Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
OS Command Injection in Laravel Framework CVE-2020-19316, GHSA-w2pm-r78h-4m7v | High | 2.5% | 20 Dec, 2021 | Packagist laravel/framework |
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) BIT-livehelperchat-2021-4131, CVE-2021-4131, GHSA-hx77-5p88-f92r | High | 0.6% | 18 Dec, 2021 | Packagist remdex/livehelperchat |
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4130, GHSA-4w23-c97g-fq5v | High | 0.5% | 18 Dec, 2021 | Packagist snipe/snipe-it |
Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager CVE-2021-23814, GHSA-f8x6-m9f5-ffp8, SNYK-PHP-UNISHARPLARAVELFILEMANAGER-1567199 | High | 1.8% | 17 Dec, 2021 | Packagist unisharp/laravel-filemanager |
PHP file inclusion in the Sulu admin panel CVE-2021-43836, GHSA-vx6j-pjrh-vgjh | High | 2.0% | 15 Dec, 2021 | Packagist sulu/sulu |
Privilege escalation in the Sulu Admin panel CVE-2021-43835, GHSA-84px-q68r-2fc9 | High | 1.2% | 15 Dec, 2021 | Packagist sulu/sulu |
YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number CVE-2021-4111, GHSA-7v7w-f7c6-f829 | High | 0.6% | 15 Dec, 2021 | Packagist yetiforce/yetiforce-crm |
SQL injection in jackalope/jackalope-doctrine-dbal CVE-2021-43822, GHSA-ph98-v78f-jqrm | High | 1.0% | 13 Dec, 2021 | Packagist jackalope/jackalope-doctrine-dbal |
Server-Side Request Forgery in snipe/snipe-it CVE-2021-4075, GHSA-553q-hpvp-q8pc | High | 0.9% | 06 Dec, 2021 | Packagist snipe/snipe-it |
Information exposure in elgg CVE-2021-3980, GHSA-hx6g-q9v2-xh7v | High | 1.6% | 03 Dec, 2021 | Packagist elgg/elgg |
showdoc is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4017, GHSA-f77h-m9w2-vvg2 | High | 0.6% | 01 Dec, 2021 | Packagist showdoc/showdoc |
Potential Zip Slip Vulnerability in baserCMS CVE-2021-41279, GHSA-4x2f-54wr-4hjg | High | 1.6% | 26 Nov, 2021 | Packagist baserproject/basercms |
Cookie persistence after password changes in symfony/security-bundle BIT-symfony-2021-41268, CVE-2021-41268, GHSA-qw36-p97w-vcqr | High | 1.3% | 24 Nov, 2021 | Packagist symfony/security-bundle Packagist symfony/symfony |
Moodle contains CSRF vulnerability BIT-moodle-2021-43559, CVE-2021-43559, GHSA-3jrj-x6cj-97cp | High | 0.6% | 22 Nov, 2021 | Packagist moodle/moodle |
Server-Side Request Forgery in Concrete CMS CVE-2021-22970, GHSA-gqpw-9q54-9x28 | High | 1.5% | 19 Nov, 2021 | Packagist concrete5/core |
Improper file handling in concrete5/core CVE-2021-22968, GHSA-g3p2-hfqr-9m25 | High | 3.2% | 19 Nov, 2021 | Packagist concrete5/core |
Exposure of sensitive information in concrete5/core CVE-2021-22967, GHSA-m2v2-8227-59f5 | High | 1.1% | 19 Nov, 2021 | Packagist concrete5/core |
Improper Privilege Management in Concrete CMS CVE-2021-22966, GHSA-j4mv-2rv7-v2j9 | High | 1.0% | 19 Nov, 2021 | Packagist concrete5/core |
Password exposure in concrete5/core CVE-2021-22951, GHSA-rhf5-f553-xg82 | High | 1.1% | 19 Nov, 2021 | Packagist concrete5/core |
Cross-site Scripting in snipe/snipe-it CVE-2021-3961, GHSA-c65v-p733-9796 | High | 0.8% | 19 Nov, 2021 | Packagist snipe/snipe-it |
HTML comments vulnerability allowing to execute JavaScript code BIT-drupal-2021-41165, CVE-2021-41165, GHSA-7h26-63m7-qhf2 | High | 1.6% | 17 Nov, 2021 | Packagist ckeditor/ckeditor npm ckeditor4 |
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2021-3915, GHSA-w2f4-hxpm-mq98 | High | 1.0% | 13 Nov, 2021 | Packagist ssddanbrown/bookstack |
Unrestricted access to predictable file paths in hov/jobfair CVE-2021-43564, GHSA-43g8-79x3-j898 | High | 1.0% | 10 Nov, 2021 | Packagist hov/jobfair |
Path traversal in grav CVE-2021-3924, GHSA-8c5p-4362-9333 | High | 4.4% | 05 Nov, 2021 | Packagist getgrav/grav |
Cross-Site Request Forgery in firefly-iii CVE-2021-3901, GHSA-rqgp-ccph-5w65 | High | 0.6% | 27 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Cross-Site Request Forgery in snipe-it CVE-2021-3858, GHSA-g92x-8m54-p89v | High | 0.5% | 19 Oct, 2021 | Packagist snipe/snipe-it |
