Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal Open redirect vulnerability in the drupal_goto function CVE-2016-3167, GHSA-gxwx-c7m8-f95h | High | 1.4% | 12 Apr, 2016 | Packagist drupal/core Packagist drupal/drupal |
Drupal Form API ignores access restrictions on submit buttons CVE-2016-3165, GHSA-4gh5-3hqj-x3pj | High | 1.4% | 12 Apr, 2016 | Packagist drupal/core Packagist drupal/drupal |
Drupal Open Redirect CVE-2016-3164, GHSA-836p-6p4j-35cg | High | 1.9% | 12 Apr, 2016 | Packagist drupal/core Packagist drupal/drupal |
Drupal Brute force amplification attacks via XML-RPC CVE-2016-3163, GHSA-h3r9-pjmr-f938 | High | 1.4% | 12 Apr, 2016 | Packagist drupal/core Packagist drupal/drupal |
Drupal File upload access bypass and denial of service CVE-2016-3162, GHSA-w2pj-c8x5-jvg2 | High | 1.6% | 12 Apr, 2016 | Packagist drupal/core Packagist drupal/drupal |
Moodle multiple cross-site request forgery (CSRF) vulnerabilities CVE-2015-5338, GHSA-v33x-q8gh-4x42 | High | 0.8% | 22 Feb, 2016 | Packagist moodle/moodle |
Moodle uses predictable password-recovery tokens CVE-2015-5267, GHSA-382v-gxj9-ffhc | High | 2.4% | 22 Feb, 2016 | Packagist moodle/moodle |
Moodle open redirect vulnerability CVE-2015-3272, GHSA-2hw2-h3mf-c2j9 | High | 1.8% | 22 Feb, 2016 | Packagist moodle/moodle |
phpMyAdmin Unsafe comparison of XSRF/CSRF token CVE-2016-2041, GHSA-8m97-xc46-rw9w | High | 2.6% | 20 Feb, 2016 | Packagist phpmyadmin/phpmyadmin |
phpMyAdmin Cryptographic Vulnerability CVE-2016-1927, GHSA-4gmg-gwjh-3mmr | High | 2.7% | 20 Feb, 2016 | Packagist phpmyadmin/phpmyadmin |
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter CVE-2015-8379, GHSA-556q-h4vr-pgh2 | High | 1.4% | 26 Jan, 2016 | Packagist cakephp/cakephp |
Joomla! Framework Remote Code Injection Vulnerability CVE-2015-8566, GHSA-wwfh-28hx-w2r2 | High | 8.5% | 16 Dec, 2015 | Packagist joomla/session |
Symfony Vulnerable to Timing Attack CVE-2015-8125, GHSA-g97c-jfx6-xvxh | High | 2.5% | 07 Dec, 2015 | Packagist symfony/form Packagist symfony/security Packagist symfony/security-http Packagist symfony/symfony |
Twig remote code execution in templates CVE-2015-7809, GHSA-xw83-pwrm-9j74 | High | 3.4% | 06 Nov, 2015 | Packagist twig/twig |
phpMyAdmin allows remote attackers to spoof content via the url parameter CVE-2015-7873, GHSA-5pmg-qh2c-7j24 | High | 2.6% | 28 Oct, 2015 | Packagist phpmyadmin/phpmyadmin |
DataTable Vulnerable to Cross-Site Scripting CVE-2015-6584, GHSA-4mv4-gmmf-q382 | High | 2.7% | 11 Sep, 2015 | Packagist datatables/datatables npm datatables |
Centreon Command Injection CVE-2015-1561, GHSA-c4fj-3wqq-g9c9 | High | 8.3% | 14 Jul, 2015 | Packagist centreon/centreon |
Slim vulnerable to PHP object injection CVE-2015-2171, GHSA-74mf-vjpg-9xh7 | High | 2.5% | 30 Mar, 2015 | Packagist slim/slim |
Typo3 Vulnerable to Cache Poisoning CVE-2014-9509, GHSA-5479-gqqr-f9gj | High | 1.5% | 04 Jan, 2015 | Packagist typo3/cms |
Moodle Temporary Passwords are Brute Force-able CVE-2014-7845, GHSA-9v64-447r-wch6 | High | 2.4% | 24 Nov, 2014 | Packagist moodle/moodle |
MAGMI plugin for Magento Unsafe File Upload CVE-2014-8770, GHSA-x3gh-95p8-43qv | High | 6.5% | 13 Nov, 2014 | Packagist dweeves/magmi |
Smarty arbitrary PHP code execution CVE-2014-8350, GHSA-2pmx-6mm6-6v72 | High | 3.1% | 03 Nov, 2014 | Packagist smarty/smarty |
WEC Map (wec_map) extension for TYPO3 allows SQL Injection CVE-2014-6295, GHSA-f3v6-g4mv-pjhq | High | 1.2% | 03 Oct, 2014 | Packagist jbartels/wec-map Packagist web-tp3/wec_map |
yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions CVE-2014-6289, GHSA-46fq-683f-2jwq | High | 1.5% | 03 Oct, 2014 | Packagist dl/yag Packagist punktde/pt_extbase |
TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism CVE-2014-6288, GHSA-2jq7-pgqq-gqqj | High | 1.9% | 03 Oct, 2014 | Packagist in2code/powermail |
