Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Magento cross-site request forgery (CSRF) vulnerability via the GraphQL API BIT-magento-2021-21027, CVE-2021-21027, GHSA-h4xc-577p-hgj9 | Medium | 1.7% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento improper authorization vulnerability in the integrations module BIT-magento-2021-21026, CVE-2021-21026, GHSA-crjc-2v9m-8w7r | Medium | 1.8% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability in the admin console BIT-magento-2021-21023, CVE-2021-21023, GHSA-h5rm-m772-6qcx | Medium | 1.6% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Insecure Direct Object Reference (IDOR) in the product module BIT-magento-2021-21022, CVE-2021-21022, GHSA-8pfq-g48p-x7w8 | Medium | 2.2% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento Improper Access Control BIT-magento-2021-21020, CVE-2021-21020, GHSA-2j6v-829g-885q | Medium | 2.4% | 11 Feb, 2021 | Packagist magento/community-edition Packagist magento/project-community-edition |
vrana/adminer via XSS in the history parameter in SQL command CVE-2020-35572, GHSA-9pgx-gcph-mpqr | Medium | 2.0% | 09 Feb, 2021 | Packagist vrana/adminer |
Users can edit the tags of any discussion GHSA-32wx-4gxx-h48f | Medium | Not scored | 29 Jan, 2021 | Packagist flarum/tags |
MantisBT Incorrect Authorization in bug_actiongroup_page.php CVE-2020-29605, GHSA-pgg9-mmcg-8mxp | Medium | 0.9% | 29 Jan, 2021 | Packagist mantisbt/mantisbt |
MantisBT Missing Authorization access check in bug_actiongroup.php CVE-2020-29604, GHSA-f38c-wxp6-8xjv | Medium | 1.1% | 29 Jan, 2021 | Packagist mantisbt/mantisbt |
MantisBT Insecure Storage in manage_proj_edit_page.php CVE-2020-29603, GHSA-qpj5-f88q-x7px | Medium | 1.1% | 29 Jan, 2021 | Packagist mantisbt/mantisbt |
Moodle Client side denial of service via personal message BIT-moodle-2021-20185, CVE-2021-20185, GHSA-c3j6-33r4-89q3 | Medium | 1.4% | 28 Jan, 2021 | Packagist moodle/moodle |
Moodle Cross-site Scripting BIT-moodle-2021-20186, CVE-2021-20186, GHSA-h8m4-h385-qhqv | Medium | 0.8% | 28 Jan, 2021 | Packagist moodle/moodle |
Moodle Grade information disclosure in grade's external fetch functions BIT-moodle-2021-20184, CVE-2021-20184, GHSA-mm73-86f9-5x5c | Medium | 0.7% | 28 Jan, 2021 | Packagist moodle/moodle |
Moodle Vulnerable to Reflected Cross-site Scripting BIT-moodle-2021-20183, CVE-2021-20183, GHSA-xhfx-rm8q-c3xv | Medium | 0.8% | 28 Jan, 2021 | Packagist moodle/moodle |
XSS in Flarum Sticky extension CVE-2021-21283, GHSA-h3gg-7wx2-cq3h | Medium | 0.8% | 26 Jan, 2021 | Packagist flarum/sticky |
Feehi CMS vulnerable to Cross-site Scripting in Username Field CVE-2020-21146, GHSA-v762-47vh-j7q3 | Medium | 0.8% | 26 Jan, 2021 | Packagist feehi/cms |
Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature CVE-2020-27852, GHSA-pjv5-v9gv-3679 | Medium | 0.8% | 20 Jan, 2021 | Packagist wp-premium/gravityforms |
Gravity Forms stored HTML injection vulnerability CVE-2020-27851, GHSA-fcj2-rxqc-294c | Medium | 0.8% | 20 Jan, 2021 | Packagist wp-premium/gravityforms |
Gravity Forms stored Cross-Site Scripting (XSS) vulnerability CVE-2020-27850, GHSA-wmh7-782f-xfw5 | Medium | 0.8% | 20 Jan, 2021 | Packagist wp-premium/gravityforms |
Cross-site scripting vulnerability in TinyMCE CVE-2024-21911, GHSA-w7jx-j77m-wp65 | Medium | 1.2% | 06 Jan, 2021 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
MantisBT SQL Injection via mc_project_get_users function CVE-2020-28413, GHSA-49w9-82cj-xr48 | Medium | 4.8% | 30 Dec, 2020 | Packagist mantisbt/mantisbt |
OS Command injection in Bolt CVE-2020-28925, GHSA-w8cj-mvf9-mpc9 | Medium | 1.1% | 30 Dec, 2020 | Packagist bolt/bolt |
OpenCart Stored Cross-Site Scripting CVE-2020-29471, GHSA-7vrp-3pff-c3j4 | Medium | 1.3% | 29 Dec, 2020 | Packagist opencart/opencart |
OpenCart Cross-site Scripting (XSS) in the Subject field of mail. CVE-2020-29470, GHSA-87cv-57p8-j33x | Medium | 1.7% | 29 Dec, 2020 | Packagist opencart/opencart |
WooCommerce Incorrect Authorization CVE-2020-29156, GHSA-wwh8-v3j3-gxfw | Medium | 4.0% | 27 Dec, 2020 | Packagist woocommerce/woocommerce |
