Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Remote code execution in web server context CVE-2024-37295, GHSA-rhc2-23c2-ww7c | High | 0.6% | 05 Jun, 2024 | Packagist aimeos/aimeos-core |
Flooding Server with Thumbnail files CVE-2024-32871, GHSA-277c-5vvj-9pwx | High | 0.8% | 04 Jun, 2024 | Packagist pimcore/pimcore |
XML External Entity (XXE) Processing in TYPO3 Core GHSA-qffc-gwpp-m2xr | High | Not scored | 04 Jun, 2024 | Packagist typo3/cms |
TYPO3 SQL Injection in dbal GHSA-9895-53fc-98v2 | High | Not scored | 03 Jun, 2024 | Packagist typo3/cms |
Moodle ReCAPTCHA can be bypassed on the login page BIT-moodle-2024-34009, CVE-2024-34009, GHSA-gwf6-q6c2-94p3 | High | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle CSRF risk in analytics management of models BIT-moodle-2024-34008, CVE-2024-34008, GHSA-68x5-4jg5-gjgg | High | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle Logout CSRF in admin/tool/mfa/auth.php BIT-moodle-2024-34007, CVE-2024-34007, GHSA-8g5h-gjwq-w5ch | High | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments BIT-moodle-2024-34005, CVE-2024-34005, GHSA-r99q-hmqv-xw8w | High | 0.5% | 31 May, 2024 | Packagist moodle/moodle |
Moodle Authenticated LFI risk in some misconfigured shared hosting environments BIT-moodle-2024-34002, CVE-2024-34002, GHSA-mm9p-xwfm-3fqf | High | 0.5% | 31 May, 2024 | Packagist moodle/moodle |
Moodle CSRF risk in admin preset tool management of presets BIT-moodle-2024-34001, CVE-2024-34001, GHSA-gq9f-8rj4-w7jc | High | 0.4% | 31 May, 2024 | Packagist moodle/moodle |
TYPO3 frontend login vulnerable to Session Fixation GHSA-r9vc-jfmh-6j48 | High | Not scored | 30 May, 2024 | Packagist typo3/cms |
TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts GHSA-4r76-xr68-w7m7 | High | Not scored | 30 May, 2024 | Packagist typo3/cms |
TYPO3 possible cache poisoning on the homepage when anchors are used GHSA-p84g-j2gh-83g3 | High | Not scored | 30 May, 2024 | Packagist typo3/cms |
TYPO3 Arbitrary Shell Execution in Swiftmailer library GHSA-45xg-4w5x-j429 | High | Not scored | 30 May, 2024 | Packagist typo3/cms |
TYPO3 Possible Insecure Deserialization in Extbase Request Handling GHSA-5h5v-m596-r6rf | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API GHSA-x428-565f-8xj2 | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Security Misconfiguration in Frontend Session Handling GHSA-82vp-jr39-4j2j | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Arbitrary Code Execution via File List Module GHSA-f9hr-7cfq-mjg2 | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Security Misconfiguration for Backend User Accounts GHSA-rxc9-f2x6-qh4w | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Denial of Service in Frontend Record Registration GHSA-hjx5-v9xg-7h25 | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 Security Misconfiguration in Install Tool Cookie GHSA-ppvg-hw62-6ph9 | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 CMS Insecure Deserialization GHSA-96jg-pmc4-cx39 | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 CMS Privilege Escalation and SQL Injection GHSA-45wj-jv2h-jwrf | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
TYPO3 CMS Authentication Bypass vulnerability GHSA-x4rj-f7m6-42c3 | High | Not scored | 30 May, 2024 | Packagist typo3/cms-core |
Thelia authentication bypass vulnerability GHSA-g8pg-33v4-9r96 | High | Not scored | 30 May, 2024 | Packagist thelia/thelia |
symfony/validator XML Entity Expansion vulnerability GHSA-4vf2-qfg3-7598 | High | Not scored | 30 May, 2024 | Packagist symfony/validator |
symfony/translation XML Entity Expansion vulnerability GHSA-f75p-x5vm-83qp | High | Not scored | 30 May, 2024 | Packagist symfony/translation |
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler CVE-2014-6072, GHSA-v35g-4rrw-h4fw | High | Not scored | 30 May, 2024 | Packagist symfony/symfony Packagist symfony/web-profiler-bundle |
Symfony XML Entity Expansion security vulnerability GHSA-q2gc-gg3x-7942 | High | Not scored | 30 May, 2024 | Packagist symfony/symfony |
Symfony XXE security vulnerability GHSA-rjpm-qmq7-q85w | High | Not scored | 30 May, 2024 | Packagist symfony/routing |
Symfony allows direct access of ESI URLs behind a trusted proxy CVE-2014-5245, GHSA-wvjv-p5rr-mmqm | High | Not scored | 30 May, 2024 | Packagist symfony/http-kernel Packagist symfony/symfony |
Symfony vulnerable to denial of service via a malicious HTTP Host header CVE-2014-5244, GHSA-v77v-x634-9m56 | High | Not scored | 30 May, 2024 | Packagist symfony/http-foundation Packagist symfony/symfony |
Code injection in the way Symfony implements translation caching in FrameworkBundle CVE-2014-4931, GHSA-wfv7-5x33-v22h | High | Not scored | 30 May, 2024 | Packagist symfony/framework-bundle Packagist symfony/symfony |
Symfony XML Entity Expansion security vulnerability GHSA-c636-cg5r-2498 | High | Not scored | 29 May, 2024 | Packagist symfony/dependency-injection |
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag CVE-2024-35226, GHSA-4rmg-292m-wg3w | High | 0.5% | 28 May, 2024 | Packagist smarty/smarty |
silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source) GHSA-xc69-p8fc-m6m5 | High | Not scored | 28 May, 2024 | Packagist silverstripe/subsites |
silverstripe/taxonomy SQL Injection vulnerability GHSA-p2v5-xcqm-4fv6 | High | Not scored | 28 May, 2024 | Packagist silverstripe/taxonomy |
silverstripe/graphql Cross-Site Request Forgery vulnerability GHSA-wjg9-v8cf-f5q2 | High | Not scored | 28 May, 2024 | Packagist silverstripe/graphql |
silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector GHSA-265q-222x-52m6 | High | Not scored | 28 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework has possible denial of service attack vector when flushing GHSA-cwgq-83w5-8jfq | High | Not scored | 28 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework allows upload of dangerous file types GHSA-vcg6-8fxc-x5cq | High | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework code execution vulnerability GHSA-vgxh-x8jv-hmff | High | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework BackURL validation bypass with malformed URLs GHSA-m5q3-mvcr-gc5m | High | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework SQL injection in full text search GHSA-xx4r-5265-48j6 | High | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework CSV Excel Macro Injection GHSA-mqjc-x563-c9q8 | High | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework vulnerable to user enumeration via timing attack on login and password reset forms GHSA-7m2v-x7rg-5hm5 | High | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
silverstripe/framework's User-Agent header not correctly invalidating user session GHSA-4qx8-j9vh-2628 | High | Not scored | 27 May, 2024 | Packagist silverstripe/framework |
Silverstripe X-Forwarded-Host request hostname injection GHSA-25gq-jvx2-vg9x | High | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
Silverstripe SiteTree Creation Permission Vulnerability GHSA-3mm9-2p44-rw39 | High | Not scored | 22 May, 2024 | Packagist silverstripe/cms |
scheb/two-factor-bundle bypass two-factor authentication with remember-me option GHSA-9phw-7h96-q3rv | High | Not scored | 21 May, 2024 | Packagist scheb/two-factor-bundle |