Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Locust Stored Cross-site Scripting Vulnerability CVE-2020-28364, GHSA-vqxw-9pg7-v7v9, PYSEC-2020-60 | Medium | 0.6% | 09 Nov, 2020 | PyPI locust |
Microweber Insufficient Session Expiry CVE-2020-23136, GHSA-g7r3-jwhw-2wfv | Medium | 0.3% | 09 Nov, 2020 | Packagist microweber/microweber |
Magento incorrect permissions vulnerability in the Inventory module BIT-magento-2020-24405, CVE-2020-24405, GHSA-p7m7-j8jv-393q | Medium | 1.5% | 09 Nov, 2020 | Packagist magento/community-edition |
Magento incorrect permissions vulnerability in the Integrations component BIT-magento-2020-24402, CVE-2020-24402, GHSA-hvf5-4jr9-fghh | Medium | 1.7% | 09 Nov, 2020 | Packagist magento/community-edition Packagist magento/project-community-edition |
Magento 2 Community Edition Incorrect Authorization BIT-magento-2020-24401, CVE-2020-24401, GHSA-f2g3-3c6q-4478 | Medium | 2.3% | 09 Nov, 2020 | Packagist magento/community-edition Packagist magento/project-community-edition |
Axios vulnerable to Server-Side Request Forgery CVE-2020-28168, GHSA-4w2v-q235-vp99 | Medium | 2.4% | 06 Nov, 2020 | npm axios |
SaltStack Salt Allows creating certificates with weak file permissions CVE-2020-17490, GHSA-3c56-vx6v-q5vh, PYSEC-2020-105 | Medium | 0.4% | 06 Nov, 2020 | PyPI salt |
Cross-site scripting in Joplin CVE-2020-28249, GHSA-q26w-wjj2-22vv | Medium | 3.1% | 06 Nov, 2020 | npm joplin |
Path Traversal in jsreport-chrome-pdf CVE-2020-7762, GHSA-934w-hvj4-7fr6, SNYK-JS-JSREPORTCHROMEPDF-1037310 | Medium | 1.6% | 05 Nov, 2020 | npm jsreport-chrome-pdf |
Regular expression denial of service in @absolunet/kafe CVE-2020-7761, GHSA-hgpf-97c5-74fc, SNYK-JS-ABSOLUNETKAFE-1017403 | Medium | 1.6% | 05 Nov, 2020 | npm @absolunet/kafe |
Path Traversal in droppy CVE-2020-7757, GHSA-grv5-w5vr-8h98 | Medium | 1.6% | 02 Nov, 2020 | npm droppy |
aptdaemon Information Disclosure via Improper Input Validation in Transaction class CVE-2020-15703, GHSA-wpmr-q825-x4c6, PYSEC-2026-783 | Medium | 0.5% | 31 Oct, 2020 | PyPI aptdaemon |
Gophish vulnerable to Server-Side Request Forgery CVE-2020-24710, GHSA-9c9w-9pq7-f35h, GO-2023-1982 | Medium | 1.3% | 28 Oct, 2020 | Go github.com/gophish/gophish |
QNAP NAS File Station Cross-Site Scripting Vulnerability CVE-2018-19953 | MediumExploited | 30.5% | 28 Oct, 2020 | |
QNAP NAS File Station Cross-Site Scripting Vulnerability CVE-2018-19943 | MediumExploited | 22.7% | 28 Oct, 2020 | |
Grafana XSS via a query alias for the ElasticSearch datasource BIT-grafana-2020-24303, CVE-2020-24303, GHSA-mvpr-q6rh-8vrp, GO-2024-2520 | Medium | 2.1% | 28 Oct, 2020 | Go github.com/grafana/grafana |
YOURLS Stored Cross Site Scripting (XSS) CVE-2020-27388, GHSA-pwgg-r6fq-mf94 | Medium | 0.7% | 23 Oct, 2020 | Packagist yourls/yourls |
receiving subscription objects with deleted session BIT-parse-2020-15270, CVE-2020-15270, GHSA-2xm2-xj2q-qgpj | Medium | 1.2% | 22 Oct, 2020 | npm parse-server |
Cross-site Scripting in Strapi CVE-2020-27666, GHSA-qvp5-mm7v-4f36 | Medium | 0.7% | 22 Oct, 2020 | npm strapi-plugin-content-manager |
Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability CVE-2020-3580 | MediumExploited | 85.6% | 21 Oct, 2020 | |
Cross-site Scripting in lightning-server CVE-2020-7747, GHSA-gmch-cm2p-9qw9 | Medium | 0.9% | 20 Oct, 2020 | npm lightning-server |
Authenticated XML External Entity Processing GHSA-8xv9-qcr9-ww9j | Medium | Not scored | 19 Oct, 2020 | Packagist shopware/core Packagist shopware/platform |
Ability to switch customer email address on account detail page and stay verified CVE-2020-15245, GHSA-6gw4-x63h-5499 | Medium | 0.6% | 19 Oct, 2020 | Packagist sylius/sylius |
A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting determinis CVE-2020-8929, GHSA-g5vf-v6wf-7w2r, PYSEC-2020-142 | Medium | 0.5% | 19 Oct, 2020 | PyPI tink |
Apple iOS, iPadOS, and macOS Input Validation Vulnerability CVE-2020-9934 | MediumExploited | 3.2% | 16 Oct, 2020 | |
