, 2019 | Packagist sjbr/sr-freecap |
Centreon Privilege Escalation CVE-2018-21025, GHSA-f24j-f97w-65h8 | Critical | 2.8% | 08 Oct, 2019 | Packagist centreon/centreon |
Missing warning can lead to unauthenticated admin access in SilverStripe CVE-2019-12204, GHSA-cg8j-8w52-735v | Critical | 1.5% | 25 Sep, 2019 | Packagist silverstripe/cms Packagist silverstripe/framework |
SQL injection in Centreon CVE-2019-16194, GHSA-wgjx-hm34-qgf7 | Critical | 1.4% | 25 Sep, 2019 | Packagist centreon/centreon |
Missing Authentication for Critical Function in LibreNMS CVE-2019-10668, GHSA-277v-gwfr-hmpj | Critical | 1.6% | 09 Sep, 2019 | Packagist librenms/librenms |
LibreNMS Information Disclosure CVE-2019-10665, GHSA-q5rg-wg7h-73m5 | Critical | 1.5% | 09 Sep, 2019 | Packagist librenms/librenms |
BEdita vulnerable to SQL injection CVE-2019-15570, GHSA-9gv2-2m38-j6cx | Critical | 1.5% | 26 Aug, 2019 | Packagist bedita/bedita |
Spoon Library as used in Fork CMS allows PHP object injection CVE-2019-15521, GHSA-2p2x-mw56-jc98 | Critical | 2.5% | 26 Aug, 2019 | Packagist spoon/library |
SQL Injection in SimpleSAMLphp CVE-2019-15537, GHSA-852q-xxj4-x2rx | Critical | 1.6% | 23 Aug, 2019 | Packagist cesnet/simplesamlphp-module-proxystatistics |
MantisBT allows cross-site scripting (XSS) via crafted filename CVE-2019-15074, GHSA-gg4j-279j-22ph | Critical | 2.1% | 21 Aug, 2019 | Packagist mantisbt/mantisbt |
Access of Resource Using Incompatible Type ('Type Confusion') in yourls/yourls CVE-2019-14537, GHSA-vf23-f26f-mjj9 | Critical | 6.1% | 07 Aug, 2019 | Packagist yourls/yourls |
Drupal Improper Access Control CVE-2019-6342, DRUPAL-CORE-2019-008, GHSA-xq62-62c9-22mg | Critical | 2.2% | 17 Jul, 2019 | Packagist drupal/core Packagist drupal/drupal |
Wikimedia MediaWiki Incorrect Access Control vulnerability CVE-2019-12468, GHSA-wrhx-3pxr-6vgg | Critical | 3.3% | 10 Jul, 2019 | Packagist mediawiki/core |
Contao SQL injection in the file manager CVE-2019-11512, GHSA-vq59-x6mq-4wgw | Critical | 1.5% | 09 Jul, 2019 | Packagist contao/contao Packagist contao/core-bundle |
CodeIgniter Rest Server XXE Vulnerability CVE-2015-3907, GHSA-cc7g-9pcj-7gwm | Critical | 1.6% | 03 Jul, 2019 | Packagist chriskacerguis/codeigniter-restserver |
silverstripe restfulserver and registry modules SQL injection vulnerability CVE-2019-12149, GHSA-4j6v-3895-8g2j | Critical | 1.4% | 11 Jun, 2019 | Packagist silverstripe/registry Packagist silverstripe/restfulserver |
phpMyAdmin SQL injection in Designer feature CVE-2019-11768, GHSA-x37v-98f9-mj32 | Critical | 3.5% | 05 Jun, 2019 | Packagist phpmyadmin/phpmyadmin |
Symfony Incorrect Access Control CVE-2017-11365, GHSA-q87v-q8fw-gmj5 | Critical | 1.9% | 23 May, 2019 | Packagist symfony/security Packagist symfony/security-core Packagist symfony/symfony |
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony CVE-2019-10913, GHSA-x92h-wmg2-6hp7 | Critical | 1.9% | 16 May, 2019 | Packagist symfony/http-foundation Packagist symfony/symfony |
