Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability CVE-2020-8196 | MediumExploited | 26.3% | 10 Jul, 2020 | |
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability CVE-2020-8195 | MediumExploited | 33.0% | 10 Jul, 2020 | |
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability CVE-2020-8193 | MediumExploited | 88.3% | 10 Jul, 2020 | |
Improper Input Validation in SocksJS-Node CVE-2020-7693, GHSA-c9g6-9335-x697 | Medium | 5.0% | 09 Jul, 2020 | npm sockjs |
Sensitive information exposure through logs in npm-registry-fetch GHSA-jmqm-f2gx-4fjv | Medium | Not scored | 07 Jul, 2020 | npm npm-registry-fetch |
npm CLI exposing sensitive information through logs CVE-2020-15095, GHSA-93f3-23rq-pjfp | Medium | 0.4% | 07 Jul, 2020 | npm npm |
Potentially sensitive data exposure in Symfony Web Socket Bundle GHSA-wwgf-3xp7-cxj4 | Medium | Not scored | 07 Jul, 2020 | Packagist gos/web-socket-bundle |
DOM-based cross-site scripting in Froala Editor CVE-2019-19935, GHSA-h236-g5gh-vq6c | Medium | 1.8% | 07 Jul, 2020 | npm froala-editor |
ke_search for Typo3 XSS Vulnerability CVE-2020-15517, GHSA-gg48-mpp8-cgqc | Medium | 0.6% | 07 Jul, 2020 | Packagist tpwd/ke_search |
jh_captcha for Typo3 XSS Vulnerability CVE-2020-15514, GHSA-23fm-v895-3qxq | Medium | 0.6% | 07 Jul, 2020 | Packagist haffner/jh_captcha |
Incorrect access control in typo3_forum CVE-2020-15513, GHSA-57gr-jvqr-3hwm | Medium | 0.8% | 07 Jul, 2020 | Packagist mittwald/typo3_forum |
Context isolation bypass via Promise in Electron CVE-2020-15096, GHSA-6vrv-94jv-crrg | Medium | 0.8% | 07 Jul, 2020 | npm electron |
Cross-site scripting in jspdf CVE-2020-7691, GHSA-3q6f-8grx-pr4v | Medium | 1.6% | 06 Jul, 2020 | npm jspdf |
Cross-site scripting in jspdf CVE-2020-7690, GHSA-vh59-v9r5-4mh4, SNYK-JS-JSPDF-575256 | Medium | 1.0% | 06 Jul, 2020 | npm jspdf |
Cross-site scripting in @shopify/koa-shopify-auth CVE-2020-8176, GHSA-jqh7-w5pr-cr56 | Medium | 1.0% | 02 Jul, 2020 | npm @shopify/koa-shopify-auth |
Denial of Service in TenderMint CVE-2020-15091, GHSA-6jqj-f58p-mrw3, GO-2021-0090 | Medium | 0.9% | 02 Jul, 2020 | Go github.com/tendermint/tendermint |
Cross-site Scripting in October CVE-2020-4061, GHSA-3pc2-fm7p-q2vg | Medium | 0.8% | 02 Jul, 2020 | Packagist october/backend |
Cross-site scripting in TileServer GL CVE-2020-15500, GHSA-3fr8-mwpp-8h9p | Medium | 12.2% | 01 Jul, 2020 | npm tileserver-gl |
ECDSA signature vulnerability of Minerva timing attack in jsrsasign GHSA-g753-jx37-7xwh | Medium | Not scored | 30 Jun, 2020 | npm jsrsasign |
Cross-Site Request Forgery in CakePHP CVE-2020-15400, GHSA-j33j-fg2g-mcv2 | Medium | 0.4% | 30 Jun, 2020 | Packagist cakephp/cakephp |
Open Redirect in OAuth2 Proxy BIT-oauth2-proxy-2020-4037, CVE-2020-4037, GHSA-5m6c-jp6f-2vcv | Medium | 0.9% | 29 Jun, 2020 | Go github.com/oauth2-proxy/oauth2-proxy |
Magento Stored cross-site scripting BIT-magento-2020-9584, CVE-2020-9584, GHSA-45h4-6gcj-6hwv | Medium | 1.2% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability BIT-magento-2020-9581, CVE-2020-9581, GHSA-2w2x-7qgj-4x78 | Medium | 1.5% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core Packagist magento/project-community-edition |
Magento stored cross-site scripting vulnerability BIT-magento-2020-9577, CVE-2020-9577, GHSA-689w-2f93-2x67 | Medium | 1.5% | 26 Jun, 2020 | Packagist magento/community-edition Packagist magento/core Packagist magento/project-community-edition |
Deserialization of Untrusted Data in Beaker CVE-2013-7489, GHSA-3cwm-7jmm-774w, PYSEC-2020-216 | Medium | 1.1% | 26 Jun, 2020 | PyPI Beaker PyPI beaker |
