Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Insufficient Session Expiration in snipe/snipe-it CVE-2022-2997, GHSA-cmxc-9ghj-jp87 | High | 0.9% | 25 Aug, 2022 | Packagist snipe/snipe-it |
exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability CVE-2022-37333, GHSA-p74q-2pf8-j5jx | High | 1.4% | 24 Aug, 2022 | Packagist exceedone/exment Packagist exceedone/laravel-admin |
Exposure of password hashes in notrinos/notrinos-erp CVE-2022-2921, GHSA-44w5-q257-8428 | High | 1.4% | 21 Aug, 2022 | Packagist notrinos/notrinos-erp |
PocketMine-MP invalid skin geometry JSON data leading to server crash CVE-2022-51009, GHSA-8cwq-4cmf-px73 | High | 0.6% | 18 Aug, 2022 | Packagist pocketmine/pocketmine-mp |
Magento Improper Access Control vulnerability BIT-magento-2022-34255, CVE-2022-34255, GHSA-x95x-f4g9-mm85 | High | 2.3% | 16 Aug, 2022 | Packagist magento/community-edition |
Magento Path Traversal vulnerability BIT-magento-2022-34254, CVE-2022-34254, GHSA-fx9g-g9q6-x3jx | High | 2.3% | 16 Aug, 2022 | Packagist magento/community-edition |
Moodle Incorrect Authorization vulnerability BIT-moodle-2020-14321, CVE-2020-14321, GHSA-9q29-jcjw-fw7h | High | 16.1% | 16 Aug, 2022 | Packagist moodle/moodle |
Cockpit Content Platform vulnerable to 2FA bypass CVE-2022-2818, GHSA-8wj3-cpmr-8whp | High | 1.7% | 15 Aug, 2022 | Packagist cockpit-hq/cockpit |
CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection BIT-codeigniter-2022-35943, CVE-2022-35943, GHSA-5hm8-vh6r-2cjq | High | 0.6% | 12 Aug, 2022 | Packagist codeigniter4/shield |
mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack GHSA-c8rp-cgf4-937w | High | Not scored | 29 Jul, 2022 | Packagist mezzio/mezzio-swoole |
Feehi CMS arbitrary code execution via crafted PHP file CVE-2022-34971, GHSA-jxg9-2ch7-f552 | High | 1.3% | 27 Jul, 2022 | Packagist feehi/cms |
Moodle Arbitrary file read when importing lesson questions BIT-moodle-2022-35650, CVE-2022-35650, GHSA-pgm5-cr62-prxq | High | 53.7% | 25 Jul, 2022 | Packagist moodle/moodle |
Drupal core arbitrary PHP code execution BIT-drupal-2022-25277, CVE-2022-25277, DRUPAL-CORE-2022-014, GHSA-6955-67hm-vjjq | High | 1.4% | 20 Jul, 2022 | Packagist drupal/core |
Drupal core Information Disclosure vulnerability BIT-drupal-2022-25275, CVE-2022-25275, DRUPAL-CORE-2022-012, GHSA-xh3v-6f9j-wxw3 | High | 0.7% | 20 Jul, 2022 | Packagist drupal/core |
LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0 CVE-2022-31158, GHSA-5p73-qg2v-383h | High | 0.9% | 15 Jul, 2022 | Packagist packbackbooks/lti-1-3-php-library |
LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0 CVE-2022-31157, GHSA-768m-5w34-2xf5 | High | 0.5% | 15 Jul, 2022 | Packagist packbackbooks/lti-1-3-php-library |
October CMS upload process vulnerable to RCE via Race Condition CVE-2022-24800, GHSA-8v7h-cpc2-r8jp | High | 1.5% | 12 Jul, 2022 | Packagist october/system |
Known vulnerable to account takeover via host header injection attack in v1.3.1 CVE-2022-33011, GHSA-p757-4v3p-j74f | High | 1.5% | 08 Jul, 2022 | Packagist idno/known |
Code injection in grav CVE-2022-2073, GHSA-cxgw-r5jg-7xwq | High | 10.9% | 29 Jun, 2022 | Packagist getgrav/grav |
BlockWishList SQL Injection vulnerability CVE-2022-31101, GHSA-2jx3-5j9v-prpp | High | 23.5% | 25 Jun, 2022 | Packagist prestashop/blockwishlist |
Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore CVE-2022-31092, GHSA-gvmf-wcx6-p974 | High | 1.4% | 22 Jun, 2022 | Packagist pimcore/pimcore |
Change in port should be considered a change in origin CVE-2022-31091, GHSA-q559-8m2m-g699 | High | 1.6% | 21 Jun, 2022 | Packagist guzzlehttp/guzzle |
CURLOPT_HTTPAUTH option not cleared on change of origin CVE-2022-31090, GHSA-25mq-v84q-4j7r | High | 1.9% | 21 Jun, 2022 | Packagist guzzlehttp/guzzle |
Code injection in Elefant CMS CVE-2017-20064, GHSA-gx6v-67qv-rhx5 | High | 1.1% | 20 Jun, 2022 | Packagist elefant/cms |
Unrestricted Upload of File with Dangerous Type in Elefant CMS CVE-2017-20063, GHSA-mwh6-g9wx-xcx3 | High | 0.9% | 20 Jun, 2022 | Packagist elefant/cms |
