Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Potential XSS vulnerability in jQuery BIT-drupal-2020-11022, CVE-2020-11022, GHSA-gxr4-xjj5-5px2 | Medium | 99.2% | 29 Apr, 2020 | Maven org.webjars.npm:jquery NuGet jquery Packagist athlon1600/youtube-downloader Packagist components/jquery +3 more |
Subrion CMS PHP Object Injection CVE-2020-12469, GHSA-fmqq-hw9m-448q | Medium | 0.9% | 29 Apr, 2020 | Packagist intelliants/subrion |
Session Fixation in Subrion CMS CVE-2020-12467, GHSA-qpxw-6473-ppww | Medium | 0.9% | 29 Apr, 2020 | Packagist intelliants/subrion |
Potential XSS vulnerability in jQuery BIT-drupal-2020-11023, CVE-2020-11023, GHSA-jpcq-cgw6-v4j6 | MediumExploited | 84.9% | 29 Apr, 2020 | Maven org.webjars.npm:jquery NuGet jQuery Packagist components/jquery RubyGems jquery-rails +1 more |
Croos-site scripting in Croogo CVE-2019-20789, GHSA-jfvf-rfmq-qwf8 | Medium | 0.7% | 26 Apr, 2020 | Packagist croogo/croogo |
Grafana XSS in header column rename BIT-grafana-2020-12245, CVE-2020-12245, GHSA-ccmg-w4xm-p28v, GO-2024-2517 | Medium | 2.0% | 24 Apr, 2020 | Go github.com/grafana/grafana |
Prototype pollution in paypal-adaptive CVE-2020-7643, GHSA-v3r2-3fp4-rp46 | Medium | 1.0% | 23 Apr, 2020 | npm paypal-adaptive |
Cross-site scripting in lazysizes CVE-2020-7642, GHSA-hg2p-2cvq-4ppv, SNYK-JS-LAZYSIZES-567144 | Medium | 0.9% | 22 Apr, 2020 | npm lazysizes |
XSS in python-markdown2 CVE-2020-11888, GHSA-fv3h-8x5j-pvgq, PYSEC-2020-65 | Medium | 1.9% | 20 Apr, 2020 | PyPI markdown2 |
XSS in svg2png (NPM package) CVE-2020-11887, GHSA-mpp5-2x55-49xw | Medium | 0.7% | 17 Apr, 2020 | npm svg2png |
Diavante vue-storefront-api and storefront-api disclose stack trace CVE-2020-11883, GHSA-9wxj-37p8-49ff | Medium | 15.2% | 17 Apr, 2020 | npm storefront-api npm vue-storefront-api |
Stored XSS with custom URLs in PrestaShop module ps_linklist CVE-2020-5273, GHSA-cx2r-mf6x-55rx | Medium | 0.7% | 16 Apr, 2020 | Packagist prestashop/ps_linklist |
Dolibarr stored Cross-site Scripting vulnerability BIT-dolibarr-2020-11823, CVE-2020-11823, GHSA-q938-82fw-wfcf | Medium | 0.7% | 16 Apr, 2020 | Packagist dolibarr/dolibarr |
Machine-In-The-Middle in https-proxy-agent GHSA-pc5p-h8pf-mvwp | Medium | Not scored | 16 Apr, 2020 | npm https-proxy-agent |
Possible XSS attack in Wagtail CVE-2020-11001, GHSA-v2wc-pfq2-5cm6, PYSEC-2020-152 | Medium | 1.3% | 14 Apr, 2020 | PyPI wagtail |
Argo Exposure of Sensitive Information CVE-2018-21034, GHSA-xj7v-c82w-92q2, GO-2023-1952 | Medium | 1.4% | 09 Apr, 2020 | Go github.com/argoproj/argo-cd |
Observable Discrepancy in Argo BIT-argo-cd-2020-11576, CVE-2020-11576, GHSA-vj54-cjrx-x696, GO-2022-0882 | Medium | 2.0% | 08 Apr, 2020 | Go github.com/argoproj/argo-cd |
Open Redirect in xdLocalStorage CVE-2020-11611, GHSA-c6c4-jmqx-3r33 | Medium | 0.9% | 07 Apr, 2020 | npm xdLocalStorage npm xdlocalstorage |
Prototype Pollution in sds CVE-2020-7618, GHSA-cxm3-284p-qc4v | Medium | 1.1% | 07 Apr, 2020 | npm sds |
Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware CVE-2020-7616, GHSA-v39h-qm32-8gwq | Medium | 1.3% | 07 Apr, 2020 | npm express-mock-middleware |
Authentication Bypass in hydra CVE-2020-5300, GHSA-3p3g-vpw6-4w66, GO-2022-0786 | Medium | 1.0% | 06 Apr, 2020 | Go github.com/ory/hydra |
eivindfjeldstad-dot contains prototype pollution vulnerability CVE-2020-7639, GHSA-wfwq-xc57-fq7v, SNYK-JS-EIVIFJDOT-564435 | Medium | 1.1% | 06 Apr, 2020 | npm @eivifj/dot |
confinit vulnerable to prototype pollution CVE-2020-7638, GHSA-jgpq-g82g-6c39, SNYK-JS-CONFINIT-564433 | Medium | 1.0% | 06 Apr, 2020 | npm confinit |
Prototype pollution in class-transformer CVE-2020-7637, GHSA-6gp3-h3jj-prx4, SNYK-JS-CLASSTRANSFORMER-564431 | Medium | 1.2% | 06 Apr, 2020 | npm class-transformer |
Open Redirect in Grav CVE-2020-11529, GHSA-wrxc-mr2w-cjpv | Medium | 10.9% | 04 Apr, 2020 | Packagist getgrav/grav |
