Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
FeehiCMS Cross Site Scripting vulnerability CVE-2020-36607, GHSA-6jj8-mqx2-7fg5 | Medium | 0.7% | 15 Dec, 2022 | Packagist feehi/feehicms |
easywebpack-cli Path Traversal vulnerability CVE-2020-24855, GHSA-252h-2cmq-pmr6 | Medium | 1.1% | 15 Dec, 2022 | npm @easy-team/easywebpack-cli |
FeehiCMS vulnerable to Cross Site Scripting CVE-2020-20589, GHSA-pwh3-3pcm-6vjh | Medium | 0.6% | 15 Dec, 2022 | Packagist feehi/feehicms |
The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves
the bookkeeper client vulnerable to a man in the middle attack.
The problem affects BookKeeper client prior to versions 4.14.6 a CVE-2022-32531, GHSA-gxq5-79m2-gvvq, PYSEC-2022-43060 | Medium | 1.1% | 15 Dec, 2022 | PyPI apache-bookkeeper-client |
Helm vulnerable to denial of service through schema file BIT-helm-2022-23526, CVE-2022-23526, GHSA-67fx-wx78-jx33, GO-2022-1166 | Medium | 0.9% | 14 Dec, 2022 | Go helm.sh/helm/v3 |
Helm vulnerable to denial of service through through repository index file BIT-helm-2022-23525, CVE-2022-23525, GHSA-53c4-hhmh-vw5q, GO-2022-1165 | Medium | 0.9% | 14 Dec, 2022 | Go helm.sh/helm/v3 |
TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz) CVE-2022-47407, GHSA-7gpw-frph-fwrg | Medium | 0.4% | 14 Dec, 2022 | Packagist fixpunkt/fp-masterquiz |
Helm vulnerable to denial of service through string value parsing BIT-helm-2022-23524, CVE-2022-23524, GHSA-6rx9-889q-vv2r, GO-2022-1167 | Medium | 0.8% | 14 Dec, 2022 | Go helm.sh/helm/v3 |
collective.dms.basecontent Cross-site Scripting vulnerability CVE-2022-4495, GHSA-r48c-4vfj-h426, PYSEC-2022-42989 | Medium | 0.5% | 14 Dec, 2022 | PyPI collective-dms-basecontent PyPI collective.dms.basecontent |
csaf-poc/csaf_distribution Cross-site Scripting vulnerability CVE-2022-43996, GHSA-xxfx-w2rw-gh63, GO-2022-1164 | Medium | 0.5% | 14 Dec, 2022 | Go github.com/csaf-poc/csaf_distribution |
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability CVE-2022-44698 | MediumExploited | 74.8% | 13 Dec, 2022 | |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23520, GHSA-rrfc-7g8p-99q8 | Medium | 1.2% | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23519, GHSA-9h9g-93gc-623h | Medium | 1.1% | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Improper neutralization of data URIs may allow XSS in rails-html-sanitizer CVE-2022-23518, GHSA-mcvf-2q2m-x72m | Medium | 0.9% | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Improper neutralization of data URIs may allow XSS in Loofah CVE-2022-23515, GHSA-228g-948r-83gx | Medium | 0.9% | 13 Dec, 2022 | RubyGems loofah |
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration BIT-typo3-2022-23504, CVE-2022-23504, GHSA-8w3p-qh3x-6gjr | Medium | 0.5% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset BIT-typo3-2022-23502, CVE-2022-23502, GHSA-mgj2-q8wp-29rr | Medium | 0.4% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login BIT-typo3-2022-23501, CVE-2022-23501, GHSA-jfp7-79g7-89rf | Medium | 0.5% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting CVE-2022-23499, GHSA-hvwx-qh2h-xcfj | Medium | 0.5% | 13 Dec, 2022 | Packagist typo3/cms Packagist typo3/html-sanitizer |
Alist Cross-site Scripting vulnerability CVE-2022-45970, GHSA-957m-g6rf-4c2m | Medium | 0.5% | 12 Dec, 2022 | Go github.com/alist-org/alist/v3 |
yikes-inc-easy-mailchimp-extender Cross-site Scripting vulnerability CVE-2021-4244, GHSA-837v-6vgx-jqcc | Medium | 0.6% | 12 Dec, 2022 | Packagist yikesinc/yikes-inc-easy-mailchimp-extender |
phpMyFAQ vulnerable to Cross-site Scripting CVE-2022-4408, GHSA-rjf6-wj7r-5fj2 | Medium | 0.5% | 11 Dec, 2022 | Packagist thorsten/phpmyfaq |
phpMyFAQ vulnerable to Cross-site Scripting CVE-2022-4407, GHSA-cp9c-phxx-55xm | Medium | 4.9% | 11 Dec, 2022 | Packagist thorsten/phpmyfaq |
pyRdfa3 Cross-site Scripting vulnerability CVE-2022-4396, GHSA-894q-wpg5-mf2h, PYSEC-2026-910 | Medium | 0.6% | 10 Dec, 2022 | PyPI pyRdfa3 PyPI pyrdfa3 |
Sentry vulnerable to invite code reuse via cookie manipulation CVE-2022-23485, GHSA-jv85-mqxj-3f9j, PYSEC-2022-43011 | Medium | 0.5% | 10 Dec, 2022 | PyPI sentry |
Yii2 Gii Cross-site Scripting vulnerability CVE-2022-34297, GHSA-x87m-36g7-6mpw | Medium | 0.6% | 09 Dec, 2022 | Packagist yiisoft/yii2-gii |
