Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Craft CMS Cross-site Scripting vulnerability CVE-2022-37246, GHSA-f546-v666-559x | Medium | 0.5% | 21 Sep, 2022 | Packagist craftcms/cms |
Pimcore vulnerable to cross site scripting CVE-2022-3255, GHSA-wqr6-57qm-hhr5 | Medium | 0.8% | 21 Sep, 2022 | Packagist pimcore/pimcore |
OctoPrint vulnerable to Insufficient Session Expiration. CVE-2022-2888, GHSA-937f-qh3w-6g87, PYSEC-2022-282 | Medium | 0.3% | 21 Sep, 2022 | PyPI OctoPrint PyPI octoprint |
OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2022-2872, GHSA-49wm-4fp6-h59c, PYSEC-2022-286 | Medium | 0.7% | 21 Sep, 2022 | PyPI OctoPrint PyPI octoprint |
Apache Airflow contains open redirect BIT-airflow-2022-40754, CVE-2022-40754, GHSA-4fg5-j4mm-wfpg, PYSEC-2022-280 | Medium | 1.8% | 21 Sep, 2022 | PyPI apache-airflow |
Cross site scripting in Cloudreve CVE-2022-32167, GHSA-fg25-gq9g-32mx | Medium | 0.6% | 21 Sep, 2022 | Go github.com/HFO4/cloudreve Go github.com/cloudreve/Cloudreve/v3 |
SFTPGo WebClient vulnerable to Cross-site Scripting CVE-2022-39220, GHSA-cf7g-cm7q-rq7f, GO-2022-1015 | Medium | 0.6% | 20 Sep, 2022 | Go github.com/drakkan/sftpgo Go github.com/drakkan/sftpgo/v2 |
Microweber vulnerable to HTML Injection in create tag functionality CVE-2022-3245, GHSA-gm8c-w9cm-c445 | Medium | 0.7% | 20 Sep, 2022 | Packagist microweber/microweber |
Microweber Cross-site Scripting can result in redirection to a malicious site CVE-2022-3242, GHSA-232p-59mg-f98p | Medium | 1.9% | 20 Sep, 2022 | Packagist microweber/microweber |
YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module CVE-2022-3005, GHSA-vx3x-hwph-grvw | Medium | 0.7% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module CVE-2022-3004, GHSA-qwc8-vjh3-gm2j | Medium | 0.7% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module CVE-2022-3000, GHSA-mqh9-5jp9-6799 | Medium | 0.7% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module CVE-2022-2924, GHSA-2qf8-h7pr-x2r8 | Medium | 0.8% | 20 Sep, 2022 | Packagist yetiforce/yetiforce-crm |
Vuetify Cross-site Scripting vulnerability CVE-2022-25873, GHSA-q4q5-c5cv-2p68 | Medium | 0.9% | 18 Sep, 2022 | Maven org.webjars.npm:vuetify npm vuetify |
rdiffweb CSRF vulnerability in admin area can lead to deletion of repositories and users CVE-2022-3232, GHSA-cw2v-wv4g-w4p6, PYSEC-2022-281 | Medium | 0.4% | 17 Sep, 2022 | PyPI rdiffweb |
LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter CVE-2022-3231, GHSA-3jh2-wmv7-m932 | Medium | 0.7% | 17 Sep, 2022 | Packagist librenms/librenms |
Snipe-IT vulnerable to Improper Authentication CVE-2022-3173, GHSA-fhvv-p968-6vvj | Medium | 0.9% | 17 Sep, 2022 | Packagist snipe/snipe-it |
Craft CMS vulnerable to Cross-site Scripting via entry revisions and drafts CVE-2022-37251, GHSA-mw37-wx8p-gp45 | Medium | 0.5% | 16 Sep, 2022 | Packagist craftcms/cms |
Craft CMS vulnerable to stored Cross-site Scripting via /admin/settings/fields page CVE-2022-37247, GHSA-3cvm-7wrh-qrf9 | Medium | 0.6% | 16 Sep, 2022 | Packagist craftcms/cms |
Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions CVE-2022-36109, GHSA-rc4r-wh2q-q6c4, GO-2022-0985 | Medium | 1.1% | 16 Sep, 2022 | Go github.com/docker/docker |
Harbor fails to validate the user permissions when updating a robot account BIT-harbor-2022-31667, CVE-2022-31667, GHSA-xx9w-464f-7h6f | Medium | 0.5% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Harbor fails to validate the user permissions when updating tag immutability policies BIT-harbor-2022-31669, CVE-2022-31669, GHSA-8c6p-v837-77f6 | Medium | 0.4% | 16 Sep, 2022 | Go github.com/goharbor/harbor |
Cosign bundle can be crafted to successfully verify a blob even if the embedded rekorBundle does not reference the given signature BIT-cosign-2022-36056, CVE-2022-36056, GHSA-8gw7-4j42-w388, GO-2022-0998 | Medium | 0.1% | 16 Sep, 2022 | Go github.com/sigstore/cosign |
nftables binding to an already bound chain GHSA-jr8j-2jhp-m67v | Medium | Not scored | 16 Sep, 2022 | Go github.com/siderolabs/talos |