Unrestricted File Upload vulnerability in Firefly III CVE-2021-3846, GHSA-5gq7-826w-8282 | High | 0.8% | 19 Oct, 2021 | Packagist grumpydictator/firefly-iii |
Deleted Admin Can Sign In to Admin Interface CVE-2021-41126, GHSA-6gjf-7w99-j7x7 | High | 1.1% | 06 Oct, 2021 | Packagist october/october Packagist october/system |
Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS CVE-2021-41120, GHSA-25fx-mxc2-76g7 | High | 1.5% | 05 Oct, 2021 | Packagist sylius/paypal-plugin |
Cross-Site-Request-Forgery in Backend BIT-typo3-2021-41113, CVE-2021-41113, GHSA-657m-v5vm-f6rw | High | 0.6% | 05 Oct, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification CVE-2021-41129, GHSA-5vfx-8w6m-h3v4 | High | 1.8% | 04 Oct, 2021 | Packagist pterodactyl/panel |
CSV Injection Vulnerability CVE-2021-41824, GHSA-h7vq-5qgw-jwwq | High | 1.4% | 30 Sep, 2021 | Packagist craftcms/cms |
User can obtain JWT token even if account is disabled GHSA-36mj-6r7r-mqhf | High | Not scored | 29 Sep, 2021 | Packagist ezsystems/ezplatform-rest |
Cross-Site Request Forgery in GilaCMS CVE-2020-20693, GHSA-hwqc-pgjw-vjqp | High | 0.7% | 27 Sep, 2021 | Packagist gilacms/gila |
Cross-Site Request Forgery in firefly-iii CVE-2021-3819, GHSA-356r-77q8-f64f | High | 0.5% | 27 Sep, 2021 | Packagist grumpydictator/firefly-iii |
Drupal core access bypass vulnerability BIT-drupal-2020-13677, CVE-2020-13677, DRUPAL-CORE-2021-010, GHSA-3xr3-phjp-g6p2 | High | 1.2% | 15 Sep, 2021 | Packagist drupal/core |
Any storage file can be downloaded from p.sh if full server path is known GHSA-2rh5-jvgx-pgw3 | High | Not scored | 14 Sep, 2021 | Packagist ezsystems/ezplatform |
Any storage file can be downloaded from p.sh if full server path is known GHSA-gqcf-83rq-gpfr | High | Not scored | 14 Sep, 2021 | Packagist ibexa/post-install |
Content object state fetch functions open to SQL injection GHSA-jpwx-ffjq-wr4w | High | Not scored | 07 Sep, 2021 | Packagist ezsystems/ezpublish-legacy |
Magento affected by a server-side denial-of-service using a GraphQL field CVE-2021-36044, GHSA-wr57-3h2f-3q95 | High | 2.0% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension CVE-2021-36043, GHSA-36xq-7w8w-xp68 | High | 1.9% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento vulnerable to file upload attack CVE-2021-36041, GHSA-mx5m-j5xr-jg8c | High | 2.4% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento affected by remote code execution via a file upload CVE-2021-36034, GHSA-j46h-qjjv-cxfj | High | 2.4% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento is affected by an improper input validation vulnerability CVE-2021-36032, GHSA-5vw8-r55w-f4q4 | High | 2.2% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Path Traversal vulnerability via the `theme[preview_image]` parameter CVE-2021-36031, GHSA-7w95-qwhh-q9p3 | High | 3.1% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento allows attackers to alter the price of items CVE-2021-36030, GHSA-rhff-65hp-55rw | High | 2.3% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento improper authorization vulnerability CVE-2021-36029, GHSA-m8wx-whpp-q283 | High | 2.5% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento is affected by an os command injection via the Data collection endpoint CVE-2021-36024, GHSA-qmq6-jpvg-j547 | High | 2.9% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento XML Injection vulnerability in the Widgets Update Layout CVE-2021-36022, GHSA-3x9x-vhqj-cv27 | High | 3.4% | 01 Sep, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Improper Encoding or Escaping of Output in Asset Metadata Component CVE-2021-39170, GHSA-2v88-qq7x-xq5f | High | 1.2% | 01 Sep, 2021 | Packagist pimcore/pimcore |