Log Forging in generator-jhipster-kotlin CVE-2020-4072, GHSA-pfxf-wh96-fvjc | Medium | 1.2% | 25 Jun, 2020 | npm generator-jhipster-kotlin |
img_auth.php may leak private extension images into the public cache BIT-mediawiki-2020-15005, CVE-2020-15005, GHSA-xpv7-93cm-4mxv | Medium | 1.3% | 24 Jun, 2020 | Packagist mediawiki/core |
Untrusted users can run pending migrations in production in Rails CVE-2020-8185, GHSA-c6qr-h5vq-59jc | Medium | 2.2% | 24 Jun, 2020 | RubyGems actionpack |
Directory traversal outside of SENDFILE_ROOT in django-sendfile2 GHSA-6r3c-8xf3-ggrr | Medium | Not scored | 24 Jun, 2020 | PyPI django-sendfile2 |
NukeViet Cross-Site Request Forgery (CSRF) CVE-2020-13157, GHSA-g3xf-85wc-45gq | Medium | 0.6% | 23 Jun, 2020 | Packagist nukeviet/nukeviet |
NukeViet Cross-Site Request Forgery (CSRF) CVE-2020-13156, GHSA-c2px-jcgw-9x57 | Medium | 0.6% | 23 Jun, 2020 | Packagist nukeviet/nukeviet |
Timing attack on django-basic-auth-ip-whitelist CVE-2020-4071, GHSA-m38j-pmg3-v5x5, PYSEC-2020-37 | Medium | 0.4% | 23 Jun, 2020 | PyPI django-basic-auth-ip-whitelist |
Unrestricted Uploads in Concrete5 CVE-2020-14961, GHSA-g4gm-pxh3-29fq | Medium | 1.0% | 22 Jun, 2020 | Packagist concrete5/concrete5 |
Insecure Permissions in Gogs CVE-2020-14958, GHSA-4c7m-vv47-7c69, GO-2022-0788 | Medium | 0.9% | 21 Jun, 2020 | Go gogs.io/gogs |
Information Exposure in jaeger BIT-jaeger-2020-10750, CVE-2020-10750, GHSA-gh32-pc56-4c96, GO-2022-0834 | Medium | 0.4% | 19 Jun, 2020 | Go github.com/jaegertracing/jaeger |
Mattermost Server does not restrict SAML certificate path for System Administrators CVE-2017-18918, GHSA-5ghq-28r7-qwfj, GO-2026-4460 | Medium | 0.5% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has Improper Authorization for Integration Requests CVE-2017-18916, GHSA-x33g-375j-jhf7, GO-2026-4467 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to XSS through channel headers CVE-2017-18907, GHSA-42x9-rr3c-gr59, GO-2026-4459 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider CVE-2017-18905, GHSA-g24c-fx4v-xg9w, GO-2026-4306 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows XSS via CSRF CVE-2016-11084, GHSA-vw57-55f8-c73q, GO-2025-4066 | Medium | 0.3% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution CVE-2016-11083, GHSA-rm24-25xm-9454, GO-2025-4065 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through crafted links CVE-2016-11082, GHSA-m78r-2x6w-qqjp, GO-2025-4064 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes information stored by a web browser CVE-2016-11081, GHSA-5q37-9874-qxcw, GO-2025-4062 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes account details to any Team Administrator CVE-2016-11080, GHSA-g3f3-p9rc-775p, GO-2025-4063 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows XSS via redirect URL CVE-2016-11079, GHSA-2j9c-76pp-xc5q, GO-2025-4053 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive information via its System Console UI CVE-2016-11078, GHSA-9w4v-9c99-hv7r, GO-2025-4057 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive information about team URLs via an API CVE-2016-11075, GHSA-q3g9-hgrx-hwhx, GO-2025-4061 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS via a Legal or Support setting CVE-2016-11073, GHSA-9jrx-fgrm-96qh, GO-2025-4056 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server's Session ID and Session Token are potentially compromised CVE-2016-11072, GHSA-43m6-wvc8-2m7j, GO-2025-4055 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` CVE-2016-11071, GHSA-h3qg-w9j5-wh3m, GO-2025-4058 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |