Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Moodle contains CSRF vulnerability BIT-moodle-2021-43559, CVE-2021-43559, GHSA-3jrj-x6cj-97cp | High | 0.6% | 22 Nov, 2021 | Packagist moodle/moodle |
Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki CVE-2021-3978, GHSA-3pqh-p72c-fj85, GO-2022-0580 | High | 0.1% | 19 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Server-Side Request Forgery in Concrete CMS CVE-2021-22970, GHSA-gqpw-9q54-9x28 | High | 1.5% | 19 Nov, 2021 | Packagist concrete5/core |
Improper file handling in concrete5/core CVE-2021-22968, GHSA-g3p2-hfqr-9m25 | High | 3.2% | 19 Nov, 2021 | Packagist concrete5/core |
Exposure of sensitive information in concrete5/core CVE-2021-22967, GHSA-m2v2-8227-59f5 | High | 1.1% | 19 Nov, 2021 | Packagist concrete5/core |
Improper Privilege Management in Concrete CMS CVE-2021-22966, GHSA-j4mv-2rv7-v2j9 | High | 1.0% | 19 Nov, 2021 | Packagist concrete5/core |
Password exposure in concrete5/core CVE-2021-22951, GHSA-rhf5-f553-xg82 | High | 1.1% | 19 Nov, 2021 | Packagist concrete5/core |
Cross-site Scripting in snipe/snipe-it CVE-2021-3961, GHSA-c65v-p733-9796 | High | 0.8% | 19 Nov, 2021 | Packagist snipe/snipe-it |
Cross-site Scripting in django-helpdesk CVE-2021-3950, GHSA-vfrc-ggmc-5jwv, PYSEC-2021-431 | High | 0.8% | 19 Nov, 2021 | PyPI django-helpdesk |
HTTP Request Smuggling in github.com/hyperledger/fabric CVE-2021-43669, GHSA-j96p-r523-8r3w | High | 1.1% | 18 Nov, 2021 | Go github.com/hyperledger/fabric |
NULL Pointer Dereference in HyperLedger Fabric CVE-2021-43667, GHSA-vjj6-5m9f-wqjw | High | 1.3% | 18 Nov, 2021 | Go github.com/hyperledger/fabric |
Metabase GeoJSON API Local File Inclusion Vulnerability CVE-2021-41277 | HighExploited | 97.2% | 17 Nov, 2021 | |
HTML comments vulnerability allowing to execute JavaScript code BIT-drupal-2021-41165, CVE-2021-41165, GHSA-7h26-63m7-qhf2 | High | 1.6% | 17 Nov, 2021 | Packagist ckeditor/ckeditor npm ckeditor4 |
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML BIT-drupal-2021-41164, CVE-2021-41164, GHSA-pvmx-g8h5-cprj | High | 1.3% | 17 Nov, 2021 | npm ckeditor4 |
Improper Encoding or Escaping of Output in Apache Superset BIT-superset-2021-42250, CVE-2021-42250, GHSA-5fp8-c45m-256p, PYSEC-2021-435 | High | 1.8% | 17 Nov, 2021 | PyPI apache-superset |
Regular expression denial of service vulnerability (ReDoS) in date BIT-ruby-2021-41817, BIT-ruby-min-2021-41817, CVE-2021-41817, GHSA-qg54-694p-wgpp | High | 3.5% | 16 Nov, 2021 | RubyGems date |
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application CVE-2021-41263, GHSA-844m-cpr9-jcmh | High | 0.6% | 15 Nov, 2021 | RubyGems rails_multisite |
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type CVE-2021-3915, GHSA-w2f4-hxpm-mq98 | High | 1.0% | 13 Nov, 2021 | Packagist ssddanbrown/bookstack |
Cross-site Scripting in django-helpdesk CVE-2021-3945, GHSA-vx6v-xg64-pmr8, PYSEC-2021-430 | High | 1.0% | 13 Nov, 2021 | PyPI django-helpdesk |
Apache Superset allowed for database connections password leak for authenticated users BIT-superset-2021-41972, CVE-2021-41972, GHSA-42q4-9xf9-f67x, PYSEC-2021-434 | High | 1.5% | 12 Nov, 2021 | PyPI apache-superset |
Privilege escalation to cluster admin on multi-tenant environments BIT-kustomize-2021-41254, CVE-2021-41254, GHSA-35rf-v2jv-gfg7, GO-2022-0260 | High | 1.8% | 12 Nov, 2021 | Go github.com/fluxcd/kustomize-controller |
Infinite certificate chain depth results in OctoRPKI running forever CVE-2021-3908, GHSA-g5gj-9ggf-9vmq, GO-2022-0249 | High | 0.7% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Infinite open connection causes OctoRPKI to hang forever CVE-2021-3909, GHSA-8cvr-4rrf-f244, GO-2022-0250 | High | 1.6% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
NUL character in ROA causes OctoRPKI to crash CVE-2021-3910, GHSA-5mxh-2qfv-4g7j, GO-2022-0251 | High | 1.2% | 10 Nov, 2021 | Go github.com/cloudflare/cfrpki |
Improper Input Validation in pip CVE-2021-3572, GHSA-5xp3-jfq3-5q8x, PYSEC-2021-437 | High | 1.8% | 10 Nov, 2021 | PyPI pip |
Insufficient Session Expiration in @cyyynthia/tokenize GHSA-jcjx-c3j3-44pr | High | Not scored | 10 Nov, 2021 | npm @cyyynthia/tokenize |
