Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site scripting in Centreon CVE-2021-27676, GHSA-r5mf-q76q-f2xq | Medium | 0.6% | 26 May, 2021 | Packagist centreon/centreon |
Information leakage in Error Handler GHSA-9vxv-wpv4-f52p | Medium | Not scored | 21 May, 2021 | Packagist shopware/shopware |
Authenticated Stored XSS in Administration GHSA-f6p7-8xfw-fjqq | Medium | Not scored | 21 May, 2021 | Packagist shopware/shopware |
Woocommerce Cross-site Scripting via Additional tax classes field when taxes are enabled CVE-2021-24323, GHSA-mp46-7x6q-f28m | Medium | 0.7% | 17 May, 2021 | Packagist woocommerce/woocommerce |
Prevent user enumeration using Guard or the new Authenticator-based Security BIT-symfony-2021-21424, CVE-2021-21424, GHSA-5pv8-ppvj-4h68 | Medium | 1.6% | 13 May, 2021 | Packagist lexik/jwt-authentication-bundle Packagist symfony/maker-bundle Packagist symfony/security Packagist symfony/security-core +3 more |
EC-CUBE Cross-site scripting vulnerability CVE-2021-20717, GHSA-c8mx-43cq-993w | Medium | 2.3% | 10 May, 2021 | Packagist ec-cube/ec-cube |
Craft CMS Cross-site Scripting Vulnerability CVE-2021-32470, GHSA-h2rj-8wgg-mm43 | Medium | 0.7% | 07 May, 2021 | Packagist craftcms/cms |
Cross-site scripting in forkcms CVE-2020-23263, GHSA-vp4x-94ff-2cmv | Medium | 0.8% | 06 May, 2021 | Packagist forkcms/forkcms |
Drupal Core Open Redirect vulnerability BIT-drupal-2020-13662, CVE-2020-13662, GHSA-gjqg-9rhv-qj67 | Medium | 0.9% | 05 May, 2021 | Packagist drupal/core Packagist drupal/drupal |
Bypass of fix for CVE-2020-26231, Twig sandbox escape CVE-2021-21264, GHSA-fcr8-6q7r-m4wg | Medium | 0.3% | 03 May, 2021 | Packagist october/cms |
Server-Side Request Forgery in yoast_seo CVE-2021-31779, GHSA-m2q4-qghh-p9cq | Medium | 0.5% | 28 Apr, 2021 | Packagist yoast-seo-for-typo3/yoast_seo |
Cross-site scripting in media2click CVE-2021-31778, GHSA-xpxm-pf7g-2534 | Medium | 0.5% | 28 Apr, 2021 | Packagist amazing/media2click |
Cross-Site Scripting in Bootstrap Package BIT-typo3-2021-21365, CVE-2021-21365, GHSA-p48w-vf3c-rqjx | Medium | 0.9% | 27 Apr, 2021 | Packagist bk2k/bootstrap-package |
Drupal core Cross-site Scripting (XSS) vulnerability BIT-drupal-2020-13672, CVE-2020-13672, DRUPAL-CORE-2021-002, GHSA-3m36-mjwj-352c | Medium | 0.7% | 21 Apr, 2021 | Packagist drupal/core Packagist drupal/drupal |
Predictable CSRF tokens in centreon/centreon CVE-2021-28055, GHSA-7rg4-266c-jqw6 | Medium | 0.8% | 15 Apr, 2021 | Packagist centreon/centreon |
reflected XSS in tribalsystems/zenario CVE-2021-27673, GHSA-8hcm-jj4x-4gmr | Medium | 1.1% | 15 Apr, 2021 | Packagist tribalsystems/zenario |
SQL Injection in tribalsystems/zenario CVE-2021-27672, GHSA-gxcm-36qw-j29v | Medium | 1.3% | 15 Apr, 2021 | Packagist tribalsystems/zenario |
Cross Site Scripting (XSS) in LavaLite 5.8.0 CVE-2020-28124, GHSA-6r6h-vhg7-53x7 | Medium | 0.5% | 14 Apr, 2021 | Packagist lavalite/cms |
Exposure of .env if project root is configured as web root in shopware/production GHSA-3pcr-4982-548m | Medium | Not scored | 13 Apr, 2021 | Packagist shopware/production Packagist shopware/shopware |
subrion CMS Cross Site Scripting (XSS) vulnerability CVE-2020-23761, GHSA-xhc3-5pgf-p576 | Medium | 1.0% | 09 Apr, 2021 | Packagist intelliants/subrion |
Wikimedia Parsoid vulnerable to Cross-site Scripting (XSS) CVE-2021-30458, GHSA-5pqx-77vf-85rw | Medium | 1.0% | 09 Apr, 2021 | Packagist wikimedia/parsoid |
Potential XSS injection in the newsletter conditions field CVE-2021-21418, GHSA-vwfx-hh3w-fj99 | Medium | 0.8% | 31 Mar, 2021 | Packagist prestashop/ps_emailsubscription |
Craft CMS Cross-site Scripting Vulnerability CVE-2020-19626, GHSA-33jj-92px-m4g7 | Medium | 0.8% | 26 Mar, 2021 | Packagist craftcms/cms |
Cross-site Scripting (XSS) in baserCMS CVE-2021-20683, GHSA-v9w8-hq92-v39m | Medium | 0.7% | 26 Mar, 2021 | Packagist baserproject/basercms |
Cross-site Scripting (XSS) in baserCMS CVE-2021-20681, GHSA-24p5-x9f9-vvpx | Medium | 0.7% | 26 Mar, 2021 | Packagist baserproject/basercms |
