Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
MantisBT XSS issue on the view_all_bug_page.php CVE-2020-16266, GHSA-4rrc-5vp6-m3f6 | Medium | 1.2% | 12 Aug, 2020 | Packagist mantisbt/mantisbt |
CBC padding oracle issue in AWS S3 Crypto SDK for golang CVE-2020-8911, GHSA-f5pg-7wfw-84q9, GO-2022-0646 | Medium | 0.3% | 11 Aug, 2020 | Go github.com/aws/aws-sdk-go |
Cross-site scripting vulnerability in TinyMCE CVE-2020-12648, GHSA-vrv8-v4w8-f95h | Medium | 1.8% | 11 Aug, 2020 | npm tinymce |
CSRF tokens leaked in URL by canned query form GHSA-q6j3-c4wc-63vw | Medium | Not scored | 11 Aug, 2020 | PyPI datasette |
Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records CVE-2020-15136, GHSA-wr2v-9rpq-c35q | Medium | 1.7% | 06 Aug, 2020 | Go go.etcd.io/etcd |
XSS via JQLite DOM manipulation functions in AngularJS GHSA-5cp4-xmrw-59wf | Medium | Not scored | 05 Aug, 2020 | npm angular |
CSRF Vulnerability in polaris-website GHSA-whrh-9j4q-g7ph | Medium | Not scored | 05 Aug, 2020 | npm polaris-website |
Reset Password / Login vulnerability in Sulu CVE-2020-15132, GHSA-wfm4-pq59-wg6r | Medium | 1.1% | 05 Aug, 2020 | Packagist sulu/sulu |
CSS Injection in Chartkick gem CVE-2020-16254, GHSA-3j95-fjv2-3m4p | Medium | 0.8% | 05 Aug, 2020 | RubyGems chartkick |
etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic BIT-etcd-2020-15106, BIT-etcd-2020-15112, CVE-2020-15106, CVE-2020-15112, GHSA-m332-53r6-2w93, GHSA-p4g4-wgrh-qrg2, GO-2020-0005 | Medium | 1.3% | 05 Aug, 2020 | Go go.etcd.io/etcd Go go.etcd.io/etcd/v3 |
Field Test CSRF vulnerability CVE-2020-16252, GHSA-w542-cpp9-r3g7 | Medium | 0.4% | 05 Aug, 2020 | RubyGems field_test |
Ability to change order address without triggering address validations in solidus CVE-2020-15109, GHSA-3mvg-rrrw-m7ph | Medium | 1.0% | 04 Aug, 2020 | RubyGems solidus_api RubyGems solidus_frontend |
Reliance on Cookies without validation in OctoberCMS CVE-2020-15128, GHSA-55mm-5399-7r63 | Medium | 0.7% | 31 Jul, 2020 | Packagist october/rain |
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header CVE-2020-15129, GHSA-6qq8-5wq3-86rp | Medium | 8.0% | 30 Jul, 2020 | Go github.com/containous/traefik Go github.com/containous/traefik/api Go github.com/containous/traefik/v2 Go github.com/containous/traefik/v2/pkg/api +4 more |
Denial of service in fastify CVE-2020-8192, GHSA-xw5p-hw6r-2j98 | Medium | 1.2% | 30 Jul, 2020 | npm fastify |
ingress-nginx component for Kubernetes allows file overwrite CVE-2020-8553, GHSA-hhpm-74pm-hf35 | Medium | 0.9% | 29 Jul, 2020 | Go k8s.io/ingress-nginx |
Cross-site Scripting vulnerability in Kitodo.Presentation CVE-2020-16095, GHSA-fpqv-x9hm-35j9 | Medium | 0.9% | 29 Jul, 2020 | Packagist kitodo/presentation |
Magento security mitigation bypass vulnerability BIT-magento-2020-9692, CVE-2020-9692, GHSA-vqg7-8v6x-54rq | Medium | 3.8% | 29 Jul, 2020 | Packagist magento/community-edition |
Magento observable timing discrepancy vulnerability BIT-magento-2020-9690, CVE-2020-9690, GHSA-xgp9-j48h-jjf9 | Medium | 1.8% | 29 Jul, 2020 | Packagist magento/community-edition |
Magento path traversal vulnerability BIT-magento-2020-9689, CVE-2020-9689, GHSA-fr6f-xmfx-rrpq | Medium | 4.1% | 29 Jul, 2020 | Packagist magento/community-edition Packagist magento/project-community-edition |
Shopware vulnerable to Cross-site Scripting CVE-2020-13971, GHSA-fxf3-wx3c-76pf | Medium | 0.6% | 28 Jul, 2020 | Packagist shopware/platform |
Authorization Bypass in I hate money CVE-2020-15120, GHSA-67j9-c52g-w2q9, PYSEC-2020-264 | Medium | 1.0% | 27 Jul, 2020 | PyPI ihatemoney |
Grafana stored XSS BIT-grafana-2020-11110, CVE-2020-11110, GHSA-xr3x-62qw-vc4w, GO-2024-2523 | Medium | 9.6% | 27 Jul, 2020 | Go github.com/grafana/grafana |
Uncontrolled resource consumption in jpeg-js CVE-2020-8175, GHSA-w7q9-p3jq-fmhm | Medium | 1.1% | 24 Jul, 2020 | npm jpeg-js |