Cross-site scripting vulnerability in TinyMCE alerts CVE-2022-23494, GHSA-gg8r-xjwq-4w92 | Medium | 1.0% | 08 Dec, 2022 | NuGet TinyMCE Packagist tinymce/tinymce npm tinymce |
golang.org/x/net/http2 vulnerable to possible excessive memory growth BIT-golang-2022-41717, CVE-2022-41717, GHSA-xrjj-mj9h-534m, GO-2022-1144 | Medium | 6.1% | 08 Dec, 2022 | Go golang.org/x/net Go golang.org/x/net/http2 Go stdlib |
Buildah (as part of Podman) vulnerable to Link Following CVE-2022-4122, GHSA-4crw-w8pw-2hmf, GO-2022-1151 | Medium | 0.9% | 08 Dec, 2022 | Go github.com/containers/podman Go github.com/containers/podman/v2 Go github.com/containers/podman/v3 Go github.com/containers/podman/v4 |
PrestaShop has potential Information exposure in the upload directory CVE-2022-46158, GHSA-9qgp-9wwc-v29r | Medium | 0.5% | 08 Dec, 2022 | Packagist prestashop/prestashop |
Traefik routes exposed with an empty TLSOption CVE-2022-46153, GHSA-468w-8x39-gj5v, GO-2022-1152 | Medium | 0.5% | 08 Dec, 2022 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 |
containerd CRI stream server vulnerable to host memory exhaustion via terminal CVE-2022-23471, GHSA-2qjp-425j-52j9, GO-2022-1147 | Medium | 1.1% | 07 Dec, 2022 | Go github.com/containerd/containerd |
baserCMS vulnerable to stored Cross-site Scripting CVE-2022-42486, GHSA-7w2v-35j3-xrm9 | Medium | 0.6% | 07 Dec, 2022 | Packagist baserproject/basercms |
baserCMS vulnerable to stored Cross-site Scripting CVE-2022-41994, GHSA-vxwf-79ch-f7f7 | Medium | 0.6% | 07 Dec, 2022 | Packagist baserproject/basercms |
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package CVE-2022-23530, GHSA-78m5-jpmf-ch7v, PYSEC-2022-42993 | Medium | 0.8% | 05 Dec, 2022 | PyPI guarddog |
Concrete CMS vulnerable to cross-site scripting in the text input field CVE-2022-43556, GHSA-xj33-8r43-r227 | Medium | 0.7% | 05 Dec, 2022 | Packagist concrete5/concrete5 |
phpxmlrpc vulnerable to argument injection GHSA-q7qq-9gx2-ggxv | Medium | Not scored | 02 Dec, 2022 | Packagist phpxmlrpc/phpxmlrpc |
kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF) GHSA-47xh-qxqv-mgvg | Medium | Not scored | 02 Dec, 2022 | Go github.com/mittwald/kube-httpcache |
ThinkCMF Stored Cross-Site Scripting (XSS) CVE-2022-40849, GHSA-m9mf-rqx6-2xpc | Medium | 0.4% | 01 Dec, 2022 | Packagist thinkcmf/thinkcmf |
Snyk plugins vulnerable to Command Injection CVE-2022-22984, GHSA-4x6g-3cmx-w76r | Medium | 3.2% | 30 Nov, 2022 | npm @snyk/snyk-cocoapods-plugin npm @snyk/snyk-hex-plugin npm snyk npm snyk-docker-plugin +4 more |
Tribal Systems Zenario CMS vulnerable to Session Fixation CVE-2022-4231, GHSA-6657-9743-4mc6 | Medium | 0.5% | 30 Nov, 2022 | Packagist tribalsystems/zenario |
Prometheus Exporter-Toolkit is vulnerable to authentication bypass CVE-2022-46146, GHSA-7rg2-cxvp-9p7p, GO-2022-1130 | Medium | 1.3% | 29 Nov, 2022 | Go github.com/prometheus/exporter-toolkit |
baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability CVE-2022-39325, GHSA-395x-wv32-44v5 | Medium | 0.6% | 25 Nov, 2022 | Packagist baserproject/basercms |
Microweber vulnerable to cross-site scripting (XSS) CVE-2022-0698, GHSA-79gx-3fm8-qxqq | Medium | 0.7% | 25 Nov, 2022 | Packagist microweber/microweber |
Moodle stored-XSS vulnerability in some "social" user profile fields BIT-moodle-2022-45151, CVE-2022-45151, GHSA-xv72-6pgh-cjj8 | Medium | 0.7% | 23 Nov, 2022 | Packagist moodle/moodle |
Moodle reflected cross-site scripting vulnerability in policy tool BIT-moodle-2022-45150, CVE-2022-45150, GHSA-6gx2-g773-hv9h | Medium | 0.7% | 23 Nov, 2022 | Packagist moodle/moodle |
Cross-Site Request Forgery in Moodle BIT-moodle-2022-45149, CVE-2022-45149, GHSA-8v23-w4w5-w83c | Medium | 0.4% | 23 Nov, 2022 | Packagist moodle/moodle |
Denial of service in Mattermost CVE-2022-4045, GHSA-v42f-hq78-8c5m | Medium | 0.6% | 23 Nov, 2022 | Go github.com/mattermost/mattermost-server |
Denial of service in Mattermost CVE-2022-4044, GHSA-5jph-wrq7-v9hf | Medium | 1.1% | 23 Nov, 2022 | Go github.com/mattermost/mattermost-server |
Cross-site Scripting in Backdrop CMS CVE-2022-42095, GHSA-58rj-w2qf-qjg7 | Medium | 2.2% | 23 Nov, 2022 | Packagist backdrop/backdrop |