Cross-Site Request Forgery in Elefant CMS CVE-2017-20062, GHSA-pq7f-cq6q-94xh | High | 0.4% | 20 Jun, 2022 | Packagist elefant/cms |
Insufficient Session Expiration in TYPO3's Admin Tool BIT-typo3-2022-31050, CVE-2022-31050, GHSA-wwjw-r3gj-39fq | High | 1.3% | 14 Jun, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
Failure to strip the Cookie header on change in host or HTTP downgrade BIT-drupal-2022-31042, BIT-drupal-2022-31043, CVE-2022-31042, CVE-2022-31043, DRUPAL-CORE-2022-011, GHSA-f2wf-25xc-69c9, GHSA-w248-ffj2-4v5q | High | 2.0% | 09 Jun, 2022 | Packagist drupal/core Packagist guzzlehttp/guzzle |
Improperly checked IDs on itemstacks received from the client leading to server crash in PocketMine-MP CVE-2022-51010, GHSA-fqx3-r75h-vc89 | High | 0.5% | 07 Jun, 2022 | Packagist pocketmine/pocketmine-mp |
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload CVE-2022-30999, GHSA-fm53-mpmp-7qw2 | High | 1.3% | 25 May, 2022 | Packagist fof/upload |
Cross-domain cookie leakage in Guzzle BIT-drupal-2022-29248, CVE-2022-29248, DRUPAL-CORE-2022-010, GHSA-cwmx-hcrq-mhc3 | High | 1.4% | 25 May, 2022 | Packagist drupal/core Packagist guzzlehttp/guzzle |
PHP Code Injection by malicious block or filename in Smarty CVE-2022-29221, GHSA-634x-pc3q-cf4c | High | 4.9% | 24 May, 2022 | Packagist smarty/smarty |
Path Traversal in FileGator CVE-2022-1850, GHSA-rrhw-54r8-545q | High | 1.0% | 24 May, 2022 | Packagist filegator/filegator |
SQL injection in helloxz/imgurl CVE-2022-29305, GHSA-rrjv-34p5-4c7r | High | 0.9% | 24 May, 2022 | Packagist helloxz/imgurl |
Arbitrary file upload in ShopXO CVE-2021-41938, GHSA-86p5-97jr-r598 | High | 1.1% | 19 May, 2022 | Packagist shopxo/shopxo |
Privilege escalation in easyappointments CVE-2022-1397, GHSA-7f62-4887-cfv5 | High | 1.2% | 10 May, 2022 | Packagist alextselegidis/easyappointments |
Improper account password reset in Craft CMS CVE-2022-29933, GHSA-5cjr-78cq-3wrg | High | 4.6% | 09 May, 2022 | Packagist craftcms/cms |
Incorrect Authorization in microweber CVE-2022-1631, GHSA-73rp-q4rx-5grc | High | 8.8% | 09 May, 2022 | Packagist microweber/microweber |
Cross site scripting via canonical tag in Contao CVE-2022-24899, GHSA-m8x6-6r63-qvj2 | High | 4.5% | 06 May, 2022 | Packagist contao/contao Packagist contao/core-bundle |
snipe-IT vulnerable to host header injection CVE-2022-23064, GHSA-9vh6-qfv6-vcqp | High | 1.3% | 02 May, 2022 | Packagist snipe/snipe-it |
Improper neutralization of formula elements in yii-helpers CVE-2022-1544, GHSA-f9p3-h6cg-2cjr | High | 2.4% | 01 May, 2022 | Packagist luyadev/yii-helpers |
URL Rewrite vulnerability in multiple zendframework components GHSA-f6p5-76fp-m248 | High | Not scored | 28 Apr, 2022 | Packagist zendframework/zend-diactoros Packagist zendframework/zend-feed Packagist zendframework/zend-http |
Multiple valid tokens for password reset in Shopware CVE-2022-24892, GHSA-3qrq-r688-vvh4 | High | 0.9% | 28 Apr, 2022 | Packagist shopware/shopware |
Malfunction of CSRF token validation in Shopware CVE-2022-24879, GHSA-pf38-v6qj-j23h | High | 0.6% | 28 Apr, 2022 | Packagist shopware/shopware |
Insufficient type validation in pocketmine/pocketmine-mp CVE-2022-51012, GHSA-g5rr-p69h-7v3g | High | 0.5% | 22 Apr, 2022 | Packagist pocketmine/pocketmine-mp |
SQL Injection found in Pimcore CVE-2022-1429, GHSA-2v7p-f4qm-r5pc | High | 63.9% | 22 Apr, 2022 | Packagist pimcore/pimcore |
Improper Access Control in Shopware CVE-2022-24872, GHSA-9wrv-g75h-8ccc | High | 1.1% | 20 Apr, 2022 | Packagist shopware/core Packagist shopware/platform |
Server-Side Request Forgery (SSRF) in Shopware CVE-2022-24871, GHSA-7gm7-8q8v-9gf2 | High | 1.1% | 20 Apr, 2022 | Packagist shopware/core Packagist shopware/platform |
Improper input validation in Drupal core BIT-drupal-2022-25273, CVE-2022-25273, DRUPAL-CORE-2022-008, GHSA-g36h-4jr6-qmm9 | High | 0.6% | 20 Apr, 2022 | Packagist drupal/core |
MantisBT CSV Injection unprivileged user access in csv_export.php CVE-2021-43257, GHSA-rg8f-5p7x-m6wv | High | 1.0% | 14 Apr, 2022 | Packagist mantisbt/mantisbt |