Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
TeamPass Cross-site Scripting vulnerability CVE-2023-3531, GHSA-pwrw-g29q-3mp8 | High | 0.5% | 06 Jul, 2023 | Packagist nilsteampassnet/teampass |
league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase CVE-2023-37260, GHSA-wj7q-gjg8-3cpm | High | 1.0% | 06 Jul, 2023 | Packagist league/oauth2-server |
Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability CVE-2023-3302, GHSA-hm75-8w6h-4f8f | High | 0.5% | 23 Jun, 2023 | Packagist admidio/admidio |
RaspAP raspap-webgui Command Injection vulnerability CVE-2023-30260, GHSA-hhqm-f4m4-pq39 | High | 2.5% | 23 Jun, 2023 | Packagist billz/raspap-webgui |
Moodle vulnerable to Server Side Request Forgery BIT-moodle-2023-35133, CVE-2023-35133, GHSA-xxp4-mf4h-6cwm | High | 0.8% | 22 Jun, 2023 | Packagist moodle/moodle |
GilaCMS Cross Site Request Forgery vulnerability CVE-2020-20726, GHSA-4cw3-rhqx-vqwr | High | 0.7% | 20 Jun, 2023 | Packagist gilacms/gila |
Magento Open Source allows Improper Neutralization of Special Elements Used CVE-2023-29297, GHSA-gfmm-ww6f-5mm5 | High | 1.4% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Open Source affected by Improper Input Validation CVE-2023-22248, GHSA-5jfg-phx7-7fxg | High | 1.0% | 15 Jun, 2023 | Packagist magento/community-edition Packagist magento/project-community-edition |
Grav Server-side Template Injection (SSTI) via Twig Default Filters CVE-2023-34448, GHSA-whr7-m3f8-mpm8 | High | 4.5% | 14 Jun, 2023 | Packagist getgrav/grav |
Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability CVE-2023-34253, GHSA-j3v8-v77f-fvgm | High | 2.1% | 14 Jun, 2023 | Packagist getgrav/grav |
Grav Server-side Template Injection (SSTI) via Twig Default Filters CVE-2023-34252, GHSA-96xv-rmwj-6p9w | High | 2.1% | 14 Jun, 2023 | Packagist getgrav/grav |
elFinder vulnerable to path traversal in LocalVolumeDriver connector CVE-2023-35840, GHSA-wm5g-p99q-66g4 | High | 1.9% | 14 Jun, 2023 | Packagist studio-42/elfinder |
hjson stack exhaustion vulnerability CVE-2023-34620, GHSA-5wfc-hjrc-gq87, GO-2026-5157 | High | 0.8% | 14 Jun, 2023 | Go github.com/hjson/hjson-go/v4 Maven org.hjson:hjson Packagist laktak/hjson |
Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability CVE-2023-30179, GHSA-3x74-v64j-qc3f | High | 2.2% | 13 Jun, 2023 | Packagist craftcms/cms |
Dolibarr vulnerable to unauthenticated database access BIT-dolibarr-2023-33568, CVE-2023-33568, GHSA-fpvg-m786-h5vr | High | 14.9% | 13 Jun, 2023 | Packagist dolibarr/dolibarr |
Froxlor vulnerable to Path Traversal CVE-2023-3172, GHSA-ghqq-jfx7-f6m9 | High | 1.2% | 09 Jun, 2023 | Packagist froxlor/froxlor |
PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash CVE-2023-7332, GHSA-h87r-f4vc-mchv | High | 0.4% | 06 Jun, 2023 | Packagist pocketmine/pocketmine-mp |
PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency CVE-2023-54393, GHSA-pqp3-8rrw-g8vm | High | 0.6% | 06 Jun, 2023 | Packagist pocketmine/pocketmine-mp |
TeamPass vulnerable to stored Cross-site Scripting CVE-2023-3084, GHSA-8vm8-38pc-8xhh | High | 0.8% | 03 Jun, 2023 | Packagist nilsteampassnet/teampass |
TeamPass vulnerable to stored Cross-site Scripting CVE-2023-3083, GHSA-c6fv-3jm9-6r8f | High | 0.7% | 03 Jun, 2023 | Packagist nilsteampassnet/teampass |
Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter CVE-2023-2984, GHSA-46g3-f9r8-xj4v | High | 0.9% | 30 May, 2023 | Packagist pimcore/pimcore |
Pimcore Privilege Defined With Unsafe Actions vulnerability CVE-2023-2983, GHSA-m4mv-rmr7-h5f5 | High | 0.9% | 30 May, 2023 | Packagist pimcore/pimcore |
Dolibarr vulnerable to remote code execution via uppercase manipulation BIT-dolibarr-2023-30253, CVE-2023-30253, GHSA-9wqr-5jp4-mjmh | High | 82.1% | 29 May, 2023 | Packagist dolibarr/dolibarr |
Code injection in nilsteampassnet/teampass CVE-2023-2859, GHSA-h6jh-cf83-qcq5 | High | 1.6% | 24 May, 2023 | Packagist nilsteampassnet/teampass |
