Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento SQL Injection vulnerability BIT-magento-2020-24400, CVE-2020-24400, GHSA-pf6w-3pfw-fxvw | High | 2.3% | 09 Nov, 2020 | Packagist magento/community-edition |
Bookstack Cross-site Scripting vulnerability CVE-2020-26211, GHSA-ch37-ch8w-cfrq, GHSA-r2cf-8778-3jgp | High | 1.1% | 03 Nov, 2020 | Packagist ssddanbrown/bookstack |
Edit feed settings and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0 CVE-2020-15273, GHSA-wpww-4jf4-4hx8 | High | 1.0% | 30 Oct, 2020 | Packagist baserproject/basercms |
Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0 CVE-2020-15276, GHSA-fw5q-j9p4-3vxg | High | 1.0% | 30 Oct, 2020 | Packagist baserproject/basercms |
Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0 CVE-2020-15277, GHSA-6fmv-q269-55cw | High | 2.3% | 30 Oct, 2020 | Packagist baserproject/basercms |
SQL Injection in pimcore CVE-2020-7759, GHSA-8jmh-c6vr-pmvm, SNYK-PHP-PIMCOREPIMCORE-1017405 | High | 1.4% | 30 Oct, 2020 | Packagist pimcore/pimcore |
RCE via PHP Object injection via SOAP Requests CVE-2020-15244, GHSA-jrgf-vfw2-hj26 | High | 1.3% | 21 Oct, 2020 | Packagist openmage/magento-lts |
Inline attribute values were not processed. CVE-2020-15263, GHSA-589w-hccm-265x | High | 0.7% | 19 Oct, 2020 | Packagist orchid/platform |
PyroCMS Vulnerable to CSRF CVE-2020-25263, GHSA-vg2g-698h-v9w3 | High | 0.6% | 08 Oct, 2020 | Packagist pyrocms/pyrocms |
OATHAuth extension in MediaWiki is not implementing rate limit BIT-mediawiki-2020-25827, CVE-2020-25827, GHSA-rqvj-fc2x-99q6 | High | 1.7% | 27 Sep, 2020 | Packagist mediawiki/core |
DotPlant2 Improper Restriction of XML External Entity Reference CVE-2020-25750, GHSA-c49v-35ff-q9f7 | High | 1.1% | 18 Sep, 2020 | Packagist devgroup/dotplant |
Exposure of Resource to Wrong Sphere in Drupal Core BIT-drupal-2020-13670, CVE-2020-13670, DRUPAL-CORE-2020-011, GHSA-mmjr-5q74-p3m4 | High | 1.1% | 16 Sep, 2020 | Packagist drupal/core Packagist drupal/drupal |
ThinkAdmin directory traversal vulnerability CVE-2020-25540, GHSA-2qm5-r82g-5hcx | High | 75.3% | 14 Sep, 2020 | Packagist zoujingli/thinkadmin |
Improper Input Validation in Laravel BIT-laravel-2020-24941, CVE-2020-24941, GHSA-w68r-5p45-5rqp | High | 1.1% | 04 Sep, 2020 | Packagist laravel/framework |
Guard bypass in Eloquent models affecting Laravel illuminate database component BIT-laravel-2020-24940, CVE-2020-24940, GHSA-c7rm-w2hj-x8g3 | High | 1.2% | 04 Sep, 2020 | Packagist illuminate/database |
RCE in Symfony BIT-symfony-2020-15094, CVE-2020-15094, GHSA-754h-5r27-7x3r | High | 3.0% | 02 Sep, 2020 | Packagist symfony/http-kernel Packagist symfony/symfony |
Dolibarr Unrestricted Upload of File with Dangerous Type CVE-2020-14209, GHSA-2gcp-xwxg-hqg3 | High | 27.5% | 02 Sep, 2020 | Packagist dolibarr/dolibarr |
Cross-Site Request Forgery in MAGMI CVE-2020-5776, GHSA-cv7m-wc7g-7gfp | High | 14.7% | 01 Sep, 2020 | Packagist dweeves/magmi |
Cross Site Scripting and RCE in baserCMS CVE-2020-15159, GHSA-673x-f5wx-fxpw | High | 2.2% | 28 Aug, 2020 | Packagist baserproject/basercms |
Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings CVE-2020-15155, GHSA-4r3m-j6x5-48m3 | High | 1.3% | 28 Aug, 2020 | Packagist baserproject/basercms |
Cross Site Scripting in baserCMS CVE-2020-15154, GHSA-cpxc-67rc-c775 | High | 1.0% | 28 Aug, 2020 | Packagist baserproject/basercms |
Codiad SSRF Vulnerability CVE-2020-14044, GHSA-c3q8-hh69-7mg5 | High | 3.2% | 24 Aug, 2020 | Packagist codiad/codiad |
Codiad CSRF Vulnerability CVE-2020-14043, GHSA-35gp-jxw8-xw6h | High | 1.5% | 24 Aug, 2020 | Packagist codiad/codiad |
Remote Code Execution in SyliusResourceBundle CVE-2020-15143, GHSA-p4pj-9g59-4ppv | High | 1.9% | 19 Aug, 2020 | Packagist sylius/resource-bundle |
Observable Timing Discrepancy in OpenMage LTS BIT-magento-2020-15151, CVE-2020-15151, GHSA-crf2-xm6x-46p6 | High | 0.9% | 19 Aug, 2020 | Packagist openmage/magento-lts |
