Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nomad Panics On Job Submission With Bad Artifact Stanza Source URL CVE-2022-41606, GHSA-7v3g-4878-5qrf, GO-2022-1062 | Medium | 0.9% | 12 Oct, 2022 | Go github.com/hashicorp/nomad |
mxGraph vulnerable to cross-site scripting in setTooltips function CVE-2022-40440, GHSA-j4rv-pr9g-q8jv | Medium | 0.7% | 12 Oct, 2022 | npm mxgraph |
AdGuardHome vulnerable to Cross-Site Request Forgery CVE-2022-32175, GHSA-mwwc-3jv2-62j3 | Medium | 0.3% | 11 Oct, 2022 | Go github.com/AdguardTeam/AdGuardHome |
Cross site scripting in Metro UI CVE-2022-41376, GHSA-633r-r4p8-pw3w | Medium | 0.6% | 11 Oct, 2022 | npm metro4 |
rdiffweb vulnerable to Open Redirect CVE-2022-3438, GHSA-8g9m-vv69-7j99, PYSEC-2022-43158 | Medium | 0.7% | 10 Oct, 2022 | PyPI rdiffweb |
Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint CVE-2022-39281, GHSA-p75c-5x3h-cxcg | Medium | 1.8% | 07 Oct, 2022 | RubyGems fat_free_crm |
NocoDB vulnerable to Denial of Service CVE-2022-3423, GHSA-grv6-m753-3w2g | Medium | 2.3% | 07 Oct, 2022 | npm nocodb |
Twisted vulnerable to HTTP Request Smuggling Attacks GHSA-8r99-h8j2-rw64 | Medium | Not scored | 07 Oct, 2022 | PyPI twisted |
Blst vulnerable to incorrect results for some inputs in blst_fp_eucl_inverse function GHSA-x279-68rr-jp4p, GO-2022-1053 | Medium | Not scored | 07 Oct, 2022 | Go github.com/supranational/blst |
Tendermint Core vulnerable to Uncontrolled Resource Consumption CVE-2021-21271, GHSA-p658-8693-mhvg, GO-2022-1052 | Medium | 1.8% | 07 Oct, 2022 | Go github.com/tendermint/tendermint |
etcd has no minimum password length CVE-2020-15115, GHSA-4993-m7g5-r9hh | Medium | 1.3% | 06 Oct, 2022 | Go go.etcd.io/etcd/client/v3 |
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued BIT-codeigniter-2022-39284, CVE-2022-39284, GHSA-745p-r637-7vvp | Medium | 1.1% | 06 Oct, 2022 | Packagist codeigniter4/framework |
SIF's Digital Signature Hash Algorithms Not Validated CVE-2022-39237, GHSA-m5m3-46gj-wch8, GO-2022-1045 | Medium | 0.7% | 06 Oct, 2022 | Go github.com/sylabs/sif/v2 |
YetiForce CRM vulnerable to stored Cross-site Scripting CVE-2022-3002, GHSA-v9fj-h8g6-4w9q | Medium | 0.7% | 06 Oct, 2022 | Packagist yetiforce/yetiforce-crm |
rdiffweb allows a new password to be the same as the previous password CVE-2022-3376, GHSA-7wr6-fj4x-893v, PYSEC-2022-43157 | Medium | 0.8% | 06 Oct, 2022 | PyPI rdiffweb |
protobuf-java has a potential Denial of Service issue CVE-2022-3171, GHSA-h4h5-3hr4-j3g2 | Medium | 1.3% | 04 Oct, 2022 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-javalite Maven com.google.protobuf:protobuf-kotlin Maven com.google.protobuf:protobuf-kotlin-lite +1 more |
LIEF vulnerable to denial of service through segmentation fault CVE-2022-40923, GHSA-rm2x-hgr8-w343, PYSEC-2022-43139 | Medium | 0.8% | 30 Sep, 2022 | PyPI lief |
Moodle No groups filtering in H5P activity attempts report BIT-moodle-2022-40316, CVE-2022-40316, GHSA-385f-vgq7-8hhx | Medium | 0.7% | 30 Sep, 2022 | Packagist moodle/moodle |
Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload CVE-2022-40931, GHSA-pwq7-f7f9-cm2j | Medium | 0.6% | 30 Sep, 2022 | Go github.com/dutchcoders/transfer.sh |
FeehiCMS vulnerable to Cross-Site scripting via crafted payload CVE-2022-40408, GHSA-5mqq-7g25-r4wx | Medium | 0.5% | 29 Sep, 2022 | Packagist feehi/feehicms |
Inventree vulnerable to Stored Cross-site Scripting CVE-2022-3355, GHSA-62g7-fpv9-v95f, PYSEC-2026-823 | Medium | 0.9% | 29 Sep, 2022 | PyPI inventree |
Moodle Exposure of Sensitive Information to an Unauthorized Actor BIT-moodle-2021-40695, CVE-2021-40695, GHSA-gp4w-f57r-9rx3 | Medium | 0.9% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle Improper Encoding or Escaping of Output BIT-moodle-2021-40694, CVE-2021-40694, GHSA-m37g-mwcg-7j7v | Medium | 0.9% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle type juggling vulnerability BIT-moodle-2021-40693, CVE-2021-40693, GHSA-2jxg-mv2m-j4r7 | Medium | 0.8% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle Incorrect Authorization BIT-moodle-2021-40692, CVE-2021-40692, GHSA-wr6q-xv23-rfq9 | Medium | 0.6% | 29 Sep, 2022 | Packagist moodle/moodle |
