Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross Site Scripting in baserCMS CVE-2020-15154, GHSA-cpxc-67rc-c775 | High | 1.0% | 28 Aug, 2020 | Packagist baserproject/basercms |
OpenStack Nova Live migration fails to update persistent domain XML CVE-2020-17376, GHSA-c7w7-9c85-4qxv, PYSEC-2020-243 | High | 1.8% | 26 Aug, 2020 | PyPI nova |
XSS due to lack of CSRF validation for replying/publishing CVE-2020-15156, GHSA-43m5-c88r-cjvv | High | 0.6% | 26 Aug, 2020 | npm nodebb-plugin-blog-comments |
HashiCorp Vault Authentication bypass BIT-vault-2020-16251, CVE-2020-16251, GHSA-4mp7-2m29-gqxf, GO-2024-2488 | High | 2.8% | 26 Aug, 2020 | Go github.com/hashicorp/vault |
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault BIT-vault-2020-16250, CVE-2020-16250, GHSA-fp52-qw33-mfmw, GO-2022-0825 | High | 1.5% | 26 Aug, 2020 | Go github.com/hashicorp/vault |
Improper exception handling in Aedes CVE-2020-13410, GHSA-gh78-48h3-frjq | High | 2.2% | 26 Aug, 2020 | npm aedes |
OS Command Injection and Improper Input Validation in ansible CVE-2019-14904, GHSA-gwr8-5j83-483c, PYSEC-2020-161 | High | 0.4% | 26 Aug, 2020 | PyPI ansible |
Cross-Site Scripting in highcharts GHSA-gr4j-r575-g665 | High | Not scored | 25 Aug, 2020 | npm highcharts |
Codiad SSRF Vulnerability CVE-2020-14044, GHSA-c3q8-hh69-7mg5 | High | 3.2% | 24 Aug, 2020 | Packagist codiad/codiad |
Codiad CSRF Vulnerability CVE-2020-14043, GHSA-35gp-jxw8-xw6h | High | 1.5% | 24 Aug, 2020 | Packagist codiad/codiad |
Remote Code Execution in Red Discord Bot CVE-2020-15147, GHSA-7257-96vg-qf6x, PYSEC-2020-266 | High | 2.6% | 21 Aug, 2020 | PyPI Red-DiscordBot PyPI red-discordbot |
Improper Input Validation in vault-ssh-helper CVE-2020-24359, GHSA-f9fq-vjvh-779p, GO-2022-0824 | High | 1.0% | 20 Aug, 2020 | Go github.com/hashicorp/vault-ssh-helper |
Remote Code Execution in SyliusResourceBundle CVE-2020-15143, GHSA-p4pj-9g59-4ppv | High | 1.9% | 19 Aug, 2020 | Packagist sylius/resource-bundle |
Observable Timing Discrepancy in OpenMage LTS BIT-magento-2020-15151, CVE-2020-15151, GHSA-crf2-xm6x-46p6 | High | 0.9% | 19 Aug, 2020 | Packagist openmage/magento-lts |
Adobe Acrobat Use-After-Free Vulnerability CVE-2020-9715 | HighExploited | 33.3% | 19 Aug, 2020 | |
Microsoft Windows Spoofing Vulnerability CVE-2020-1464 | HighExploited | 38.9% | 17 Aug, 2020 | |
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability CVE-2020-1380 | HighExploited | 24.2% | 17 Aug, 2020 | |
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability CVE-2020-3433 | HighExploited | 10.0% | 17 Aug, 2020 | |
django-celery-results Stores Sensitive Information In Cleartext CVE-2020-17495, GHSA-fvx8-v524-8579, PYSEC-2020-38 | High | 0.9% | 11 Aug, 2020 | PyPI django-celery-results |
Cross-Site Scripting in @progress/kendo-angular-editor GHSA-j7wp-vjj6-cp5m | High | Not scored | 11 Aug, 2020 | npm @progress/kendo-angular-editor |
TPM 1.2 key authorization values vulnerable to TPM transport eavesdropper in go-tpm CVE-2020-8918, GHSA-5x29-3hr9-6wpw, GO-2021-0095 | High | 0.2% | 11 Aug, 2020 | Go github.com/google/go-tpm |
Cross-Site Scripting in Prism CVE-2020-15138, GHSA-wvhm-4hhf-97x9 | High | 2.0% | 07 Aug, 2020 | npm prismjs |
Etcd Gateway can include itself as an endpoint resulting in resource exhaustion CVE-2020-15114, GHSA-2xhq-gv6c-p224 | High | 1.1% | 06 Aug, 2020 | Go go.etcd.io/etcd |
etcd has no minimum password length CVE-2020-15115, GHSA-4993-m7g5-r9hh | High | 1.3% | 06 Aug, 2020 | Go go.etcd.io/etcd/client/v3 |
