Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
invoiceninja is vulnerable to Cross-site Scripting CVE-2021-3977, GHSA-xg6r-5gx4-qxjm | Medium | 0.6% | 24 Dec, 2021 | Packagist hillelcoren/invoice-ninja |
elgg is vulnerable to Cross-site Scripting CVE-2021-4072, GHSA-2xw8-j43j-5vxp | Medium | 0.7% | 24 Dec, 2021 | Packagist elgg/elgg |
cordova-plugin-fingerprint-aio DoS vulnerability CVE-2021-43849, GHSA-7vfx-hfvm-rhr8 | Medium | 0.3% | 23 Dec, 2021 | npm cordova-plugin-fingerprint-aio |
PrestaShop XSS Vulnerability CVE-2012-20001, GHSA-j33m-2537-86jm | Medium | 0.8% | 21 Dec, 2021 | Packagist prestashop/prestashop |
Signature verification failure in Tendermint GHSA-f3w5-v9xx-rp8p | Medium | Not scored | 20 Dec, 2021 | Go github.com/tendermint/tendermint |
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect BIT-oauth2-proxy-2020-5233, CVE-2020-5233, GHSA-qqxw-m5fj-f7gv | Medium | 1.3% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
Open Redirect in OAuth2 Proxy BIT-oauth2-proxy-2020-4037, CVE-2020-4037, GHSA-5m6c-jp6f-2vcv | Medium | 0.9% | 20 Dec, 2021 | Go github.com/oauth2-proxy/oauth2-proxy |
Buffer Copy without Checking Size of Input in NumPy CVE-2021-41496, GHSA-f7c7-j99h-c22f, PYSEC-2021-857 | Medium | 0.4% | 17 Dec, 2021 | PyPI numpy |
Path traversal when MessageBus::Diagnostics is enabled CVE-2021-43840, GHSA-xmgj-5fh3-xjmm | Medium | 1.9% | 17 Dec, 2021 | RubyGems message_bus |
NumPy Buffer Overflow (Disputed) CVE-2021-33430, GHSA-6p56-wp2h-9hxr, PYSEC-2021-854 | Medium | 1.5% | 17 Dec, 2021 | PyPI numpy |
Incorrect Comparison in NumPy CVE-2021-34141, GHSA-fpfv-jqm9-f5jm, PYSEC-2021-855 | Medium | 1.7% | 17 Dec, 2021 | PyPI numpy |
livehelperchat is vulnerable to Cross-site Scripting BIT-livehelperchat-2021-4132, CVE-2021-4132, GHSA-f7xw-46vh-5jw2 | Medium | 0.7% | 17 Dec, 2021 | Packagist remdex/livehelperchat |
Wechat-php-sdk is affected by a Cross Site Scripting vulnerability. CVE-2021-43678, GHSA-rwqq-p4p9-5wpq | Medium | 0.8% | 17 Dec, 2021 | Packagist gaoming13/wechat-php-sdk |
Inability to de-op players if listed in ops.txt with non-lowercase letters CVE-2021-48006, GHSA-j5qg-w9jg-3wg3 | Medium | 0.2% | 16 Dec, 2021 | Packagist pocketmine/pocketmine-mp |
Open redirect in @auth0/nextjs-auth0 CVE-2021-43812, GHSA-2mqv-4j3r-vjvp | Medium | 0.7% | 16 Dec, 2021 | npm @auth0/nextjs-auth0 |
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) BIT-livehelperchat-2021-4123, CVE-2021-4123, GHSA-rpg7-q4cv-p466 | Medium | 0.5% | 16 Dec, 2021 | Packagist remdex/livehelperchat |
yetiforcecrm is vulnerable to Cross-site Scripting CVE-2021-4121, GHSA-j85f-xw9x-ffwp | Medium | 0.8% | 16 Dec, 2021 | Packagist yetiforce/yetiforce-crm |
Cross-site Scripting in Anchor CMS CVE-2021-44116, GHSA-7mq6-cp5m-f4j5 | Medium | 0.8% | 15 Dec, 2021 | Packagist anchorcms/anchor-cms |
Android Kernel Race Condition Vulnerability CVE-2021-0920 | MediumExploited | 0.9% | 15 Dec, 2021 | |
YetiForceCRM is vulnerable to Business Logic Errors in the weight of a product CVE-2021-4117, GHSA-cxg7-84wp-8pcq | Medium | 0.7% | 15 Dec, 2021 | Packagist yetiforce/yetiforce-crm |
yetiforcecrm is vulnerable to Cross-site Scripting CVE-2021-4116, GHSA-fwh7-v4gf-xv7w | Medium | 0.5% | 15 Dec, 2021 | Packagist yetiforce/yetiforce-crm |
Dolibarr Cross Site Scripting (XSS) vulnerability CVE-2021-42220, GHSA-jqfp-m5f8-vg28 | Medium | 1.0% | 15 Dec, 2021 | Packagist dolibarr/dolibarr |
actionpack Open Redirect in Host Authorization Middleware BIT-rails-2021-44528, CVE-2021-44528, GHSA-qphc-hf5q-v8fc | Medium | 4.4% | 14 Dec, 2021 | RubyGems actionpack |
snipe-it is vulnerable to Cross-site Scripting CVE-2021-4108, GHSA-rxch-gp62-574w | Medium | 0.8% | 14 Dec, 2021 | Packagist snipe/snipe-it |
yetiforcecrm is vulnerable to Cross-site Scripting CVE-2021-4107, GHSA-rp42-c45j-g46x | Medium | 0.8% | 14 Dec, 2021 | Packagist yetiforce/yetiforce-crm |