Craft CMS vulnerable to Remote Code Execution via unrestricted file extension CVE-2023-32679, GHSA-vqxf-r9ph-cc9c | High | 1.8% | 19 May, 2023 | Packagist craftcms/cms |
pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query CVE-2023-2756, GHSA-25fx-3c2q-cq46 | High | 0.9% | 17 May, 2023 | Packagist pimcore/customer-management-framework-bundle |
WWBN AVideo command injection vulnerability CVE-2023-32073, GHSA-2mhh-27v7-3vcx | High | 6.5% | 12 May, 2023 | Packagist wwbn/avideo |
CraftCMS allows remote attacker to execute arbitrary code via crafted script to Section parameter CVE-2023-30130, GHSA-fjx5-xm7q-whvj | High | 1.4% | 12 May, 2023 | Packagist craftcms/cms |
Froxlor vulnerable to Allocation of Resources Without Limits or Throttling CVE-2023-2666, GHSA-4gm9-c9jq-g523 | High | 0.7% | 12 May, 2023 | Packagist froxlor/froxlor |
RosarioSIS Stores Sensitive Data in a Mechanism without Access Control CVE-2023-2665, GHSA-36cm-h8gv-mg97 | High | 0.6% | 12 May, 2023 | Packagist francoisjacquet/rosariosis |
Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection CVE-2023-2629, GHSA-mq3x-qgwx-3rfw | High | 0.4% | 10 May, 2023 | Packagist pimcore/customer-management-framework-bundle |
teampass vulnerable to code injection CVE-2023-2591, GHSA-prj5-2g2p-x2mw | High | 0.6% | 09 May, 2023 | Packagist nilsteampassnet/teampass |
Cross Site Scripting in thorsten/phpmyfaq CVE-2023-2550, GHSA-5mf7-p346-7rm8 | High | 0.5% | 05 May, 2023 | Packagist thorsten/phpmyfaq |
Moodle SQL Injection vulnerability BIT-moodle-2023-30944, CVE-2023-30944, GHSA-7mmc-22g7-3xq2 | High | 1.1% | 02 May, 2023 | Packagist moodle/moodle |
Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php CVE-2023-30855, GHSA-g2mc-fqqc-hxg3 | High | 0.8% | 02 May, 2023 | Packagist pimcore/pimcore |
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account CVE-2023-30860, GHSA-xr9h-p2rc-rpqm | High | 0.7% | 01 May, 2023 | Packagist wwbn/avideo |
Remote code injection in wwbn/avideo CVE-2023-30854, GHSA-6vrj-ph27-qfp3 | High | 5.2% | 27 Apr, 2023 | Packagist wwbn/avideo |
SQL Injection in Admin Translations API CVE-2023-30850, GHSA-jwg4-qcgv-5wg6 | High | 0.8% | 27 Apr, 2023 | Packagist pimcore/pimcore |
SQL Injection in Translation Export API CVE-2023-30849, GHSA-xmg8-w465-mr56 | High | 0.8% | 27 Apr, 2023 | Packagist pimcore/pimcore |
SQL Injection in Admin Search Find API CVE-2023-30848, GHSA-6mhm-gcpf-5gr8 | High | 0.7% | 27 Apr, 2023 | Packagist pimcore/pimcore |
SQL Injection in AssetController CVE-2023-2338, GHSA-4x35-vr82-xvj6 | High | 0.9% | 27 Apr, 2023 | Packagist pimcore/pimcore |
Cross site scripting (XSS) in wwbn/avideo GHSA-2fch-hv74-fgw9 | High | Not scored | 26 Apr, 2023 | Packagist wwbn/avideo |
Arbitrary file read via SQL injection CVE-2023-30545, GHSA-8r4m-5p6p-52rp | High | 0.9% | 25 Apr, 2023 | Packagist prestashop/prestashop |
Path traversal vulnerability in the file manager CVE-2023-29200, GHSA-fp7q-xhhw-6rj3 | High | 0.8% | 25 Apr, 2023 | Packagist contao/contao |
HTTP Multiline Header Termination CVE-2023-29530, GHSA-xv3h-4844-9h36 | High | 1.0% | 24 Apr, 2023 | Packagist laminas/laminas-diactoros |
Improper Privilege Management in microweber CVE-2023-2240, GHSA-r6xq-xcxc-fghx | High | 0.7% | 22 Apr, 2023 | Packagist microweber/microweber |
Improper header name validation in guzzlehttp/psr7 CVE-2023-29197, GHSA-wxmh-65f7-jcvw | High | 1.2% | 17 Apr, 2023 | Packagist guzzlehttp/psr7 |
Shopware Has Improper Control of Generation of Code in Twig rendered views CVE-2023-2017, GHSA-7v2v-9rm4-7m8f | High | 2.1% | 17 Apr, 2023 | Packagist shopware/core Packagist shopware/platform |
alextselegidis/easyappointments Session Fixation vulnerability CVE-2023-2105, GHSA-4qmm-cv4r-qfr4 | High | 0.7% | 15 Apr, 2023 | Packagist alextselegidis/easyappointments |
yuan1994 tpAdmin Unrestricted Upload of File with Dangerous Type vulnerability CVE-2023-1970, GHSA-27pg-4cj6-8994 | High | 1.0% | 10 Apr, 2023 | Packagist yuan1994/tpadmin |