Unrestricted access to predictable file paths in hov/jobfair CVE-2021-43564, GHSA-43g8-79x3-j898 | High | 1.0% | 10 Nov, 2021 | Packagist hov/jobfair |
Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2021-42321 | HighExploited | 91.7% | 10 Nov, 2021 | |
Microsoft Excel Security Feature Bypass CVE-2021-42292 | HighExploited | 43.0% | 10 Nov, 2021 | |
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability CVE-2021-42287 | HighExploited | 77.2% | 10 Nov, 2021 | |
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability CVE-2021-42278 | HighExploited | 73.3% | 10 Nov, 2021 | |
Signature verification vulnerability in Stark Bank ecdsa libraries GHSA-9wx7-jrvc-28mm | High | Not scored | 08 Nov, 2021 | Maven com.starkbank:ecdsa-java NuGet starkbank-ecdsa PyPI starkbank-ecdsa npm starkbank-ecdsa |
Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server) GHSA-qm7x-rc44-rrqw | High | Not scored | 08 Nov, 2021 | npm apollo-server |
Improper hashing in enrocrypt CVE-2021-39182, GHSA-35m5-8cvj-8783, PYSEC-2021-385 | High | 0.6% | 08 Nov, 2021 | PyPI enrocrypt |
Panic when opening certain archives in archive/zip BIT-golang-2021-41772, CVE-2021-41772, GO-2021-0264 | High | 3.3% | 08 Nov, 2021 | Go stdlib |
Panic on invalid symbol tables in debug/macho BIT-golang-2021-41771, CVE-2021-41771, GO-2021-0263 | High | 4.7% | 08 Nov, 2021 | Go stdlib |
OIDC claims not updated from Identity Provider in Pomerium CVE-2021-41230, GHSA-j6wp-3859-vxfg, GO-2021-0258 | High | 0.9% | 05 Nov, 2021 | Go github.com/pomerium/pomerium |
Heap buffer overflow in `Transpose` BIT-tensorflow-2021-41216, CVE-2021-41216, GHSA-3ff2-r28g-w7h9, PYSEC-2021-408, PYSEC-2021-625, PYSEC-2021-823 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Use after free / memory leak in `CollectiveReduceV2` BIT-tensorflow-2021-41220, CVE-2021-41220, GHSA-gpfh-jvf9-7wg5, PYSEC-2021-412, PYSEC-2021-629, PYSEC-2021-827 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Access to invalid memory during shape inference in `Cudnn*` ops BIT-tensorflow-2021-41221, CVE-2021-41221, GHSA-cqv6-3phm-hcwx, PYSEC-2021-413, PYSEC-2021-630, PYSEC-2021-828 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
A use of uninitialized value vulnerability in Tensorflow BIT-tensorflow-2021-41225, CVE-2021-41225, GHSA-7r94-xv9v-63jw, PYSEC-2021-417, PYSEC-2021-634, PYSEC-2021-832 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Code injection in `saved_model_cli` BIT-tensorflow-2021-41228, CVE-2021-41228, GHSA-3rcw-9p9x-582v, PYSEC-2021-420, PYSEC-2021-637, PYSEC-2021-835 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Incomplete validation of shapes in multiple TF ops BIT-tensorflow-2021-41206, CVE-2021-41206, GHSA-pgcq-h79j-2f69, PYSEC-2021-843, PYSEC-2021-845, PYSEC-2021-847 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Missing validation during checkpoint loading BIT-tensorflow-2021-41203, CVE-2021-41203, GHSA-7pxj-m4jf-r6h2, PYSEC-2021-396, PYSEC-2021-613, PYSEC-2021-811 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops BIT-tensorflow-2021-41205, CVE-2021-41205, GHSA-49rx-x2rw-pc6f, PYSEC-2021-398, PYSEC-2021-615, PYSEC-2021-813 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Heap OOB in shape inference for `QuantizeV2` BIT-tensorflow-2021-41211, CVE-2021-41211, GHSA-cvgx-3v3q-m36c, PYSEC-2021-403, PYSEC-2021-620, PYSEC-2021-818 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Heap OOB read in `tf.ragged.cross` BIT-tensorflow-2021-41212, CVE-2021-41212, GHSA-fr77-rrx3-cp7g, PYSEC-2021-404, PYSEC-2021-621, PYSEC-2021-819 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Reference binding to `nullptr` in `tf.ragged.cross` BIT-tensorflow-2021-41214, CVE-2021-41214, GHSA-vwhq-49r4-gj9v, PYSEC-2021-406, PYSEC-2021-623, PYSEC-2021-821 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Undefined behavior via `nullptr` reference binding in sparse matrix multiplication BIT-tensorflow-2021-41219, CVE-2021-41219, GHSA-4f99-p9c2-3j8x, PYSEC-2021-411, PYSEC-2021-628, PYSEC-2021-826 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |
Heap OOB in `FusedBatchNorm` kernels BIT-tensorflow-2021-41223, CVE-2021-41223, GHSA-f54p-f6jp-4rhr, PYSEC-2021-415, PYSEC-2021-632, PYSEC-2021-830 | High | 0.2% | 05 Nov, 2021 | PyPI tensorflow PyPI tensorflow-cpu PyPI tensorflow-gpu |