Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Insufficient output escaping of attachment names in PHPMailer BIT-phpmailer-2020-13625, CVE-2020-13625, GHSA-f7hx-fqxw-rvvj | High | 3.8% | 27 May, 2020 | Packagist phpmailer/phpmailer |
Image Resizer Cross-Site Request Forgery (CSRF) CVE-2020-13458, GHSA-5v5q-3m7m-97j7 | High | 0.5% | 25 May, 2020 | Packagist verbb/image-resizer |
Moodle vulnerable to RCE BIT-moodle-2020-10738, CVE-2020-10738, GHSA-vr6v-g96p-cjc3 | High | 3.0% | 21 May, 2020 | Packagist moodle/moodle |
Command Injection in Centreon CVE-2020-13252, GHSA-jmgg-wx67-7qfv | High | 5.4% | 21 May, 2020 | Packagist centreon/centreon |
Microweber allows Unrestricted File Upload CVE-2020-13241, GHSA-89fp-j8v7-p82h | High | 0.5% | 20 May, 2020 | Packagist microweber/microweber |
Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability CVE-2019-20390, GHSA-c4wx-3x5q-hf4w | High | 0.7% | 15 May, 2020 | Packagist intelliants/subrion |
Backend Same-Site Request Forgery in TYPO3 CMS BIT-typo3-2020-11069, CVE-2020-11069, GHSA-pqg8-crx9-g8m4 | High | 0.7% | 13 May, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Insecure Deserialization in Backend User Settings in TYPO3 CMS BIT-typo3-2020-11067, CVE-2020-11067, GHSA-2wj9-434x-9hvp | High | 2.0% | 13 May, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
SEOmatic for CraftCMS allows Server-Side Template Injection CVE-2020-12790, GHSA-23q7-59jj-2pj4 | High | 2.2% | 11 May, 2020 | Packagist nystudio107/craft-seomatic |
Incorrect Authorization in Dolibarr CVE-2020-12669, GHSA-rg8m-84jf-9367 | High | 2.0% | 06 May, 2020 | Packagist dolibarr/dolibarr |
Missing Authorization in TeamPass CVE-2020-11671, GHSA-gmr7-m73x-6c9q | High | 1.1% | 04 May, 2020 | Packagist nilsteampassnet/teampass |
TeamPass PHP arbitrary file include vulnerability CVE-2020-12479, GHSA-6jf9-8m34-96w5 | High | 2.6% | 29 Apr, 2020 | Packagist nilsteampassnet/teampass |
TeamPass files are available without authentication CVE-2020-12478, GHSA-83h6-22cp-f22w | High | 8.6% | 29 Apr, 2020 | Packagist nilsteampassnet/teampass |
Incorrect Authorization in TeamPass CVE-2020-12477, GHSA-fv48-hjhp-94c7 | High | 1.8% | 29 Apr, 2020 | Packagist nilsteampassnet/teampass |
Subrion CMS CSV injection via Export Language CVE-2020-12468, GHSA-4f4h-jgjp-3vfg | High | 0.9% | 29 Apr, 2020 | Packagist intelliants/subrion |
Dolibarr Cross-Site Request Forgery Vulnerability BIT-dolibarr-2020-11825, CVE-2020-11825, GHSA-m66x-wm27-xxpc | High | 1.0% | 16 Apr, 2020 | Packagist dolibarr/dolibarr |
SilverStripe Folders migrated from 3.x may be unsafe to upload to BIT-silverstripe-2020-9280, CVE-2020-9280, GHSA-592m-4533-rxq9 | High | 1.7% | 15 Apr, 2020 | Packagist silverstripe/assets Packagist silverstripe/framework Packagist silverstripe/userforms |
Firewall configured with unanimous strategy was not actually unanimous in Symfony BIT-symfony-2020-5275, CVE-2020-5275, GHSA-g4m9-5hpf-hx72 | High | 1.1% | 30 Mar, 2020 | Packagist symfony/security Packagist symfony/security-http Packagist symfony/symfony |
FrozenNode Laravel-Administrator unrestricted file upload CVE-2020-10963, GHSA-9r2j-rg24-fvpj | High | 14.7% | 25 Mar, 2020 | Packagist frozennode/administrator |
CodeIgniter Improper Privilege Management BIT-codeigniter-2020-10793, CVE-2020-10793, GHSA-jwqp-wh5g-4gmm | High | 1.9% | 23 Mar, 2020 | Packagist codeigniter4/framework |
phpMyAdmin SQL injection vulnerability BIT-phpmyadmin-2020-10802, CVE-2020-10802, GHSA-f4cr-3xmc-2wpm | High | 1.8% | 22 Mar, 2020 | Packagist phpmyadmin/phpmyadmin |
phpMyAdmin SQL Injection BIT-phpmyadmin-2020-10804, CVE-2020-10804, GHSA-h65r-8fp8-w7cx | High | 2.4% | 22 Mar, 2020 | Packagist phpmyadmin/phpmyadmin |
phpBB arbitrary CSS injection CVE-2019-16108, GHSA-8hc2-hvrc-x4qr | High | 1.1% | 20 Mar, 2020 | Packagist phpbb/phpbb |
Subrion CMS CSRF Vulnerability CVE-2018-21037, GHSA-g8j7-w673-4mjp | High | 0.5% | 17 Mar, 2020 | Packagist intelliants/subrion |