Mautic vulnerable to secret data exfiltration via symfony parameters CVE-2021-27908, GHSA-4hjq-422q-4vpx | Medium | 0.3% | 23 Mar, 2021 | Packagist mautic/core |
Cross-Site Scripting in Content Preview (CType menu) BIT-typo3-2021-21370, CVE-2021-21370, GHSA-x7hc-x7fm-f7qh | Medium | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-backend Packagist typo3/cms-core |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form BIT-typo3-2021-21358, CVE-2021-21358, GHSA-x79j-wgqv-g8h2 | Medium | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/cms-form |
Cross-Site Scripting in Content Preview BIT-typo3-2021-21340, CVE-2021-21340, GHSA-fjh3-g8gq-9q92 | Medium | 0.9% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-backend Packagist typo3/cms-core |
Open Redirection in Login Handling BIT-typo3-2021-21338, CVE-2021-21338, GHSA-4jhw-2p6j-5wmp | Medium | 1.1% | 23 Mar, 2021 | Packagist typo3/cms Packagist typo3/cms-core |
Reflected XSS in Zen Cart before 1.5.7a CVE-2020-6578, GHSA-wxxx-2x6v-979f | Medium | 0.8% | 19 Mar, 2021 | Packagist zencart/zencart |
Concrete CMS Cross-site Scripting via Survey Blocks CVE-2021-28145, GHSA-7388-7vq2-m4f4 | Medium | 0.9% | 18 Mar, 2021 | Packagist concrete5/concrete5 |
Aimeos Typo3 extension contains Cross-site Scripting vulnerability CVE-2021-28380, GHSA-73wv-rgj7-vjj9 | Medium | 0.6% | 16 Mar, 2021 | Packagist aimeos/aimeos-typo3 |
XSS in CreateQueuedJobTask CVE-2021-27938, GHSA-xgpf-p52j-pf7m | Medium | 0.8% | 16 Mar, 2021 | Packagist symbiote/silverstripe-queuedjobs |
Missing permission check in Moodle BIT-moodle-2021-20283, CVE-2021-20283, GHSA-2m72-m5cw-3g9h | Medium | 1.1% | 15 Mar, 2021 | Packagist moodle/moodle |
Moodle Bypass email verification secret when confirming account registration BIT-moodle-2021-20282, CVE-2021-20282, GHSA-grj4-g57c-9xmv | Medium | 1.3% | 15 Mar, 2021 | Packagist moodle/moodle |
Moodle allowed some users without permission to view other users' full names BIT-moodle-2021-20281, CVE-2021-20281, GHSA-93wh-35r4-6qmw | Medium | 1.4% | 15 Mar, 2021 | Packagist moodle/moodle |
Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle BIT-moodle-2021-20280, CVE-2021-20280, GHSA-x2jp-hh65-4xvf | Medium | 1.3% | 15 Mar, 2021 | Packagist moodle/moodle |
Moodle contains Stored XSS via ID number user profile field BIT-moodle-2021-20279, CVE-2021-20279, GHSA-h7h6-fwpv-ggvx | Medium | 1.0% | 15 Mar, 2021 | Packagist moodle/moodle |
Grav CMS Local File Injection CVE-2020-29556, GHSA-r3rg-jrjq-w4mr | Medium | 1.0% | 15 Mar, 2021 | Packagist getgrav/grav |
Authenticated remote code execution GHSA-pjj4-jjgc-h3r8 | Medium | Not scored | 12 Mar, 2021 | Packagist shopware/platform |
/user/sessions endpoint allows detecting valid accounts CVE-2021-46876, GHSA-gmrf-99gw-vvwj | Medium | 0.5% | 11 Mar, 2021 | Packagist ezsystems/ezpublish-kernel |
Cross-site scripting (XSS) CVE-2021-28088, GHSA-79hv-pfx6-hhpj | Medium | 0.9% | 11 Mar, 2021 | Packagist impresscms/impresscms |
Path Traversal within joomla/archive zip class BIT-joomla-2021-26028, CVE-2021-26028, GHSA-vgwr-773q-7j3c | Medium | 1.0% | 04 Mar, 2021 | Packagist joomla/archive |
qcubed reflected cross-site scripting (XSS) vulnerability CVE-2020-24912, GHSA-xj4v-gp4q-h6qq | Medium | 6.3% | 04 Mar, 2021 | Packagist qcubed/qcubed |
MantisBT XSS in manage_custom_field_update.php CVE-2020-35571, GHSA-cvrm-cr3m-qj92 | Medium | 0.7% | 22 Feb, 2021 | Packagist mantisbt/mantisbt |
Stored cross-site scripting in PressBooks CVE-2021-3271, GHSA-9652-78hp-w58c | Medium | 0.9% | 18 Feb, 2021 | Packagist pressbooks/pressbooks |
Magento Insufficient Session Expiration BIT-magento-2021-21032, CVE-2021-21032, GHSA-4jfq-f8hc-775q | Medium | 1.6% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Insufficient Session Expiration BIT-magento-2021-21031, CVE-2021-21031, GHSA-4h3p-63x6-vwg2 | Medium | 1.7% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Reflected Cross-site Scripting vulnerability via 'file' parameter BIT-magento-2021-21029, CVE-2021-21029, GHSA-jwxh-wj79-ccm6 | Medium | 84.6% | 11 Feb, 2021 | Packagist magento/community-edition |