Symfony Service IDs Allow Injection CVE-2019-10910, GHSA-pgwj-prpq-jpc2 | Critical | 6.0% | 16 May, 2019 | Packagist symfony/dependency-injection Packagist symfony/proxy-manager-bridge Packagist symfony/symfony |
PharStreamWrapper for Typo3 unsafe deserialization vulnerability CVE-2019-11830, GHSA-3hxw-g85p-qgxm | Critical | 2.7% | 09 May, 2019 | Packagist typo3/phar-stream-wrapper |
Directory Traversal in typo3/phar-stream-wrapper CVE-2019-11831, DRUPAL-CORE-2019-007, GHSA-xv7v-rf6g-xwrc | Critical | 5.4% | 08 May, 2019 | Packagist drupal/core Packagist drupal/drupal Packagist typo3/phar-stream-wrapper |
Contao SQL injection in the backend and listing module CVE-2017-16558, GHSA-w38g-hj45-mjjp | Critical | 1.5% | 25 Apr, 2019 | Packagist contao/contao Packagist contao/core-bundle Packagist contao/listing-bundle |
LibreNMS arbitrary OS commands execution CVE-2018-20434, GHSA-62q7-qj6g-gvr7 | Critical | 71.5% | 24 Apr, 2019 | Packagist librenms/librenms |
Contao Does Not Expire Tokens Correctly CVE-2019-10643, GHSA-j99g-qjvx-995g | Critical | 1.3% | 17 Apr, 2019 | Packagist contao/contao Packagist contao/core-bundle |
Contao Does Not Invalidate Existing Sessions When Password Changes CVE-2019-10641, GHSA-vcgg-hp4r-87gx | Critical | 1.3% | 17 Apr, 2019 | Packagist contao/contao Packagist contao/core Packagist contao/core-bundle |
Silverstripe Framework SQLi Vulnerability CVE-2019-5715, GHSA-wvfw-w3x6-g526 | Critical | 1.6% | 11 Apr, 2019 | Packagist silverstripe/framework |
Magento 2 Community Edition SQLi Vulnerability CVE-2019-7139, GHSA-4j6w-9rf8-hg7r | Critical | 22.2% | 10 Apr, 2019 | Packagist magento/community-edition |
ThinkAdmin Administrator cookies still working after password change CVE-2019-11018, GHSA-qv5j-rwq3-m823 | Critical | 1.4% | 08 Apr, 2019 | Packagist zoujingli/thinkadmin |
Moodle Blind SSRF Risk in /badges/mybackpack.php CVE-2019-3809, GHSA-jp4g-r8c9-3534 | Critical | 0.8% | 25 Mar, 2019 | Packagist moodle/moodle |
Dolibarr SQL injection via the integer parameters qty and value_unit CVE-2018-16809, GHSA-h34q-878w-w96r | Critical | 2.3% | 07 Mar, 2019 | Packagist dolibarr/dolibarr |
elFinder command injection vulnerability in the PHP connector CVE-2019-9194, GHSA-4223-qj94-7x9p | Critical | 96.7% | 26 Feb, 2019 | Packagist studio-42/elfinder |
Joomla! Object Injection Vulnerability CVE-2019-7743, GHSA-5m3w-rvvh-8fx6 | Critical | 2.7% | 12 Feb, 2019 | Packagist joomla/joomla-cms |
TeamPass Storing Passwords in a Recoverable Format vulnerability CVE-2019-1000001, GHSA-q9qr-h33g-fw3j | Critical | 1.7% | 04 Feb, 2019 | Packagist nilsteampassnet/teampass |
phpMyAdmin SQL injection in Designer feature CVE-2019-6798, GHSA-f732-fxh6-g4qj | Critical | 3.6% | 26 Jan, 2019 | Packagist phpmyadmin/phpmyadmin |
Arbitrary PHP code execution in Drupal CVE-2019-6339, DRUPAL-CORE-2019-002, GHSA-8cw5-rv98-5c46 | Critical | 35.9% | 16 Jan, 2019 | Packagist drupal/core Packagist drupal/drupal |
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions CVE-2017-6925, GHSA-f4qx-jqfq-7785 | Critical | 3.0% | 15 Jan, 2019 | Packagist drupal/core Packagist drupal/drupal |