MediaWiki makeCollapsible allows applying event handler to any CSS selector BIT-mediawiki-2020-10960, CVE-2020-10960, GHSA-pfm2-mqwj-ggm5 | Medium | 1.2% | 03 Apr, 2020 | Packagist mediawiki/core |
Excessive Platform Resource Consumption within a Loop in Kubernetes CVE-2019-11254, GHSA-wxc4-f4m6-wwqv, GO-2020-0036 | Medium | 3.2% | 01 Apr, 2020 | Go github.com/go-yaml/yaml Go gopkg.in/yaml.v2 |
Deserialization of Untrusted Data in bson CVE-2019-2391, GHSA-4jwp-vfvf-657p | Medium | 0.8% | 31 Mar, 2020 | npm bson |
Directory Traversal in Next.js CVE-2020-5284, GHSA-fq77-7p7r-83rj | Medium | 44.8% | 30 Mar, 2020 | npm next |
Exceptions displayed in non-debug configurations in Symfony BIT-symfony-2020-5274, CVE-2020-5274, GHSA-m884-279h-32v2 | Medium | 1.2% | 30 Mar, 2020 | Packagist symfony/error-handler Packagist symfony/symfony |
Prevent cache poisoning via a Response Content-Type header in Symfony BIT-symfony-2020-5255, CVE-2020-5255, GHSA-mcx4-f5f5-4859 | Medium | 1.3% | 30 Mar, 2020 | Packagist symfony/http-foundation Packagist symfony/symfony |
Kubernetes API Server DoS Via API Requests CVE-2020-8552, GHSA-82hx-w2r5-c2wq | Medium | 2.8% | 27 Mar, 2020 | Go k8s.io/apiserver |
Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes CVE-2020-8551, GHSA-qhm4-jxv7-j9pq, GO-2022-0867 | Medium | 1.2% | 27 Mar, 2020 | Go k8s.io/kubernetes |
python-apt Does Not Check Hash Signature CVE-2019-15796, GHSA-pj65-3pf6-c5q4 | Medium | 0.5% | 26 Mar, 2020 | PyPI python-apt |
python-apt Flawed Package Integrity Check CVE-2019-15795, GHSA-rp8m-h266-53jh | Medium | 0.5% | 26 Mar, 2020 | PyPI python-apt |
Improper Input Validation in Google Closure Library CVE-2020-8910, GHSA-vh5w-fg69-rc8m | Medium | 0.5% | 26 Mar, 2020 | npm google-closure-library |
Vyper interfaces returning integer types less than 256 bits can be manipulated if uint256 is used CVE-2020-37289, GHSA-mr6r-mvw4-736g | Medium | 0.3% | 25 Mar, 2020 | PyPI vyper |
Bleach vulnerable to mutation XSS via whitelisted math or svg and raw tag CVE-2020-6816, GHSA-m6xf-fq7q-8743, PYSEC-2020-28 | Medium | 1.3% | 24 Mar, 2020 | PyPI bleach |
Malicious package may avoid detection in python auditing CVE-2020-5252, GHSA-7q25-qrjw-6fg2, PYSEC-2020-101 | Medium | 0.4% | 23 Mar, 2020 | PyPI safety |
HashiCorp Vault Improper Privilege Management BIT-vault-2020-10660, CVE-2020-10660, GHSA-m979-w9wj-qfj9, GO-2024-2486 | Medium | 0.8% | 23 Mar, 2020 | Go github.com/hashicorp/vault |
phpMyAdmin SQL injection vulnerability BIT-phpmyadmin-2020-10803, CVE-2020-10803, GHSA-fcww-8wvc-38q9 | Medium | 1.4% | 22 Mar, 2020 | Packagist phpmyadmin/phpmyadmin |
SQL Injection in Cloud Native Computing Foundation Harbor CVE-2019-19026, GHSA-rh89-vvrg-fg64, GHSA-w4x5-jqq4-qc8x, GO-2022-0883 | Medium | 1.4% | 20 Mar, 2020 | Go github.com/goharbor/harbor |
MantisBT XSS when uploading an attachment CVE-2019-15539, GHSA-p495-jrpq-p66g | Medium | 1.2% | 19 Mar, 2020 | Packagist mantisbt/mantisbt |
Cross site scripting vulnerability in ActionView CVE-2020-5267, GHSA-65cv-r6x7-79hv | Medium | 1.5% | 19 Mar, 2020 | RubyGems actionview |
Moodle reflected Cross-site Scripting (XSS) CVE-2019-14884, GHSA-3xh5-5v5v-mfgm | Medium | 0.9% | 18 Mar, 2020 | Packagist moodle/moodle |
Moodle Email media URL tokens were not checking for user status CVE-2019-14883, GHSA-774q-wfcp-vc2q | Medium | 1.1% | 18 Mar, 2020 | Packagist moodle/moodle |
Moodle open redirect vulnerability CVE-2019-14882, GHSA-m98q-q59p-r9fv | Medium | 1.1% | 18 Mar, 2020 | Packagist moodle/moodle |
Moodle XSS Vulnerability CVE-2019-14881, GHSA-9jf6-wq34-fg9w | Medium | 1.1% | 18 Mar, 2020 | Packagist moodle/moodle |
Cross-site Scripting in OpenCart CVE-2020-10596, GHSA-36fm-v9wv-56jf | Medium | 2.7% | 17 Mar, 2020 | Packagist opencart/opencart |
yargs-parser Vulnerable to Prototype Pollution CVE-2020-7608, GHSA-p9pc-299p-vxgp, SNYK-JS-YARGSPARSER-560381 | Medium | 0.5% | 16 Mar, 2020 | npm yargs-parser |