Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Remote Code Execution Through Image Uploads in BookStack CVE-2020-5256, GHSA-g9rq-x4fj-f5hx | High | 2.0% | 09 Mar, 2020 | Packagist ssddanbrown/bookstack |
Froxlor arbitrary code execution via the database configuration options CVE-2020-10235, GHSA-p29c-jpgj-v57r | High | 1.7% | 09 Mar, 2020 | Packagist froxlor/froxlor |
Path Traversal in Ansible CVE-2020-1737, GHSA-893h-35v4-mxqx, PYSEC-2020-9 | High | 0.4% | 09 Mar, 2020 | PyPI ansible |
D-Link DCS-930L Devices OS Command Injection Vulnerability CVE-2016-11021 | HighExploited | 69.6% | 09 Mar, 2020 | |
rConfig OS Command Injection Vulnerability CVE-2020-10221 | HighExploited | 77.1% | 08 Mar, 2020 | |
Uncontrolled Resource Consumption in urllib3 CVE-2020-7212, GHSA-hmv2-79q8-fv6g, PYSEC-2020-149 | High | 3.4% | 06 Mar, 2020 | PyPI urllib3 |
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit GHSA-p94w-42g3-f7h4 | High | Not scored | 06 Mar, 2020 | npm vp-toolkit |
Holder can generate proof of ownership for credentials it does not control in vp-toolkit GHSA-ff5x-w9wg-h275 | High | Not scored | 06 Mar, 2020 | npm vp-toolkit |
D-Link DWL-2600AP Access Point Command Injection Vulnerability CVE-2019-20500 | HighExploited | 96.7% | 05 Mar, 2020 | |
SQL injection in Django BIT-django-2020-9402, CVE-2020-9402, GHSA-3gh2-xw74-jmcw, PYSEC-2020-345, PYSEC-2020-36 | High | 24.0% | 05 Mar, 2020 | PyPI Django PyPI django |
Information disclosure in parse-server BIT-parse-2020-5251, CVE-2020-5251, GHSA-h4mf-75hf-67w4 | High | 0.8% | 04 Mar, 2020 | npm parse-server |
OS Command Injection in ansible CVE-2020-1734, GHSA-h39q-95q5-9jfp, PYSEC-2020-6 | High | 0.5% | 03 Mar, 2020 | PyPI ansible |
Mozilla Firefox And Thunderbird Type Confusion Vulnerability CVE-2019-17026 | HighExploited | 46.3% | 02 Mar, 2020 | |
Exposure of Resource to Wrong Sphere in valib CVE-2019-10805, GHSA-pmpr-vc5q-h3jw, SNYK-JS-VALIB-559015 | High | 1.4% | 28 Feb, 2020 | npm valib |
HTTP Response Splitting in Puma BIT-ruby-2020-5247, BIT-ruby-min-2020-5247, CVE-2020-5247, GHSA-84j7-475p-hp8v | High | 2.5% | 28 Feb, 2020 | RubyGems puma |
Google Chromium V8 Type Confusion Vulnerability CVE-2020-6418 | HighExploited | 78.8% | 27 Feb, 2020 | |
Apple Multiple Products Memory Corruption Vulnerability CVE-2020-3837 | HighExploited | 14.8% | 27 Feb, 2020 | |
CardGate Payments plugin for WooCommerce does not validate request origin CVE-2020-8819, GHSA-5pq5-9phv-q5j3 | High | 4.9% | 25 Feb, 2020 | Packagist cardgate/woocommerce |
Origin Validation Error in Magento 2 CVE-2020-8818, GHSA-qf6q-qfwp-vp44 | High | 4.2% | 25 Feb, 2020 | Packagist cardgate/magento2 |
OS Command Injection in compile-sass CVE-2019-10799, GHSA-79qm-h35f-hr77, SNYK-JS-COMPILESASS-551804 | High | 2.3% | 24 Feb, 2020 | npm compile-sass |
discord-html not escaping HTML code blocks when lacking a language identifier GHSA-9r27-994c-4xch | High | Not scored | 24 Feb, 2020 | npm discord-markdown |
Private data exposure via REST API in BuddyPress CVE-2020-5244, GHSA-3j78-7m59-r7gv | High | 2.4% | 24 Feb, 2020 | Packagist buddypress/buddypress |
Path Traversal in Yarn CVE-2020-8131, GHSA-8mfc-v7wv-p62g | High | 5.2% | 24 Feb, 2020 | npm yarn |
Denial of Service in uap-core when processing crafted User-Agent strings CVE-2020-5243, GHSA-cmcx-xhr8-3w9p | High | 2.3% | 20 Feb, 2020 | RubyGems user_agent_parser npm uap-core |
Improper Verification of Cryptographic Signature in golang.org/x/crypto CVE-2020-9283, GHSA-ffhg-7mh4-33c4, GO-2020-0012 | High | 21.1% | 20 Feb, 2020 | Go golang.org/x/crypto |
