Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Improper user session handling in filegator CVE-2022-1849, GHSA-47vg-483w-hp3m | Medium | 0.8% | 24 May, 2022 | Packagist filegator/filegator |
Exposure of Sensitive Information in moodle BIT-moodle-2022-30598, CVE-2022-30598, GHSA-fj6p-g234-rrv3 | Medium | 1.1% | 18 May, 2022 | Packagist moodle/moodle |
External Control of Assumed-Immutable Web Parameter in moodle BIT-moodle-2022-30597, CVE-2022-30597, GHSA-x6gm-qqwp-76gr | Medium | 1.3% | 18 May, 2022 | Packagist moodle/moodle |
Cross-site Scripting in moodle BIT-moodle-2022-30596, CVE-2022-30596, GHSA-wvh5-78h5-gmgr | Medium | 0.9% | 18 May, 2022 | Packagist moodle/moodle |
Cross-site Scripting in Jirafeau CVE-2022-30110, GHSA-j2xf-p274-g8cc | Medium | 0.6% | 17 May, 2022 | Packagist mojo42/jirafeau |
Cross-site Scripting in facturascripts CVE-2022-1682, GHSA-6465-r752-2h8v | Medium | 0.8% | 12 May, 2022 | Packagist facturascripts/facturascripts |
Improper Access Control in wp-graphql CVE-2019-25060, GHSA-w3xg-7q6m-3xwp | Medium | 1.8% | 09 May, 2022 | Packagist wp-graphql/wp-graphql |
Unrestricted Upload of File with Dangerous Type in yetiforce-crm CVE-2022-1411, GHSA-pqr6-3j58-9w58 | Medium | 0.8% | 05 May, 2022 | Packagist yetiforce/yetiforce-crm |
Cross-site Scripting in Microweber CVE-2022-1584, GHSA-f23x-4gf4-m9ff | Medium | 0.9% | 04 May, 2022 | Packagist microweber/microweber |
MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php CVE-2022-28508, GHSA-wfg2-2wmw-6894 | Medium | 5.2% | 04 May, 2022 | Packagist mantisbt/mantisbt |
Cross-site Scripting in FacturaScripts CVE-2022-1571, GHSA-m8gv-gvhf-7rhp | Medium | 0.9% | 04 May, 2022 | Packagist facturascripts/facturascripts |
Microweber vulnerable to cross-site scripting (XSS) CVE-2022-1555, GHSA-6346-5r4h-ff5x | Medium | 1.3% | 04 May, 2022 | Packagist microweber/microweber |
SCart is vulnerable to cross-site scripting (XSS) CVE-2022-21149, GHSA-7pfc-cx3m-v22x | Medium | 0.6% | 01 May, 2022 | Packagist s-cart/core Packagist s-cart/s-cart |
Missing authorization in Moodle BIT-moodle-2022-0984, CVE-2022-0984, GHSA-c5hf-mc85-2hx4 | Medium | 0.6% | 29 Apr, 2022 | Packagist moodle/moodle |
Improper Authentication in moodle BIT-moodle-2022-0985, CVE-2022-0985, GHSA-6q9g-3vfq-q2qj | Medium | 0.6% | 29 Apr, 2022 | Packagist moodle/moodle |
Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin CVE-2021-41948, GHSA-jv64-2m3x-6v4q | Medium | 0.5% | 29 Apr, 2022 | Packagist intelliants/subrion |
An attacker can execute malicious javascript in Live Helper Chat BIT-livehelperchat-2022-1530, CVE-2022-1530, GHSA-9hgc-wpc5-v8p9 | Medium | 0.7% | 29 Apr, 2022 | Packagist remdex/livehelperchat |
Improper Access Control in snipe/snipe-it CVE-2022-1511, GHSA-p2vw-f87c-q597 | Medium | 1.1% | 28 Apr, 2022 | Packagist snipe/snipe-it |
Reflected Cross-site Scripting in Shopware storefront CVE-2022-24873, GHSA-4g29-fccr-p59w | Medium | 0.8% | 28 Apr, 2022 | Packagist shopware/shopware |
Cross-site Scripting in microweber CVE-2022-1504, GHSA-6xj3-fhrf-rjgc | Medium | 1.0% | 27 Apr, 2022 | Packagist microweber/microweber |
Stored cross site scripting in getgrav/grav CVE-2022-1173, GHSA-3p5m-j98p-c698 | Medium | 1.5% | 26 Apr, 2022 | Packagist getgrav/grav |
Stored cross-site scripting in Snipe-IT CVE-2022-1445, GHSA-hpx4-xjp7-m4vr | Medium | 0.8% | 24 Apr, 2022 | Packagist snipe/snipe-it |
Cross-site Scripting in Microweber CVE-2022-1439, GHSA-9w7h-3wwh-6m5q | Medium | 3.3% | 22 Apr, 2022 | Packagist microweber/microweber |
Access bypass in Drupal core BIT-drupal-2022-25274, CVE-2022-25274, DRUPAL-CORE-2022-009, GHSA-7jr4-hgqx-vwgq | Medium | 0.4% | 20 Apr, 2022 | Packagist drupal/core |