Moodle Improper Authentication BIT-moodle-2021-40691, CVE-2021-40691, GHSA-92vh-mr2w-j2cr | Medium | 0.7% | 29 Sep, 2022 | Packagist moodle/moodle |
rdiffweb vulnerable to password complexity bypass leading to weak passwords CVE-2022-3326, GHSA-8wxf-c45w-g66g, PYSEC-2022-297 | Medium | 0.7% | 29 Sep, 2022 | PyPI rdiffweb |
Bytebase does not restrict low privilege user to access admin issues CVE-2022-32169, GHSA-5rc4-v5mj-g8c4 | Medium | 0.7% | 29 Sep, 2022 | Go github.com/bytebase/bytebase |
Bytebase allows low-privilege users to view admin projects CVE-2022-32170, GHSA-9mmc-27gw-w6mq | Medium | 0.7% | 29 Sep, 2022 | Go github.com/bytebase/bytebase |
rdiffweb vulnerable to Use of Cache Containing Sensitive Information CVE-2022-3292, GHSA-7fqm-jm52-f9vc, PYSEC-2022-296 | Medium | 0.6% | 28 Sep, 2022 | PyPI rdiffweb |
Improper beacon events in matrix-js-sdk can result in availability issues CVE-2022-39236, GHSA-hvv8-5v86-r45x | Medium | 1.4% | 28 Sep, 2022 | npm matrix-js-sdk |
EC-CUBE DOM-based cross-site scripting vulnerability CVE-2022-38975, GHSA-pggw-rqfm-72rh | Medium | 0.7% | 27 Sep, 2022 | Packagist ec-cube/ec-cube |
Centreon contains cross-site scripting vulnerability via esc_name parameter CVE-2022-40044, GHSA-rv5q-72p2-2q24 | Medium | 0.8% | 26 Sep, 2022 | Packagist centreon/centreon |
Google Chromium Intents Insufficient Input Validation Vulnerability CVE-2022-2856 | MediumExploited | 4.6% | 26 Sep, 2022 | |
rdiffweb vulnerable to Improper Cleanup on Thrown Exception CVE-2022-3301, GHSA-qq29-5vjh-vxwr, PYSEC-2022-295 | Medium | 0.7% | 26 Sep, 2022 | PyPI rdiffweb |
express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute CVE-2022-21169, GHSA-grjp-4jmr-mjcw | Medium | 1.0% | 26 Sep, 2022 | npm express-xss-sanitizer |
HashiCorp Consul vulnerable to authorization bypass BIT-consul-2022-40716, CVE-2022-40716, GHSA-m69r-9g56-7mv8, GO-2022-1029 | Medium | 1.1% | 25 Sep, 2022 | Go github.com/hashicorp/consul |
Mattermost subject to Denial of Service via upload of special GIF BIT-mattermost-2022-3257, CVE-2022-3257, GHSA-m7w4-q5vg-5xfp | Medium | 1.3% | 25 Sep, 2022 | Go github.com/mattermost/mattermost-server/v6 |
Jodit Editor vulnerable to Cross-site Scripting CVE-2022-23461, GHSA-42hx-vrxx-5r6v | Medium | 0.6% | 24 Sep, 2022 | npm jodit |
Toast UI Grid vulnerable to Cross-site Scripting CVE-2022-23458, GHSA-9rwj-9j2h-fhvm | Medium | 0.7% | 22 Sep, 2022 | npm tui-grid |
rdiffweb Cross-Site Request Forgery vulnerability CVE-2022-3267, GHSA-74j6-3hh4-w3f5, PYSEC-2022-284 | Medium | 0.4% | 22 Sep, 2022 | PyPI rdiffweb |
Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability CVE-2022-39197 | MediumExploited | 44.1% | 22 Sep, 2022 | |
@netlify/ipx vulnerable to Full Response SSRF and Stored XSS via Cache Poisoning and Improper Host Validation CVE-2022-39239, GHSA-9jjv-524m-jm98 | Medium | 0.5% | 21 Sep, 2022 | npm @netlify/ipx |
fhir-works-on-aws-authz-smart handles permissions improperly CVE-2022-39230, GHSA-vv7x-7w4m-q72f | Medium | 0.7% | 21 Sep, 2022 | npm fhir-works-on-aws-authz-smart |
Awesome Support vulnerable to persistent cross-site scripting CVE-2022-38073, GHSA-qrqm-574x-q7f2 | Medium | 0.6% | 21 Sep, 2022 | Packagist awesome-support/awesome-support |
rdiffweb CSRF could lead to disabling notifications in user profile CVE-2022-3233, GHSA-9vxf-mcm6-5m42, PYSEC-2022-285 | Medium | 0.4% | 21 Sep, 2022 | PyPI rdiffweb |
parse-server's session object properties can be updated by foreign user if object ID is known BIT-parse-2022-39225, CVE-2022-39225, GHSA-6w4q-23cf-j9jp | Medium | 0.5% | 21 Sep, 2022 | npm parse-server |
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service GHSA-4qw4-jpp4-8gvp | Medium | Not scored | 21 Sep, 2022 | RubyGems commonmarker |
rdiffweb has insecure HTTP cookies CVE-2022-3250, GHSA-m748-hjqg-rpp8, PYSEC-2022-287 | Medium | 0.5% | 21 Sep, 2022 | PyPI rdiffweb |
jwcrypto token substitution can lead to authentication bypass CVE-2022-3102, GHSA-gwp4-mcv4-w95j, PYSEC-2026-827 | Medium | Not scored | 21 Sep, 2022 | PyPI jwcrypto |