phpservermon is vulnerable to CRLF Injection CVE-2021-4097, GHSA-8qv8-fq5w-p966 | Medium | 0.9% | 12 Dec, 2021 | Packagist phpservermon/phpservermon |
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4092, GHSA-v4cr-m5f8-gxw8 | Medium | 0.4% | 11 Dec, 2021 | Packagist yetiforce/yetiforce-crm |
snipe-it is vulnerable to Improper Access Control CVE-2021-4089, GHSA-9vwf-54m9-gc4f | Medium | 0.7% | 10 Dec, 2021 | Packagist snipe/snipe-it |
Cross-site Scripting in pimcore CVE-2021-4084, GHSA-8w3x-r6x7-c5r5 | Medium | 1.6% | 10 Dec, 2021 | Packagist pimcore/pimcore |
pimcore is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-4082, GHSA-2v2v-fx7r-f2fh | Medium | 0.4% | 10 Dec, 2021 | Packagist pimcore/pimcore |
pimcore is vulnerable to Cross-site Scripting CVE-2021-4081, GHSA-3p85-p4qg-hcrp | Medium | 0.8% | 10 Dec, 2021 | Packagist pimcore/pimcore |
Cross-Site Request Forgery in kimai2 CVE-2021-4033, GHSA-4jwx-78vx-gm6g | Medium | 0.5% | 09 Dec, 2021 | Packagist kevinpapst/kimai2 |
Server side request forgery in SwaggerUI GHSA-qrmm-w75w-3wpx | Medium | Not scored | 09 Dec, 2021 | NuGet Swashbuckle.AspNetCore.SwaggerUI npm swagger-ui npm swagger-ui-dist npm swagger-ui-react |
Instance config inline secret exposure in Grafana CVE-2021-41090, GHSA-9c4x-5hgq-q3wh, GO-2022-0305 | Medium | 0.8% | 08 Dec, 2021 | Go github.com/grafana/agent |
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile. CVE-2021-43809, GHSA-fj7f-vq84-fh43 | Medium | 2.9% | 08 Dec, 2021 | RubyGems bundler |
Cross site scripting in remdex/livehelperchat BIT-livehelperchat-2021-4050, CVE-2021-4050, GHSA-97cc-825c-399g | Medium | 0.9% | 08 Dec, 2021 | Packagist remdex/livehelperchat |
Laravel Framework XSS in Blade templating engine CVE-2021-43808, GHSA-66hf-2p6w-jqfw | Medium | 0.8% | 08 Dec, 2021 | Packagist illuminate/view Packagist laravel/framework |
Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC CVE-2021-43784, GHSA-v95c-p5hm-xq8f, GO-2022-0274 | Medium | 1.8% | 07 Dec, 2021 | Go github.com/opencontainers/runc |
Cross-Site Request Forgery in remdex/livehelperchat BIT-livehelperchat-2021-4049, CVE-2021-4049, GHSA-h86j-6h6m-qjqw | Medium | 0.4% | 07 Dec, 2021 | Packagist remdex/livehelperchat |
Permissions not properly checked in Invenio-Drafts-Resources CVE-2021-43781, GHSA-xr38-w74q-r8jv, PYSEC-2021-836, PYSEC-2021-837, PYSEC-2021-838 | Medium | 0.7% | 06 Dec, 2021 | PyPI invenio-app-rdm PyPI invenio-drafts-resources PyPI invenio-rdm-records |
Cross Site Request Forgery in firefly-iii CVE-2021-4005, GHSA-hjhp-hwfj-hwf3 | Medium | 0.4% | 04 Dec, 2021 | Packagist grumpydictator/firefly-iii |
Open Redirect in showdoc CVE-2021-4000, GHSA-8c9x-wfgj-v78w | Medium | 0.8% | 03 Dec, 2021 | Packagist showdoc/showdoc |
Silent Configuration Failure in Puppet Agent CVE-2021-27025, GHSA-q4g7-jrxv-67r9 | Medium | 1.1% | 02 Dec, 2021 | RubyGems puppet |
Unsafe HTTP Redirect in Puppet Agent and Puppet Server CVE-2021-27023, GHSA-93j5-g845-9wqp | Medium | 1.4% | 02 Dec, 2021 | RubyGems puppet |
bookstack is vulnerable to Cross-Site Request Forgery (CSRF) CVE-2021-3944, GHSA-wc7v-77jr-5c3m | Medium | 0.6% | 02 Dec, 2021 | Packagist ssddanbrown/bookstack |
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext GHSA-9jp8-cwwx-p64q | Medium | Not scored | 01 Dec, 2021 | Packagist ezsystems/ezplatform-admin-ui |
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext GHSA-fxwm-rx68-p5vx | Medium | Not scored | 01 Dec, 2021 | Packagist ezsystems/ezplatform-richtext |
Cross-site Scripting in LibreNMS CVE-2021-44279, GHSA-5vr6-hm68-5j9p | Medium | 0.6% | 01 Dec, 2021 | Packagist librenms/librenms |
Cross-site Scripting in LibreNMS CVE-2021-44277, GHSA-4gwh-2pqx-f5cc | Medium | 0.6% | 01 Dec, 2021 | Packagist librenms/librenms |
Cross-site Scripting in CKAN CVE-2021-25967, GHSA-6w9p-88qg-p3g3, PYSEC-2021-841 | Medium | 0.5% | 01 Dec, 2021 | PyPI ckan |