Cross site scripting in safe-svg CVE-2022-1091, GHSA-5h7w-hmxc-99g5 | Medium | 1.2% | 18 Apr, 2022 | Packagist darylldoyle/safe-svg |
Cross-site Scripting in snipe-it CVE-2022-1380, GHSA-p885-prv3-m4xv | Medium | 0.8% | 16 Apr, 2022 | Packagist snipe/snipe-it |
Cross-site Scripting in Pimcore CVE-2022-1351, GHSA-xcr3-4qvr-54rh | Medium | 0.8% | 14 Apr, 2022 | Packagist pimcore/pimcore |
MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php CVE-2022-26144, GHSA-rqgj-rqfr-5j6f | Medium | 0.8% | 13 Apr, 2022 | Packagist mantisbt/mantisbt |
HTML Injection in Froxlor CVE-2020-29653, GHSA-j739-gw6q-f4c7 | Medium | 1.4% | 13 Apr, 2022 | Packagist froxlor/froxlor |
Open redirect in wwbn/avideo CVE-2022-27463, GHSA-34hv-f45p-4qfq | Medium | 0.6% | 05 Apr, 2022 | Packagist wwbn/avideo |
Cross-site Scripting in craftcms/cms CVE-2022-28378, GHSA-7xj5-fwqr-5378 | Medium | 0.6% | 03 Apr, 2022 | Packagist craftcms/cms |
Improper Certificate Validation in node-sass affects eZ Platform GHSA-6v6p-g8cg-2hgg | Medium | Not scored | 01 Apr, 2022 | Packagist ezsystems/ezplatform-admin-ui |
Cross-site Scripting (XSS) within joomla/filter class BIT-joomla-2022-23800, CVE-2022-23800, GHSA-qcv6-h33g-hvrc | Medium | 0.7% | 30 Mar, 2022 | Packagist joomla/filter |
Path Disclosure within joomla/filesystem class BIT-joomla-2022-23794, CVE-2022-23794, GHSA-rc8q-45v8-x6xc | Medium | 0.9% | 30 Mar, 2022 | Packagist joomla/filesystem |
Cross-site Scripting in teampass CVE-2022-26980, GHSA-m2wv-m5pf-284r | Medium | 1.1% | 28 Mar, 2022 | Packagist nilsteampassnet/teampass |
Incorrect Access Control in ImpressCMS CVE-2021-26598, GHSA-48p3-xfvw-g59c | Medium | 10.5% | 28 Mar, 2022 | Packagist impresscms/impresscms |
Cross-Site Request Forgery in Anchor CMS CVE-2022-25576, GHSA-322v-p3jc-7hrg | Medium | 0.4% | 24 Mar, 2022 | Packagist anchorcms/anchor-cms |
Cross-site Scripting in Pimcore Datahub BIT-pimcore-2022-0955, CVE-2022-0955, GHSA-vc5r-xfc4-4x22 | Medium | 0.6% | 24 Mar, 2022 | Packagist pimcore/data-hub |
Cross-site Scripting in Fork CMS CVE-2022-0145, GHSA-qf2g-q4mc-w7rr | Medium | 0.7% | 24 Mar, 2022 | Packagist forkcms/forkcms |
Possibility for Denial of Service by overwriting PHP files with language exports GHSA-3fvf-2gp4-89wq | Medium | Not scored | 18 Mar, 2022 | Packagist barryvdh/laravel-translation-manager |
Cross-site Scripting in Pimcore CVE-2022-0705, GHSA-xmq3-hgjx-6997 | Medium | 0.5% | 16 Mar, 2022 | Packagist pimcore/pimcore |
Cross-site Scripting in Pimcore CVE-2022-0704, GHSA-pc32-x737-74cv | Medium | 1.3% | 16 Mar, 2022 | Packagist pimcore/pimcore |
Cross-site Scripting in Pimcore CVE-2022-0911, GHSA-j29f-m23h-3p8p | Medium | 0.8% | 16 Mar, 2022 | Packagist pimcore/pimcore |
Stored Cross-site Scripting in showdoc CVE-2022-0967, GHSA-3pg8-c473-w6rr | Medium | 3.3% | 15 Mar, 2022 | Packagist showdoc/showdoc |
Cross-site Scripting in ShowDoc CVE-2022-0966, GHSA-g585-j55v-38h7 | Medium | 0.5% | 15 Mar, 2022 | Packagist showdoc/showdoc |
Cross-site Scripting in ShowDoc CVE-2022-0965, GHSA-v8mp-hhjq-h4cj | Medium | 0.9% | 15 Mar, 2022 | Packagist showdoc/showdoc |
Cross-site Scripting in ShowDoc CVE-2022-0964, GHSA-xm3x-787m-p66r | Medium | 0.8% | 15 Mar, 2022 | Packagist showdoc/showdoc |
Unrestricted XML files leading to cross-site scripting in Microweber CVE-2022-0963, GHSA-q3x2-jvp3-wj78 | Medium | 1.9% | 15 Mar, 2022 | Packagist microweber/microweber |
Cross-site Scripting in ShowDoc CVE-2022-0942, GHSA-9fcc-7g44-mxrj | Medium | 0.8% | 15 Mar, 2022 | Packagist showdoc/showdoc |
Cross-site Scripting in ShowDoc CVE-2022-0957, GHSA-q73m-3q7r-fpf7 | Medium | 0.8% | 15 Mar, 2022 | Packagist showdoc/showdoc |