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS BIT-typo3-2020-15099, CVE-2020-15099, GHSA-3x94-fv5h-5q2c | High | 1.8% | 29 Jul, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS BIT-typo3-2020-15098, CVE-2020-15098, GHSA-m5vr-3m74-jwxp | High | 2.2% | 29 Jul, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Shopware database password is leaked to an unauthenticated users CVE-2020-13997, GHSA-r4ph-mx67-x58p | High | 1.5% | 28 Jul, 2020 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to SSRF CVE-2020-13970, GHSA-5vmg-x99g-396q | High | 1.3% | 28 Jul, 2020 | Packagist shopware/platform |
Unrestricted Uploads in Concrete5 CVE-2020-11476, GHSA-hf9p-9r39-r2h3 | High | 2.9% | 28 Jul, 2020 | Packagist concrete5/concrete5 |
MunkiReport Software Update module is vulnerable to SQL injection CVE-2020-15887, GHSA-4qgh-m9vp-48xp | High | 1.3% | 23 Jul, 2020 | Packagist munkireport/softwareupdate |
MunkiReport reportdata module SQL injection vulnerability CVE-2020-15886, GHSA-qvw9-6567-wq78 | High | 1.3% | 23 Jul, 2020 | Packagist munkireport/reportdata |
Exposure of Resource to Wrong Sphere in LibreNMS CVE-2020-15877, GHSA-3c33-3465-fhx2 | High | 1.9% | 21 Jul, 2020 | Packagist librenms/librenms |
Microweber Discloses Sensitive Information CVE-2020-13405, GHSA-pmxg-w9c7-ffmq | High | 13.6% | 16 Jul, 2020 | Packagist microweber/microweber |
Silverstripe CMS malicious file upload enables script execution CVE-2020-9309, GHSA-h77w-655f-6j3m | High | 1.8% | 15 Jul, 2020 | Packagist silverstripe/cms |
Silverstripe CMS information disclosure BIT-silverstripe-2020-6164, CVE-2020-6164, GHSA-gm5x-hpmw-xpxg | High | 1.8% | 15 Jul, 2020 | Packagist silverstripe/cms Packagist silverstripe/framework |
Remote code execution in turn extension for TYPO3 CVE-2020-15515, GHSA-q7j5-9j77-g4gq | High | 1.9% | 07 Jul, 2020 | Packagist marcwillmann/turn |
Magento defense-in-depth security mitigation vulnerability BIT-magento-2020-9591, CVE-2020-9591, GHSA-w7rh-9w5v-rwqj | High | 3.4% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core |
Magento Signature verification bypass BIT-magento-2020-9588, CVE-2020-9588, GHSA-j2r4-2cr6-h3r3 | High | 2.9% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core Packagist magento/project-community-edition |
Magento authorization bypass vulnerability BIT-magento-2020-9587, CVE-2020-9587, GHSA-8wm7-h2qh-ff4c | High | 5.0% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core Packagist magento/project-community-edition |
acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation CVE-2020-13700, GHSA-r345-x8hr-2r9p | High | 13.5% | 24 Jun, 2020 | Packagist airesvsg/acf-to-rest-api |
NukeViet Cross-Site Request Forgery (CSRF) CVE-2020-13155, GHSA-7rw5-6pr4-fgh3 | High | 0.7% | 23 Jun, 2020 | Packagist nukeviet/nukeviet |
WooCommerce Cross-Site Request Forgery (CSRF) CVE-2019-20891, GHSA-rcmf-88p4-9wrg | High | 0.5% | 19 Jun, 2020 | Packagist woocommerce/woocommerce |
EC-CUBE Directory traversal vulnerability CVE-2020-5590, GHSA-hx79-x87c-hgm3 | High | 2.1% | 19 Jun, 2020 | Packagist ec-cube/ec-cube |
Dolibarr SQL injection vulnerability in accountancy/customer/card.php CVE-2020-14443, GHSA-8v7v-6mmm-xjxm | High | 1.1% | 18 Jun, 2020 | Packagist dolibarr/dolibarr |
Drupal Core Arbitrary PHP code execution vulnerability BIT-drupal-2020-13664, CVE-2020-13664, DRUPAL-CORE-2020-005, GHSA-x72f-ggjw-v5xh | High | 3.0% | 17 Jun, 2020 | Packagist drupal/core Packagist drupal/drupal |
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability BIT-drupal-2020-13663, CVE-2020-13663, DRUPAL-CORE-2020-004, GHSA-m648-hpf8-qcjw | High | 0.7% | 17 Jun, 2020 | Packagist drupal/core Packagist drupal/drupal |
The filename of uploaded files vulnerable to stored XSS CVE-2020-4041, GHSA-68q3-7wjp-7q3j | High | 2.1% | 08 Jun, 2020 | Packagist bolt/bolt |
CSRF issue on preview pages in Bolt CMS CVE-2020-4040, GHSA-2q66-6cc3-6xm8 | High | 1.8% | 08 Jun, 2020 | Packagist bolt/bolt |
Gravity Forms plugin leak hashed passwords CVE-2020-13764, GHSA-m983-q76g-cwpq | High | 1.8% | 02 Jun, 2020 | Packagist wp-premium/gravityforms |