TYPO3 powermail extension has unrestricted file upload vulnerability CVE-2014-3947, GHSA-m278-c6gg-4jrr | High | 2.3% | 03 Oct, 2014 | Packagist in2code/powermail |
Moodle vulnerable to PHP object injection attacks CVE-2014-3541, GHSA-fccf-p8fx-vjj4 | High | 3.7% | 29 Jul, 2014 | Packagist moodle/moodle |
Yii PHP Framework arbitrary PHP scripts execution CVE-2014-4672, GHSA-74qv-rv53-5wcx | High | 2.1% | 03 Jul, 2014 | Packagist yiisoft/yii |
GeSHi vulnerable to Directory Traversal CVE-2012-3521, GHSA-fw3x-2pr2-5j64 | High | 3.2% | 13 Jun, 2014 | Packagist geshi/geshi |
XXE in SabreDAV CVE-2014-2055, GHSA-qm4x-ch5w-gr62 | High | 2.2% | 04 Jun, 2014 | Packagist sabre/dav |
PHPExcel vulnerable to XXE attacks through libxml CVE-2014-2054, GHSA-28rm-rj57-qjpv | High | 1.5% | 04 Jun, 2014 | Packagist phpoffice/phpexcel |
getID3 is vulnerable to XML External Entity (XXE) CVE-2014-2053, GHSA-5v43-55m5-qr8f | High | 4.7% | 04 Jun, 2014 | Packagist james-heinrich/getid3 |
TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code CVE-2014-3942, GHSA-55g3-fjwm-w2c8 | High | 1.6% | 03 Jun, 2014 | Packagist typo3/cms |
Symfony Arbitrary PHP code Execution CVE-2013-1397, GHSA-7w53-hfpw-rg3g | High | 1.6% | 02 Jun, 2014 | Packagist symfony/symfony Packagist symfony/yaml |
Symphony Vulnerable to PHP Code Injection via YAML Parsing CVE-2013-1348, GHSA-2r5h-6r7v-5m7c | High | 1.6% | 02 Jun, 2014 | Packagist symfony/symfony Packagist symfony/yaml |
TYPO3 vulnerable to remote authenticated arbitrary code execution CVE-2013-4321, GHSA-m76j-69c2-c3m8 | High | 1.1% | 20 May, 2014 | Packagist typo3/cms |
TYPO3 doesn't properly check file extensions CVE-2013-4250, GHSA-54jj-pxx2-pv8h | High | 1.2% | 20 May, 2014 | Packagist typo3/cms |
Pimcore Vulnerable to PHP Object Injection Attacks CVE-2014-2921, GHSA-g7pj-3v97-3vxp | High | 6.4% | 21 Apr, 2014 | Packagist pimcore/pimcore |
Drupal has open redirect vulnerability in the Overlay module CVE-2013-6389, GHSA-hxg2-5c8p-ppwm | High | 1.2% | 07 Dec, 2013 | Packagist drupal/drupal |
PHP OpenID Library Denial of Service vulnerability CVE-2013-4701, GHSA-5qp6-78pr-gv8c | High | 3.0% | 21 Aug, 2013 | Packagist openid/php-openid Packagist typo3/cms |
CoolURI extension for TYPO3 vulnerable to SQL Injection CVE-2013-5322, GHSA-r3rw-h5v8-ff6h | High | 1.4% | 20 Aug, 2013 | Packagist bednee/cooluri |
News system (news) extension for TYPO3 vulnerable to SQL Injection CVE-2013-4748, GHSA-rg6g-v4xm-g49q | High | 1.2% | 01 Jul, 2013 | Packagist georgringer/news |
Multishop extension for TYPO3 has SQL Injection vulnerability CVE-2013-4682, GHSA-v4fw-fh5c-xvjg | High | 1.2% | 25 Jun, 2013 | Packagist bvbmedia/multishop |
phpMyAdmin Remote Code Execution CVE-2013-3239, GHSA-gg36-9346-9qx9 | High | 8.8% | 26 Apr, 2013 | Packagist phpmyadmin/phpmyadmin |
TYPO3 SQL injection vulnerability in the Extbase Framework CVE-2013-1842, GHSA-m64j-j252-jxmr | High | 3.1% | 20 Mar, 2013 | Packagist typo3/cms-core |
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references CVE-2012-4399, GHSA-5964-pq8r-4q62 | High | 12.1% | 09 Oct, 2012 | Packagist cakephp/cakephp |
ImpressPages CMS eval injection vulnerability CVE-2011-4932, GHSA-fr34-mx6j-vpxh | High | 3.9% | 06 Oct, 2012 | Packagist impresspages/impresspages |
PHPMailer vulnerable to email header injection CVE-2012-0796, GHSA-398j-f7m7-795j | High | 1.7% | 17 Jul, 2012 | Packagist phpmailer/phpmailer |
Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands CVE-2010-4962, GHSA-xq29-jcj7-xg86 | High | 1.9% | 09 Oct, 2011 | Packagist dmk/webkitpdf |
Webkit PDFs for TYPO3 has SQL Injection vulnerability CVE-2010-4961, GHSA-9568-hcj9-rf7v | High | 1.1% | 09 Oct, 2011 | Packagist dmk/webkitpdf |