Withdrawn Advisory: Infinite loop in xz BIT-golang-2020-16845, CVE-2020-16845, GHSA-q6gq-997w-f55g, GO-2021-0142 | High | 4.9% | 06 Aug, 2020 | Go github.com/ulikunitz/xz Go stdlib |
Improper Preservation of Permissions in etcd BIT-etcd-2020-15113, CVE-2020-15113, GHSA-chh6-ppwq-jh92 | High | 0.2% | 05 Aug, 2020 | Go github.com/etcd-io/etcd |
PgHero gem allows CSRF CVE-2020-16253, GHSA-v6fx-752r-ccp2 | High | 0.5% | 05 Aug, 2020 | RubyGems pghero |
CSRF vulnerability in save-server CVE-2020-15135, GHSA-wwrj-35w6-77ff | High | 0.7% | 04 Aug, 2020 | npm save-server |
Missing TLS certificate verification in faye-websocket CVE-2020-15133, GHSA-2v5c-755p-p4gv | High | 0.9% | 31 Jul, 2020 | RubyGems faye-websocket |
Missing TLS certificate verification CVE-2020-15134, GHSA-3q49-h8f9-9fr9 | High | 0.9% | 31 Jul, 2020 | RubyGems faye |
Pulse Connect Secure Code Injection Vulnerability CVE-2020-8218 | HighExploited | 32.3% | 30 Jul, 2020 | |
Authorization header is not sanitized in an error object in auth0 CVE-2020-15125, GHSA-5jpf-pj32-xx53 | High | 1.5% | 29 Jul, 2020 | npm auth0 |
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS BIT-typo3-2020-15099, CVE-2020-15099, GHSA-3x94-fv5h-5q2c | High | 1.8% | 29 Jul, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS BIT-typo3-2020-15098, CVE-2020-15098, GHSA-m5vr-3m74-jwxp | High | 2.2% | 29 Jul, 2020 | Packagist typo3/cms Packagist typo3/cms-core |
Command Injection in git-tags-remote GHSA-gm9x-q798-hmr4 | High | Not scored | 29 Jul, 2020 | npm git-tags-remote |
Shopware database password is leaked to an unauthenticated users CVE-2020-13997, GHSA-r4ph-mx67-x58p | High | 1.5% | 28 Jul, 2020 | Packagist shopware/core Packagist shopware/platform |
Shopware vulnerable to SSRF CVE-2020-13970, GHSA-5vmg-x99g-396q | High | 1.3% | 28 Jul, 2020 | Packagist shopware/platform |
Unrestricted Uploads in Concrete5 CVE-2020-11476, GHSA-hf9p-9r39-r2h3 | High | 2.9% | 28 Jul, 2020 | Packagist concrete5/concrete5 |
Improper Authentication in Kubernetes CVE-2020-8558, GHSA-wqv3-8cm6-h6wg, GO-2022-0885 | High | 3.4% | 27 Jul, 2020 | Go k8s.io/kubernetes |
Log injection in uvicorn CVE-2020-7694, GHSA-33c7-2mpw-hg34, PYSEC-2020-150, SNYK-PYTHON-UVICORN-575560 | High | 1.4% | 27 Jul, 2020 | PyPI uvicorn |
HTTP response splitting in uvicorn CVE-2020-7695, GHSA-f97h-2pfx-f59f, PYSEC-2020-151, SNYK-PYTHON-UVICORN-570471 | High | 1.4% | 27 Jul, 2020 | PyPI uvicorn |
Directory traversal in fast-http CVE-2020-7687, GHSA-7phr-5m9x-rw9q | High | 1.8% | 25 Jul, 2020 | npm fast-http |
Directory traversal in rollup-plugin-server CVE-2020-7686, GHSA-vr98-27qj-3c8q | High | 1.8% | 25 Jul, 2020 | npm rollup-plugin-server |
Directory traversal in rollup-plugin-server CVE-2020-7683, GHSA-34gh-3cwv-wvp2 | High | 1.8% | 25 Jul, 2020 | npm rollup-plugin-server |
Path Traversal in marked-tree CVE-2020-7682, GHSA-xr8h-53xr-jhcm | High | 1.7% | 25 Jul, 2020 | npm marked-tree |
Path Traversal in marscode CVE-2020-7681, GHSA-8pww-pp5r-rff8 | High | 1.7% | 25 Jul, 2020 | npm marscode |
MunkiReport Software Update module is vulnerable to SQL injection CVE-2020-15887, GHSA-4qgh-m9vp-48xp | High | 1.3% | 23 Jul, 2020 | Packagist munkireport/softwareupdate |
MunkiReport reportdata module SQL injection vulnerability CVE-2020-15886, GHSA-qvw9-6567-wq78 | High | 1.3% | 23 Jul, 2020 | Packagist munkireport/reportdata |
bsdiff4 out-of-bounds write via patch file CVE-2020-15904, GHSA-f8m3-jpxr-hm5x, PYSEC-2020-30 | High | 1.1% | 22 Jul, 2020 | PyPI bsdiff4 |
Cisco ASA and FTD Read-Only Path Traversal Vulnerability CVE-2020-3452 | HighExploited | 100.0% | 22 Jul, 2020 |