Storing Password in Local Storage GHSA-wvh7-5p38-2qfc | Medium | Not scored | 23 Jul, 2020 | npm parse |
Denial of service in Kubernetes CVE-2020-8557, GHSA-55qj-gj3x-jq9r, GO-2024-2753 | Medium | 0.4% | 23 Jul, 2020 | Go k8s.io/kubernetes Go k8s.io/kubernetes/pkg/kubelet |
MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment CVE-2020-15885, GHSA-vc4f-2g7f-pmqr | Medium | 0.9% | 23 Jul, 2020 | Packagist munkireport/comment |
MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability CVE-2020-15883, GHSA-79xr-v794-wq35 | Medium | 1.2% | 23 Jul, 2020 | Packagist munkireport/managedinstalls |
MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability CVE-2020-15881, GHSA-x9q4-5f3c-cw62 | Medium | 1.2% | 23 Jul, 2020 | Packagist munkireport/munki_facts |
GraphQL: Security breach on Viewer query CVE-2020-15126, GHSA-236h-rqv8-8q73 | Medium | 1.1% | 22 Jul, 2020 | npm parse-server |
Magento stored cross-site scripting vulnerability CVE-2020-9665, GHSA-xc4p-j89c-p7x5 | Medium | 1.4% | 22 Jul, 2020 | Packagist magento/core |
Android WebView Universal Cross-site Scripting CVE-2020-6506, GHSA-36j3-xxf7-4pqg | Medium | 3.7% | 22 Jul, 2020 | npm react-native-webview |
Privilege Escalation in Kubernetes CVE-2020-8559, GHSA-33c5-9fx5-fvjm, GO-2024-2748 | Medium | 6.1% | 22 Jul, 2020 | Go k8s.io/apimachinery Go k8s.io/kubernetes |
LibreNMS SQL Injection vulnerability CVE-2020-15873, GHSA-g5r6-vrmx-9gwj | Medium | 2.2% | 21 Jul, 2020 | Packagist librenms/librenms |
CRLF vulnerability in Fiber CVE-2020-15111, GHSA-9cx9-x2gp-9qvh, GO-2021-0108 | Medium | 0.9% | 20 Jul, 2020 | Go github.com/gofiber/fiber |
Cross-site Scripting in docsify CVE-2020-7680, GHSA-qpqh-46qj-vwcw, SNYK-JS-DOCSIFY-567099 | Medium | 4.5% | 20 Jul, 2020 | npm docsify |
Data race and crash in net/http BIT-golang-2020-15586, CVE-2020-15586, GO-2021-0224 | Medium | 2.9% | 17 Jul, 2020 | Go stdlib |
Certificate verification error on Windows in crypto/x509 BIT-golang-2020-14039, CVE-2020-14039, GO-2021-0223 | Medium | 1.8% | 17 Jul, 2020 | Go stdlib |
Credential leak in react-native-fast-image CVE-2020-7696, GHSA-6xhg-q9c8-rj32 | Medium | 1.6% | 17 Jul, 2020 | npm react-native-fast-image |
Multiple stored XSS in RBAC Admin screens in Apache Airflow BIT-airflow-2020-11983, CVE-2020-11983, GHSA-q4p3-qw5c-mhpc, PYSEC-2020-17 | Medium | 1.8% | 17 Jul, 2020 | PyPI apache-airflow |
Stored XSS in Apache Airflow BIT-airflow-2020-9485, CVE-2020-9485, GHSA-j38c-25fj-mr84, PYSEC-2020-23 | Medium | 2.8% | 17 Jul, 2020 | PyPI apache-airflow |
Silverstripe CMS XSS Vulnerability BIT-silverstripe-2020-9311, CVE-2020-9311, GHSA-2pw2-qpcp-m47x | Medium | 0.6% | 15 Jul, 2020 | Packagist silverstripe/cms Packagist silverstripe/framework |
Silverstripe has Incorrect Default Permissions BIT-silverstripe-2020-6165, CVE-2020-6165, GHSA-589q-75r3-mfq4 | Medium | 1.1% | 15 Jul, 2020 | Packagist silverstripe/graphql Packagist silverstripe/recipe-cms |
Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788) BIT-harbor-2020-13788, CVE-2020-13788, GHSA-33p6-fx42-7rf5, GO-2022-0781 | Medium | 1.3% | 15 Jul, 2020 | Go github.com/goharbor/harbor |
Prototype Pollution in Ajv CVE-2020-15366, GHSA-v88g-cgmw-v5xw | Medium | 2.3% | 15 Jul, 2020 | npm ajv |
SilverStripe Web Cache Poisoning through HTTPRequestBuilder CVE-2019-19326, GHSA-q9ff-3q93-fm8m | Medium | 0.8% | 15 Jul, 2020 | Packagist silverstripe/framework |
Stored XSS in October CVE-2020-11083, GHSA-w4pj-7p68-3vgv | Medium | 1.1% | 14 Jul, 2020 | Packagist october/backend |
Cross-site Scripting in RosarioSIS CVE-2020-15721, GHSA-6vc5-v7hw-h5h2 | Medium | 1.5% | 14 Jul, 2020 | Packagist francoisjacquet/rosariosis |
Command Injection in standard-version GHSA-7xcx-6wjh-7xp2 | Medium | Not scored | 13 Jul, 2020 | npm standard-version |
User passwords are stored in clear text in the Django session CVE-2020-15105, GHSA-vhr6-pvjm-9qwf, PYSEC-2020-39 | Medium | 0.7% | 10 Jul, 2020 | PyPI django-two-factor-auth |