BSON rubygem contains potential denial of service CVE-2015-4411, GHSA-qh4w-7pw3-p4rp | High | 6.4% | 20 Feb, 2020 | RubyGems bson |
Moped Rubygem Data Injection Vulnerability CVE-2015-4410, GHSA-f93j-hmcr-jcwh | High | 5.7% | 20 Feb, 2020 | RubyGems moped |
Silverstripe CSRF Protection Bypass via GraphQL CVE-2019-12437, GHSA-fx37-56v6-85q6 | High | 0.7% | 19 Feb, 2020 | Packagist silverstripe/graphql |
Nokogiri is vulnerable to XML External Entity (XXE) attack CVE-2012-6685, GHSA-6wj9-77wq-jq7p | High | 2.2% | 19 Feb, 2020 | RubyGems nokogiri |
TaffyDB can allow access to any data items in the DB CVE-2019-10790, GHSA-mxhp-79qh-mcx6 | High | 1.9% | 17 Feb, 2020 | npm taffy npm taffydb |
codecov NPM module allows remote attackers to execute arbitrary commands CVE-2020-7597, GHSA-5q88-cjfq-g2mh, SNYK-JS-CODECOV-548879 | High | 2.9% | 17 Feb, 2020 | npm codecov |
XSS/Script injection vulnerability in matestack CVE-2020-5241, GHSA-3jqw-vv45-mjhh | High | 0.6% | 12 Feb, 2020 | RubyGems matestack-ui-core |
GPGME Go wrapper contains Use After Free CVE-2020-8945, GHSA-m6wg-2mwg-4rfq, GO-2021-0096 | High | 5.1% | 12 Feb, 2020 | Go github.com/proglottis/gpgme |
opencontainers runc contains procfs race condition with a shared volume mount CVE-2019-19921, GHSA-fh74-hm69-rqjw, GO-2021-0087 | High | 0.4% | 12 Feb, 2020 | Go github.com/opencontainers/runc |
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability CVE-2020-0688 | HighExploited | 100.0% | 11 Feb, 2020 | |
Microsoft Windows Installer Privilege Escalation Vulnerability CVE-2020-0683 | HighExploited | 7.7% | 11 Feb, 2020 | |
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability CVE-2020-0674 | HighExploited | 86.9% | 11 Feb, 2020 | |
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability CVE-2020-0618 | HighExploited | 99.0% | 11 Feb, 2020 | |
Netis WF2419 Devices Remote Code Execution Vulnerability CVE-2019-19356 | HighExploited | 28.1% | 07 Feb, 2020 | |
TeamViewer Desktop Bypass Remote Login Vulnerability CVE-2019-18988 | HighExploited | 4.7% | 07 Feb, 2020 | |
EyesOfNetwork Improper Privilege Management Vulnerability CVE-2020-8655 | HighExploited | 59.9% | 07 Feb, 2020 | |
Cisco IOS XR Software Discovery Protocol Format String Vulnerability CVE-2020-3118 | HighExploited | 11.7% | 05 Feb, 2020 | |
Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle CVE-2020-5237, GHSA-x8wj-6m73-gfqp | High | 3.9% | 05 Feb, 2020 | Packagist oneup/uploader-bundle |
dot-prop Prototype Pollution vulnerability CVE-2020-8116, GHSA-ff7x-qrg7-qggm | High | 3.1% | 04 Feb, 2020 | npm dot-prop |
Improper Access Control in Lightning Network Daemon CVE-2019-12999, GHSA-78hj-86cr-6j2v, GO-2022-0807 | High | 2.2% | 31 Jan, 2020 | Go github.com/lightningnetwork/lnd |
Denial of Service (DoS) in HashiCorp Consul BIT-consul-2020-7219, CVE-2020-7219, GHSA-23jv-v6qj-3fhh, GO-2022-0776 | High | 2.0% | 31 Jan, 2020 | Go github.com/hashicorp/consul |
Allocation of Resources Without Limits or Throttling in HashiCorp Nomad CVE-2020-7218, GHSA-h43v-26r7-7j4c, GO-2022-0840 | High | 1.5% | 31 Jan, 2020 | Go github.com/hashicorp/nomad |
Malicious takeover of previously owned ENS names CVE-2020-5232, GHSA-8f9f-pc5v-9r5h | High | 1.2% | 30 Jan, 2020 | npm @ensdomains/ens |
Cross-site scripting vulnerability in TinyMCE CVE-2020-17480, GHSA-27gm-ghr9-4v95 | High | 1.2% | 30 Jan, 2020 | npm tinymce |
Insecure Entropy Source - Math.random() in node-uuid CVE-2015-8851, GHSA-265q-28rp-chq5 | High | 2.3% | 30 Jan, 2020 | npm node-uuid |