browsershot local file inclusion vulnerability CVE-2020-7790, GHSA-rv74-mh27-4jpv | Medium | 1.0% | 11 Dec, 2020 | Packagist spatie/browsershot |
Cross-Site Scripting in Grav CVE-2020-37256, GHSA-cvmr-6428-87w9 | Medium | 0.3% | 10 Dec, 2020 | Packagist getgrav/grav |
Cross-site scripting in phpoffice/phpspreadsheet CVE-2020-7776, GHSA-4mqv-gcr3-pff9, SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856 | Medium | 1.3% | 09 Dec, 2020 | Packagist phpoffice/phpexcel Packagist phpoffice/phpspreadsheet |
Moodle stored Cross-site Scripting (XSS) BIT-moodle-2020-25627, CVE-2020-25627, GHSA-mgfp-qcf2-pw3m | Medium | 3.7% | 09 Dec, 2020 | Packagist moodle/moodle |
Kirby .dev domains and some reverse proxy setups were treated as local CVE-2020-26253, GHSA-2ccx-2gf3-8xvv | Medium | 0.6% | 08 Dec, 2020 | Packagist getkirby/cms Packagist getkirby/panel |
Moodle Cross-site Scripting (XSS) BIT-moodle-2020-25631, CVE-2020-25631, GHSA-4w4j-9533-82qg | Medium | 0.9% | 08 Dec, 2020 | Packagist moodle/moodle |
Cross site-scripting (XSS) moodle BIT-moodle-2020-25628, CVE-2020-25628, GHSA-5x33-h32w-6vr2 | Medium | 1.0% | 08 Dec, 2020 | Packagist moodle/moodle |
EC-CUBE Improper Restriction of Rendered UI Layers or Frames CVE-2020-5679, GHSA-rwh8-h525-4jvj | Medium | 0.7% | 03 Dec, 2020 | Packagist ec-cube/ec-cube |
Cross-site scripting in ThinkAdmin CVE-2020-29315, GHSA-v47f-vp3p-5j6h | Medium | 1.0% | 01 Dec, 2020 | Packagist zoujingli/thinkadmin |
Cross-Site Scripting in Fluid view helpers BIT-typo3-2020-26227, CVE-2020-26227, GHSA-vqqx-jw6p-q3rf | Medium | 0.7% | 23 Nov, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Bypass of fix for CVE-2020-15247, Twig sandbox escape CVE-2020-26231, GHSA-r89v-cgv7-3jhx | Medium | 0.3% | 23 Nov, 2020 | Packagist october/cms |
Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. CVE-2020-15247, GHSA-94vp-rmqv-5875 | Medium | 0.3% | 23 Nov, 2020 | Packagist october/cms |
Stored XSS by authenticated backend user with access to upload files CVE-2020-15249, GHSA-fx3v-553x-3c4q | Medium | 0.5% | 23 Nov, 2020 | Packagist october/backend |
Privilege escalation by backend users assigned to the default "Publisher" system role CVE-2020-15248, GHSA-rfjc-xrmf-5vvw | Medium | 0.3% | 23 Nov, 2020 | Packagist october/backend |
Exposure of Sensitive Information to an Unauthorized Actor in Moodle BIT-moodle-2020-25703, CVE-2020-25703, GHSA-c7v4-m269-4995 | Medium | 1.5% | 19 Nov, 2020 | Packagist moodle/moodle |
Cross-site Scripting (XSS) in moodle BIT-moodle-2020-25702, CVE-2020-25702, GHSA-pgcp-m69h-p2gr | Medium | 1.3% | 19 Nov, 2020 | Packagist moodle/moodle |
Privilage Escalation in moodle BIT-moodle-2020-25701, CVE-2020-25701, GHSA-c9hq-g4q8-w893 | Medium | 1.4% | 19 Nov, 2020 | Packagist moodle/moodle |
SQL Injection in moodle BIT-moodle-2020-25700, CVE-2020-25700, GHSA-7h8v-2v8x-h264 | Medium | 1.3% | 19 Nov, 2020 | Packagist moodle/moodle |
Reflected XSS with parameters in PostComment CVE-2020-26225, GHSA-58w4-w77w-qv3w | Medium | 0.9% | 16 Nov, 2020 | Packagist prestashop/productcomments |
Microweber Insufficient Session Expiry CVE-2020-23136, GHSA-g7r3-jwhw-2wfv | Medium | 0.3% | 09 Nov, 2020 | Packagist microweber/microweber |
Magento incorrect permissions vulnerability in the Inventory module BIT-magento-2020-24405, CVE-2020-24405, GHSA-p7m7-j8jv-393q | Medium | 1.5% | 09 Nov, 2020 | Packagist magento/community-edition |
Magento incorrect permissions vulnerability in the Integrations component BIT-magento-2020-24402, CVE-2020-24402, GHSA-hvf5-4jr9-fghh | Medium | 1.7% | 09 Nov, 2020 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento 2 Community Edition Incorrect Authorization BIT-magento-2020-24401, CVE-2020-24401, GHSA-f2g3-3c6q-4478 | Medium | 2.3% | 09 Nov, 2020 | Packagist magento/community-edition Packagist magento/project-community-edition |
YOURLS Stored Cross Site Scripting (XSS) CVE-2020-27388, GHSA-pwgg-r6fq-mf94 | Medium | 0.7% | 23 Oct, 2020 | Packagist yourls/yourls |
Authenticated XML External Entity Processing GHSA-8xv9-qcr9-ww9j | Medium | Not scored | 19 Oct, 2020 | Packagist shopware/core Packagist shopware/platform |