Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Server is vulnerable to XSS through customizable theme color-code values CVE-2016-11070, GHSA-h8qw-xqm9-q66j, GO-2025-4050 | Medium | 0.6% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Code Injection through its LDAP fields CVE-2016-11068, GHSA-7vmw-6c7h-rrrv, GO-2025-4048 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Uncontrolled Resource Consumption CVE-2016-11067, GHSA-ffcc-qr2v-3qmv, GO-2025-4046 | Medium | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to Cross-site Scripting through file preview feature CVE-2016-11063, GHSA-cffj-7w5c-jqjh, GO-2025-4045 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to XSS via an uploaded file CVE-2017-18904, GHSA-8pff-p3gx-w4jf, GO-2026-4302 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes team invite IDs through API endpoints CVE-2017-18902, GHSA-jwfv-5hwq-f97r, GO-2025-4185 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes private team invite ID CVE-2017-18901, GHSA-c253-8hr4-r8v9, GO-2026-4304 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to DoS through maliciously crafted posts CVE-2017-18898, GHSA-9589-mq83-f749, GO-2026-4300 | Medium | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server mishandles redirect denial action CVE-2017-18897, GHSA-f7c3-7vp3-44p6, GO-2026-4301 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint CVE-2017-18896, GHSA-63wg-qmrv-7q66, GO-2026-4299 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint CVE-2017-18895, GHSA-h742-xx59-r9pq, GO-2026-4295 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through display name field CVE-2017-18893, GHSA-887v-xh2x-47cm, GO-2026-4296 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not neutralize HTML content in an Email template field CVE-2017-18892, GHSA-wj5w-qghh-gvqp, GO-2026-4317 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not safeguard against phishing via error page links CVE-2017-18891, GHSA-vrh2-rprg-rgc6, GO-2026-4298 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to create buttons that can launch API requests CVE-2017-18890, GHSA-m497-hq5x-6jcv, GO-2025-4202 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to webhook and slash command manipulation CVE-2017-18889, GHSA-jp57-4x34-5v94, GO-2025-4201 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes team creator's e-mail address to other members CVE-2017-18887, GHSA-35c4-5qfp-wxj6, GO-2025-4199 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through author_link field in Slack attachments CVE-2017-18879, GHSA-498j-wxww-j897, GO-2025-4189 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows users with a session ID to revoke another users' session CVE-2017-18878, GHSA-h564-6gc2-fcc6, GO-2025-4191 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Directory Traversal by System Admins CVE-2017-18874, GHSA-8qg8-c7mw-6fj7, GO-2025-4148 | Medium | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
CSRF Vulnerability in rails-ujs CVE-2020-8167, GHSA-xq5j-gw7f-jgj8 | Medium | 1.5% | 19 Jun, 2020 | RubyGems actionview |
Mattermost Server is vulnerable to channel invisibility DoS via misformatted post CVE-2017-18873, GHSA-x6mw-hf2j-vqpc, GO-2026-4282 | Medium | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization CVE-2017-18872, GHSA-hgrp-fgm8-56g8, GO-2025-4075 | Medium | 0.6% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Dolibarr reflected cross-site scripting (XSS) vulnerability BIT-dolibarr-2020-14475, CVE-2020-14475, GHSA-m396-2x3h-v3v4 | Medium | 0.8% | 19 Jun, 2020 | Packagist dolibarr/dolibarr |
Improper Input Validation in strapi CVE-2020-13961, GHSA-65wv-528r-m892 | Medium | 1.7% | 19 Jun, 2020 | npm strapi |
Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page CVE-2017-18877, GHSA-9x8x-w6g5-hx4w, GO-2025-4190 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Path Traversal when files are stored locally CVE-2017-18876, GHSA-hjqh-j6rj-gh8q, GO-2025-4187 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not prevent System Admin from arbitrary file creation CVE-2017-18875, GHSA-9rr5-q43r-ccv4, GO-2025-4186 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
CVE-2017-18870 in github.com/mattermost/mattermost-server CVE-2017-18870, GHSA-9j9j-mm2r-9rfm, GO-2025-4183 | Medium | 0.6% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server Sensitive Data Exposure BIT-mattermost-2020-14457, CVE-2020-14457, GHSA-j2h2-cvwh-cr64, GO-2023-1939 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 |
OMERO-web Sensitive Data Exposure CVE-2020-7932, GHSA-vwxv-frj6-fhc9, PYSEC-2020-244 | Medium | 0.8% | 17 Jun, 2020 | PyPI omero-web |
Treck TCP/IP stack Out-of-Bounds Read Vulnerability CVE-2020-11899 | MediumExploited | 18.4% | 17 Jun, 2020 | |
Plugin archive directory traversal in Helm BIT-helm-2020-4053, CVE-2020-4053, GHSA-qq3j-xp49-j73f | Medium | 1.5% | 16 Jun, 2020 | Go helm.sh/helm/v3 |
Cross-site Scripting in dijit editor's LinkDialog plugin CVE-2020-4051, GHSA-cxjc-r2fp-7mq6 | Medium | 1.2% | 15 Jun, 2020 | npm dijit |
KumbiaPHP Cross-site Scripting CVE-2020-14146, GHSA-x6gq-vr59-4q5q | Medium | 0.6% | 15 Jun, 2020 | Packagist kumbiaphp/kumbiapp |
Incorrect Permission Assignment for Critical Resource in Hashicorp Consul BIT-consul-2020-12797, CVE-2020-12797, GHSA-hwqm-x785-qh8p, GO-2022-0847 | Medium | 1.5% | 11 Jun, 2020 | Go github.com/hashicorp/consul |
Improper Privilege Management and Execution with Unnecessary Privileges in Kata Containers CVE-2020-2023, GHSA-6978-vg2j-cc9q | Medium | 1.1% | 10 Jun, 2020 | Go github.com/kata-containers/agent Go github.com/kata-containers/runtime |
Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability CVE-2020-9819 | MediumExploited | 2.2% | 09 Jun, 2020 | |
OpenCart Cross-site Scripting CVE-2020-13980, GHSA-p9qw-fh38-x37f | Medium | 0.7% | 09 Jun, 2020 | Packagist opencart/opencart |
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability CVE-2020-13965 | MediumExploited | 76.6% | 09 Jun, 2020 | |
Angular vulnerable to Cross-site Scripting CVE-2020-7676, GHSA-mhp6-pxh8-r675, SNYK-JS-ANGULAR-570058 | Medium | 1.9% | 08 Jun, 2020 | npm angular |
Introspection in schema validation in Apollo Server GHSA-w42g-7vfc-xf37 | Medium | Not scored | 05 Jun, 2020 | npm apollo-server npm apollo-server-azure-functions npm apollo-server-cache-memcached npm apollo-server-cloud-functions +8 more |
Use of insecure jQuery version in OctoberCMS GHSA-v73w-r9xg-7cr9 | Medium | Not scored | 05 Jun, 2020 | Packagist october/october Packagist october/system |
Comments plugin stored Cross-site Scripting (XSS) via an asset volume name CVE-2020-13870, GHSA-69ww-wv3j-mhg4 | Medium | 0.5% | 05 Jun, 2020 | Packagist verbb/comments |
Comments plugin stored Cross-site Scripting via a guest name CVE-2020-13869, GHSA-jhhf-c849-3rh2 | Medium | 0.5% | 05 Jun, 2020 | Packagist verbb/comments |
Comments plugin Cross-Site Request Forgery (CSRF) CVE-2020-13868, GHSA-4r8c-pj7x-m5jx | Medium | 0.4% | 05 Jun, 2020 | Packagist verbb/comments |
Server Side Request Forgery (SSRF) in Kubernetes CVE-2020-8555, GHSA-x6mj-w4jf-jmgw, GO-2022-0890 | Medium | 3.7% | 05 Jun, 2020 | Go k8s.io/kubernetes |
Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements CVE-2020-11091, GHSA-59qg-grp7-5r73, GO-2022-0794 | Medium | 0.9% | 03 Jun, 2020 | Go github.com/weaveworks/weave |
Potential CSV Injection vector in OctoberCMS CVE-2020-5299, GHSA-4rhm-m2fp-hx7q | Medium | 1.0% | 03 Jun, 2020 | Packagist october/backend |
Reflected XSS when importing CSV in OctoberCMS CVE-2020-5298, GHSA-gg6x-xx78-448c | Medium | 0.9% | 03 Jun, 2020 | Packagist october/backend |