Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Silverstripe XSS In FormAction GHSA-4h54-vwx9-3vr3 | Medium | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
Silverstripe XSS In rewritten hash links GHSA-34q6-xqxh-gq39 | Medium | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
Silverstripe XSS In GridField print GHSA-88jp-9jrv-6368 | Medium | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
Silverstripe XSS in TreeDropdownField and TreeMultiSelectField GHSA-r32j-mr8p-hfp8 | Medium | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
SilverStripe framework XML Quadratic Blowup Attack GHSA-g43w-98wp-m694 | Medium | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
Silverstripe IE requests not properly behaving with rewritehashlinks GHSA-5f5v-5c3v-gw5v | Medium | Not scored | 23 May, 2024 | Packagist silverstripe/framework |
Silverstripe Forum Module CSRF Vulnerability GHSA-w8fq-xgvh-cxc2 | Medium | Not scored | 23 May, 2024 | Packagist silverstripe/forum |
Silverstripe XSS vulnerability via VirtualPage GHSA-r97r-64vp-fghm | Medium | Not scored | 22 May, 2024 | Packagist silverstripe/cms |
Silverstripe History XSS Vulnerability GHSA-6hh6-59j2-qrxw | Medium | Not scored | 22 May, 2024 | Packagist silverstripe/cms |
Shopware Non-Persistent XSS in the Frontend GHSA-jqr7-5h7r-ch8p | Medium | Not scored | 21 May, 2024 | Packagist shopware/shopware |
sensiolabs/connect has a Cross-Site Request Forgery Vulnerability GHSA-6wqp-7g94-f69j | Medium | Not scored | 21 May, 2024 | Packagist sensiolabs/connect |
verbb/formie Server-Side Template Injection for variable-enabled settings CVE-2024-35191, GHSA-v45m-hxqp-fwf5 | Medium | 0.3% | 20 May, 2024 | Packagist verbb/formie |
Pusher Service Channel Authentication Bypass GHSA-7v7m-pcw5-h3cg | Medium | Not scored | 20 May, 2024 | Packagist pusher/pusher-php-server |
phpxmlrpc/extra XSS in class documenting_xmlrpc_server GHSA-ww6p-q26w-fr6m | Medium | Not scored | 20 May, 2024 | Packagist phpxmlrpc/extras |
Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab" GHSA-qm5v-pj64-852j | Medium | Not scored | 20 May, 2024 | Packagist passbolt/passbolt_api |
Passbolt Api E-mail HTML injection GHSA-v86m-j5f7-ccwh | Medium | Not scored | 20 May, 2024 | Packagist passbolt/passbolt_api |
OroPlatform Forced Redirect to External Website GHSA-3vhm-q4w3-rw8q | Medium | Not scored | 20 May, 2024 | Packagist oro/platform |
OroCRM Forced Redirect to External Website GHSA-v8hp-239v-9367 | Medium | Not scored | 20 May, 2024 | Packagist oro/crm |
onelogin/php-saml signature wrapping attacks CVE-2016-1000253, GHSA-g48f-pgwh-wwxx | Medium | Not scored | 17 May, 2024 | Packagist onelogin/php-saml |
Privilege Escalation in TYPO3 Neos GHSA-43cf-7f3h-38rg | Medium | Not scored | 17 May, 2024 | Packagist neos/neos |
Time-Based Information Disclosure Vulnerability in Flow GHSA-6pq8-67pw-j6hw | Medium | Not scored | 17 May, 2024 | Packagist neos/flow |
Neos Flow Information disclosure in entity security GHSA-9cw3-j7wg-jwj8 | Medium | Not scored | 17 May, 2024 | Packagist neos/flow |
Neos Flow Arbitrary file upload and XML External Entity processing GHSA-5vv7-j593-mgjc | Medium | Not scored | 17 May, 2024 | Packagist neos/flow |
Magento Cross-Site Scripting (XSS) vulnerability GHSA-mcfc-67vm-j568 | Medium | Not scored | 15 May, 2024 | Packagist magento/community-edition |
Data Leakage Vulnerability in livewire/livewire GHSA-qwvp-268g-jjm8 | Medium | Not scored | 15 May, 2024 | Packagist livewire/livewire |
Insecure State Generation in laravel/socialite GHSA-h97c-qp24-439v | Medium | Not scored | 15 May, 2024 | Packagist laravel/socialite |
State Guessing Vulnerability in laravel/socialite GHSA-7fjv-25q9-2w88 | Medium | Not scored | 15 May, 2024 | Packagist laravel/socialite |
Laravel Guard bypass in Eloquent models GHSA-44pg-c29v-hp6r | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Cross-site Scripting (XSS) vulnerability in blade templating GHSA-vr95-p7q6-8m9q | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Encrypter Component Potential Decryption Failure Leading to Unintended Behavior GHSA-7852-w36x-6mf6 | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Hijacked authentication cookies vulnerability GHSA-p62r-7637-3wwc | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Laravel Risk of mass-assignment vulnerabilities GHSA-rj3w-99gc-8j58 | Medium | Not scored | 15 May, 2024 | Packagist laravel/framework |
Read private customer data reclaiming carts in Klaviyo Magento GHSA-hvgw-gg3p-295j | Medium | Not scored | 15 May, 2024 | Packagist klaviyo/magento2-extension |
Laravel Cross-site Scripting vulnerability in blade templating GHSA-297g-xg4h-7w4c | Medium | Not scored | 15 May, 2024 | Packagist illuminate/view |
Laravel Risk of mass-assignment vulnerabilities GHSA-cc2w-ghc5-m5qr | Medium | Not scored | 15 May, 2024 | Packagist illuminate/database |
Laravel Hijacked authentication cookies vulnerability GHSA-q4xf-7fw5-4x8v | Medium | Not scored | 15 May, 2024 | Packagist illuminate/auth |
fuel/core Crypt encryption compromised. GHSA-fgrx-4637-fcf5 | Medium | Not scored | 15 May, 2024 | Packagist fuel/core |
FOSUserBundle User Identity Validation Vulnerability GHSA-8wx3-8m4x-g5h4 | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/user-bundle |
FOSUserBundle Entropy is lost in the TokenGenerator GHSA-pjx8-984p-7p3x | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/user-bundle |
FOSRestBundle issue with broken validation of JSONP callbacks GHSA-p9fg-j6ww-953m | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/rest-bundle |
friendsofsymfony/oauth2-php open redirection in oauth GHSA-xm3x-4ph3-3x9c | Medium | Not scored | 15 May, 2024 | Packagist friendsofsymfony/oauth2-php |
eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS) GHSA-w9p3-26fx-5mp3 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/platform-ui-assets-bundle |
Ez Platform Object Injection in legacy shop module GHSA-39j2-4p9j-5w4j | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads GHSA-pqjm-xcp8-wgmm | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template GHSA-2vh3-cj9j-mcj5 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-legacy |
eZ Platform Prevent accepting app.php in URL in Platform.sh GHSA-qhjc-hg94-245v | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform |
eZ Platform REST API returns list of all SiteAccesses GHSA-9wwx-c723-vm8x | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezpublish-kernel |
eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud) GHSA-6xch-2vxx-5pvr | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform |
eZ Platform Editor Cross-site Scripting (XSS) GHSA-4c2w-v5rq-5mx7 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-admin-ui-assets |
eZ Platform Bundled jQuery affected by CVE-2019-11358 GHSA-jrpw-8884-2747 | Medium | Not scored | 15 May, 2024 | Packagist ezsystems/ezplatform-admin-ui-assets |