Dolibarr ERP and CRM SQLi CVE-2019-19209, GHSA-jh3j-xfv2-f9m9 | High | 2.1% | 16 Mar, 2020 | Packagist dolibarr/dolibarr |
Remote Code Execution Through Image Uploads in BookStack CVE-2020-5256, GHSA-g9rq-x4fj-f5hx | High | 2.0% | 09 Mar, 2020 | Packagist ssddanbrown/bookstack |
Froxlor arbitrary code execution via the database configuration options CVE-2020-10235, GHSA-p29c-jpgj-v57r | High | 1.7% | 09 Mar, 2020 | Packagist froxlor/froxlor |
CardGate Payments plugin for WooCommerce does not validate request origin CVE-2020-8819, GHSA-5pq5-9phv-q5j3 | High | 4.9% | 25 Feb, 2020 | Packagist cardgate/woocommerce |
Origin Validation Error in Magento 2 CVE-2020-8818, GHSA-qf6q-qfwp-vp44 | High | 4.2% | 25 Feb, 2020 | Packagist cardgate/magento2 |
Private data exposure via REST API in BuddyPress CVE-2020-5244, GHSA-3j78-7m59-r7gv | High | 2.4% | 24 Feb, 2020 | Packagist buddypress/buddypress |
Silverstripe CSRF Protection Bypass via GraphQL CVE-2019-12437, GHSA-fx37-56v6-85q6 | High | 0.7% | 19 Feb, 2020 | Packagist silverstripe/graphql |
Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle CVE-2020-5237, GHSA-x8wj-6m73-gfqp | High | 3.9% | 05 Feb, 2020 | Packagist oneup/uploader-bundle |
Magento sql injection vulnerability BIT-magento-2020-3719, CVE-2020-3719, GHSA-rr59-pjwj-6grj | High | 3.2% | 29 Jan, 2020 | Packagist magento/community-edition Packagist magento/core |
Contao core SQL Injection Vulnerability CVE-2012-4383, GHSA-9jq2-jvwc-p52f | High | 0.9% | 29 Jan, 2020 | Packagist contao/core |
Magento arbitrary PHP code execution via the productData parameter CVE-2015-6497, GHSA-j4fq-3fm7-wh5v | High | 7.4% | 15 Jan, 2020 | Packagist magento/core |
DOMPDF Remote Code Execution CVE-2014-5013, GHSA-jjwj-w3gc-gcw4 | High | 4.5% | 10 Jan, 2020 | Packagist dompdf/dompdf |
phpMyAdmin SQL injection in user accounts page BIT-phpmyadmin-2020-5504, CVE-2020-5504, GHSA-fgj8-93xx-f6g6 | High | 39.0% | 09 Jan, 2020 | Packagist phpmyadmin/phpmyadmin |
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841 GHSA-769f-539v-f5jg | High | Not scored | 08 Jan, 2020 | Packagist prestashop/gamification |
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841 GHSA-wqq8-mqj9-697f | High | Not scored | 08 Jan, 2020 | Packagist prestashop/autoupgrade |
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841 GHSA-f884-gm86-cg3q | High | Not scored | 07 Jan, 2020 | Packagist prestashop/ps_facetedsearch |
TYPO3 SQL Injection in low-level Query Generator CVE-2019-19850, GHSA-59pj-7mjh-4465 | High | 0.9% | 17 Dec, 2019 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 Insecure Deserialization in Query Generator & Query View CVE-2019-19849, GHSA-rcgc-4xfc-564v | High | 1.3% | 17 Dec, 2019 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 Directory Traversal on ZIP extraction CVE-2019-19848, GHSA-77p4-wfr8-977w | High | 1.5% | 17 Dec, 2019 | Packagist typo3/cms Packagist typo3/cms-core |
Unrestricted file uploads in Contao CVE-2019-19745, GHSA-wjx8-cgrm-hh8p | High | 1.1% | 17 Dec, 2019 | Packagist contao/contao Packagist contao/core-bundle |
Pagekit File Upload vulnerability CVE-2019-19013, GHSA-692x-89xv-64jx | High | 0.8% | 22 Nov, 2019 | Packagist pagekit/pagekit |
Argument injection in a MimeTypeGuesser in Symfony CVE-2019-18888, GHSA-xhh6-956q-4q69 | High | 2.2% | 21 Nov, 2019 | Packagist symfony/http-foundation Packagist symfony/mime Packagist symfony/symfony |
Symfony Http-Kernel has non-constant time comparison in UriSigner CVE-2019-18887, GHSA-q8hg-pf8v-cxrv | High | 1.3% | 21 Nov, 2019 | Packagist symfony/http-kernel Packagist symfony/symfony |
Improper Input Validation in Centreon Web CVE-2019-16405, GHSA-4f26-v6fr-9hmp | High | 27.0% | 21 Nov, 2019 | Packagist centreon/centreon |
Timing attacks might allow practical recovery of the long-term private key CVE-2019-10764, GHSA-mr6r-82x4-f4jj, SNYK-PHP-SIMPLITOELLIPTICPHP-534576 | High | 1.1% | 18 Nov, 2019 | Packagist simplito/elliptic-php |
Pimcore Discloses Usernames In Use CVE-2019-18986, GHSA-8889-9g3f-73rj | High | 1.2% | 15 Nov, 2019 | Packagist pimcore/pimcore |