Budibase Improper Control of Dynamically-Managed Code Resources vulnerability CVE-2022-3225, GHSA-x92g-49gh-63qm | Medium | 1.0% | 16 Sep, 2022 | npm @budibase/bbui npm @budibase/builder npm @budibase/worker |
Craft CMS Cross site Scripting vulnerability CVE-2022-37248, GHSA-wxvf-839f-jqmh | Medium | 0.7% | 16 Sep, 2022 | Packagist craftcms/cms |
Craft CMS Stored Cross-site Scripting in User Addresses Title CVE-2022-37250, GHSA-8r89-x93x-mjq2 | Medium | 0.7% | 16 Sep, 2022 | Packagist craftcms/cms |
Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users CVE-2022-3211, GHSA-4849-x3jx-45qr | Medium | 0.5% | 15 Sep, 2022 | Packagist pimcore/pimcore |
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing CVE-2022-3224, GHSA-pqw5-jmp5-px4v | Medium | 0.8% | 15 Sep, 2022 | npm parse-url |
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection GHSA-gqqf-g5r7-84vf | Medium | Not scored | 15 Sep, 2022 | Packagist typo3/cms-core |
Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto CVE-2018-25047, GHSA-hwq7-5vv9-c6cf | Medium | 1.1% | 15 Sep, 2022 | Packagist smarty/smarty |
ouqiang gocron Cross-site scripting vulnerability CVE-2022-40365, GHSA-r947-2crg-xc39 | Medium | 0.6% | 15 Sep, 2022 | Go github.com/ouqiang/gocron |
UniSharp Laravel Filemanager directory traversal vulnerability CVE-2022-40734, GHSA-5m2h-7rf2-rpx6 | Medium | 5.2% | 14 Sep, 2022 | Packagist unisharp/laravel-filemanager |
Feehi CMS host header injection vulnerability CVE-2022-38796, GHSA-4r4f-jrvw-h727 | Medium | 0.6% | 14 Sep, 2022 | Packagist feehi/cms |
Moodle Cross-site Scripting vulnerability BIT-moodle-2021-36568, CVE-2021-36568, GHSA-fm6m-fg23-67jq | Medium | 1.0% | 13 Sep, 2022 | Packagist moodle/moodle |
LIEF contains segmentation violation CVE-2022-38307, GHSA-x2xx-jw5m-5j86, PYSEC-2022-275 | Medium | 0.3% | 13 Sep, 2022 | PyPI lief |
LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp. CVE-2022-38496, PYSEC-2022-43137 | Medium | 0.3% | 13 Sep, 2022 | PyPI lief |
LIEF contains a segmentation violation CVE-2022-38497, GHSA-2p5h-hpj4-fxgg, PYSEC-2022-277 | Medium | 0.3% | 13 Sep, 2022 | PyPI lief |
matrix-appservice-irc vulnerable to IRC mode parameter confusion CVE-2022-39202, GHSA-cq7q-5c67-w39w | Medium | 0.9% | 13 Sep, 2022 | npm matrix-appservice-irc |
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper BIT-typo3-2022-36108, CVE-2022-36108, GHSA-fv2m-9249-qx85 | Medium | 0.9% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController BIT-typo3-2022-36107, CVE-2022-36107, GHSA-9c6w-55cp-5w25 | Medium | 0.9% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS missing check for expiration time of password reset token for backend users BIT-typo3-2022-36106, CVE-2022-36106, GHSA-5959-4x58-r8c2 | Medium | 0.9% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 CMS vulnerable to User Enumeration via Response Timing BIT-typo3-2022-36105, CVE-2022-36105, GHSA-m392-235j-9r7r | Medium | 1.3% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core |
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection CVE-2022-36020, GHSA-47m6-46mj-p235 | Medium | 0.8% | 13 Sep, 2022 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3/html-sanitizer |
rdiffweb Missing Custom Error Page CVE-2022-3175, GHSA-ch4c-278q-5654, PYSEC-2022-273 | Medium | 0.9% | 13 Sep, 2022 | PyPI rdiffweb |
Shopware contains sensitive data in backend customer module CVE-2022-36101, GHSA-6vfq-jmxg-g58r | Medium | 0.7% | 12 Sep, 2022 | Packagist shopware/shopware |
Gophish before 0.12.0 vulnerable to Open Redirect CVE-2022-25295, GHSA-hvw3-p9px-gpc9, GO-2022-0987 | Medium | 0.7% | 12 Sep, 2022 | Go github.com/gophish/gophish |
OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI CVE-2022-36087, GHSA-3pgj-pg6c-r5p7, PYSEC-2022-269 | Medium | 1.8% | 09 Sep, 2022 | PyPI oauthlib |
Harbor fails to validate the user permissions when reading job execution logs through the P2P preheat execution logs BIT-harbor-2022-31671, CVE-2022-31671, GHSA-q76q-q8hw-hmpw | Medium | 0.5% | 09 Sep, 2022 | Go github.com/goharbor/harbor |
Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting CVE-2022-38639, GHSA-462r-wxvm-jvxh | Medium | 0.5% | 09 Sep, 2022 | npm markdown-nice |