containerd v1.2.x can be coerced into leaking credentials during image pull CVE-2020-15157, GHSA-742w-89gc-8m9c, GO-2022-0803 | Medium | 2.3% | 16 Oct, 2020 | Go github.com/containerd/containerd |
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint CVE-2020-26891, GHSA-3x8c-fmpc-5rmq, PYSEC-2020-238 | Medium | 1.9% | 16 Oct, 2020 | PyPI matrix-synapse |
Magento 2 Community Edition XSS Vulnerability BIT-magento-2020-24408, CVE-2020-24408, GHSA-jxjc-6xmh-h7mg | Medium | 1.7% | 16 Oct, 2020 | Packagist magento/community-edition |
Privilege Escalation in Channelmgnt plug-in for Sopel CVE-2020-15251, GHSA-23pc-4339-95vg, GHSA-j257-jfvv-h3x5, PYSEC-2020-110 | Medium | 1.5% | 13 Oct, 2020 | PyPI sopel-plugins-channelmgnt PyPI sopel_plugins.channelmgnt |
phpMyAdmin Cross-site Scripting (XSS) BIT-phpmyadmin-2020-26934, CVE-2020-26934, GHSA-6349-53vr-7hcr | Medium | 1.9% | 10 Oct, 2020 | Packagist phpmyadmin/phpmyadmin |
XSS vulnerability when listing users on add & modify server pages. GHSA-5822-pw57-vv37 | Medium | Not scored | 08 Oct, 2020 | Packagist pterodactyl/panel |
Cross-Site Scripting in ternary conditional operator BIT-typo3-2020-15241, CVE-2020-15241, GHSA-7733-hjv6-4h47 | Medium | 1.0% | 08 Oct, 2020 | Packagist typo3/cms Packagist typo3/cms-core Packagist typo3fluid/fluid |
Open Redirect in Next.js versions CVE-2020-15242, GHSA-x56p-c8cg-q435 | Medium | 0.8% | 08 Oct, 2020 | npm next |
PyroCMS Vulnerable to CSRF CVE-2020-25262, GHSA-56xx-pv88-2662 | Medium | 0.5% | 08 Oct, 2020 | Packagist pyrocms/pyrocms |
Cross-site scripting (XSS) CVE-2020-17551, GHSA-j29g-g982-pwpv | Medium | 1.1% | 07 Oct, 2020 | Packagist impresscms/impresscms |
Cross-site Scripting in dompurify CVE-2020-26870, GHSA-63q7-h895-m982 | Medium | 4.9% | 07 Oct, 2020 | npm dompurify |
Context isolation bypass in Electron CVE-2020-15215, GHSA-56pc-6jqp-xqj8 | Medium | 0.7% | 06 Oct, 2020 | npm electron |
Possible timing attack in derivation_endpoint CVE-2020-15237, GHSA-5jjv-x4fq-qjwp | Medium | 1.0% | 05 Oct, 2020 | RubyGems shrine |
Ansible does not collect garbage after playbook run CVE-2020-25635, GHSA-f556-49jc-4rvc, PYSEC-2020-220 | Medium | 0.3% | 05 Oct, 2020 | PyPI ansible |
Redirect URL matching ignores character casing CVE-2020-15234, GHSA-grfp-q2mm-hfp6 | Medium | 0.8% | 02 Oct, 2020 | Go github.com/ory/fosite |
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses CVE-2020-15233, GHSA-rfq3-w54c-f9q5 | Medium | 0.8% | 02 Oct, 2020 | Go github.com/ory/fosite |
Froala WYSIWYG Editor XSS Vulnerability CVE-2020-26523, GHSA-qrhq-x7xh-2784 | Medium | 0.7% | 02 Oct, 2020 | Packagist froala/wysiwyg-editor |
Environment Variable Injection in GitHub Actions CVE-2020-15228, GHSA-mfwh-5m23-j46w | Medium | 1.5% | 01 Oct, 2020 | npm @actions/core |
Authorization bypass in Istio CVE-2020-16844, GHSA-82mm-ffjr-h86c | Medium | 1.1% | 01 Oct, 2020 | Go istio.io/istio |
Cross-site scripting in @atlaskit/editor-core CVE-2019-20903, GHSA-p5ch-w78f-xh44 | Medium | 1.1% | 01 Oct, 2020 | npm @atlaskit/editor-core |
MantisBT HTML Injection vulnerability CVE-2020-25830, GHSA-2pm7-q8pc-xhvq | Medium | 1.7% | 30 Sep, 2020 | Packagist mantisbt/mantisbt |
MantisBT unauthorized users able to access private files CVE-2020-25781, GHSA-xjmx-cprh-646r | Medium | 0.9% | 30 Sep, 2020 | Packagist mantisbt/mantisbt |
MantisBT XXS where a Custom Field with a crafted Regular Expression property is used CVE-2020-25288, GHSA-qgrr-f26j-87vf | Medium | 1.5% | 30 Sep, 2020 | Packagist mantisbt/mantisbt |
Cross-site Scripting (XSS) in Django REST Framework CVE-2020-25626, GHSA-fx83-3ph3-9j2q, PYSEC-2020-263 | Medium | 1.3% | 30 Sep, 2020 | PyPI djangorestframework |
Authenticated users can exploit an enumeration vulnerability in Harbor BIT-harbor-2020-13794, CVE-2020-13794, GHSA-q9p8-33wc-h432, GO-2022-0865 | Medium | 1.3% | 30 Sep, 2020 | Go github.com/goharbor/harbor |