Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
DCE extension for Typo3 Discloses Environment Information CVE-2014-8328, GHSA-v4vm-gj2x-6qhm | Medium | 1.6% | 03 Feb, 2020 | Packagist t3/dce |
auth0-lock vulnerable to XSS via unsanitized placeholder property CVE-2019-20174, GHSA-w2pf-g6r8-pg22 | Medium | 0.7% | 31 Jan, 2020 | npm auth0-lock |
Incorrect Authorization in HashiCorp Consul BIT-consul-2020-7955, CVE-2020-7955, GHSA-r9w6-rhh9-7v53, GO-2022-0874 | Medium | 1.4% | 31 Jan, 2020 | Go github.com/hashicorp/consul |
Multiple cross-site scripting (XSS) vulnerabilities in Roundup CVE-2012-6133, GHSA-5jq3-8437-x35p, PYSEC-2020-212 | Medium | 1.6% | 30 Jan, 2020 | PyPI roundup |
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect BIT-oauth2-proxy-2020-5233, CVE-2020-5233, GHSA-qqxw-m5fj-f7gv | Medium | 1.3% | 30 Jan, 2020 | Go github.com/oauth2-proxy/oauth2-proxy |
Magento stored cross-site scripting vulnerability BIT-magento-2020-3758, CVE-2020-3758, GHSA-p5q3-xg47-653m | Medium | 1.8% | 29 Jan, 2020 | Packagist magento/community-edition Packagist magneto/core |
Magento Path Traversal BIT-magento-2020-3717, CVE-2020-3717, GHSA-874g-pxqp-frqp | Medium | 3.2% | 29 Jan, 2020 | Packagist magento/community-edition |
Magento stored cross-site scripting vulnerability BIT-magento-2020-3715, CVE-2020-3715, GHSA-mgg3-v948-2vgr | Medium | 1.8% | 29 Jan, 2020 | Packagist magento/community-edition Packagist magento/core |
Cross-Site Scripting in node-red CVE-2019-15607, GHSA-8w65-xjc5-9w79 | Medium | 0.6% | 28 Jan, 2020 | npm node-red |
Information disclosure in Apache Superset BIT-superset-2020-1932, CVE-2020-1932, GHSA-fxjm-wvj9-9c39, PYSEC-2020-224 | Medium | 1.4% | 28 Jan, 2020 | PyPI apache-superset |
Typo3 Cross-Site Scripting in Flash component (ELTS) BIT-typo3-2020-8091, CVE-2020-8091, GHSA-qvhv-pwww-53jj | Medium | 5.2% | 27 Jan, 2020 | Packagist typo3/cms |
Ability to expose data in Sylius by using an unintended serialisation group CVE-2020-5218, CVE-2020-5220, GHSA-8vp7-j5cj-vvm2, GHSA-prg5-hg25-8grq | Medium | 0.7% | 27 Jan, 2020 | Packagist sylius/resource-bundle Packagist sylius/sylius |
Zenario CMS vulnerable to CRLF injection CVE-2015-3154, GHSA-5957-5crx-79jx | Medium | 1.0% | 27 Jan, 2020 | Packagist zendframework/zend-http Packagist zendframework/zendframework Packagist zendframework/zendframework1 |
XSS in Dolibarr ERP & CRM BIT-dolibarr-2020-7996, CVE-2020-7996, GHSA-v384-jqmq-fc74 | Medium | 1.2% | 26 Jan, 2020 | Packagist dolibarr/dolibarr |
Dolibarr cross-site scripting (XSS) vulnerability BIT-dolibarr-2020-7994, CVE-2020-7994, GHSA-4hf3-229w-6h8r | Medium | 1.5% | 26 Jan, 2020 | Packagist dolibarr/dolibarr |
Cross-site scripting in SimpleSAMLphp CVE-2020-5226, GHSA-mj9p-v2r8-wf8w | Medium | 0.5% | 24 Jan, 2020 | Packagist simplesamlphp/simplesamlphp |
Log injection in SimpleSAMLphp CVE-2020-5225, GHSA-6gc6-m364-85ww | Medium | 0.7% | 24 Jan, 2020 | Packagist simplesamlphp/simplesamlphp |
Missing Authentication for Critical Function in Saleor CVE-2020-7964, GHSA-rgcm-rpq9-9cgr, PYSEC-2026-747 | Medium | 1.1% | 24 Jan, 2020 | PyPI saleor |
Plone Open Redirect Vulnerability CVE-2020-7936, GHSA-82j9-wfcf-9v2h, PYSEC-2020-85 | Medium | 0.9% | 23 Jan, 2020 | PyPI Plone PyPI plone |
Plone cross site scripting (XSS) CVE-2020-7937, GHSA-8mc4-2xrc-g582, PYSEC-2020-86 | Medium | 0.8% | 23 Jan, 2020 | PyPI Plone PyPI plone |
Cross-Site Scripting in sanitize-html CVE-2016-1000237, GHSA-3j7m-hmh3-9jmp | Medium | 0.8% | 23 Jan, 2020 | npm sanitize-html |
Directive injection when using dynamic overrides with user input CVE-2020-5217, GHSA-xq52-rv6w-397c | Medium | 1.8% | 23 Jan, 2020 | RubyGems secure_headers |
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers CVE-2020-5216, GHSA-w978-rmpf-qmwg | Medium | 1.2% | 23 Jan, 2020 | RubyGems secure_headers |
Cross-site scripting in markdown2 for python CVE-2009-3724, GHSA-72cx-5ff9-4hhc, PYSEC-2020-235, SNYK-PYTHON-PYRAD-40000 | Medium | 0.8% | 15 Jan, 2020 | PyPI markdown2 |
phpBB allows CSRF BIT-phpbb-2020-5502, CVE-2020-5502, GHSA-69q7-hww4-8pjq | Medium | 0.4% | 15 Jan, 2020 | Packagist phpbb/phpbb |
phpBB Cross-Site Request Forgery (CSRF) BIT-phpbb-2020-5501, CVE-2020-5501, GHSA-cpqc-g4r8-6hxg | Medium | 0.4% | 15 Jan, 2020 | Packagist phpbb/phpbb |
Drupal Cross-Site Scripting vulnerability CVE-2011-2714, GHSA-qp8q-gwf5-hqh2 | Medium | 1.2% | 14 Jan, 2020 | Packagist drupal/core |
Kubernetes ingress exposes sensitive information CVE-2018-1002104, GHSA-p3x5-5xpx-9phm | Medium | 1.1% | 14 Jan, 2020 | Go k8s.io/ingress-nginx |
Persistent XSS vulnerability in filename of attached file in PrivateBin CVE-2020-5223, GHSA-8j72-p2wm-6738 | Medium | 0.7% | 14 Jan, 2020 | Packagist privatebin/privatebin |
Client Denial of Service on TUF CVE-2020-6173, GHSA-2828-9vh6-9m6j, PYSEC-2020-146 | Medium | 1.8% | 14 Jan, 2020 | PyPI tuf |
XSS in Apache Airflow CVE-2019-12398, GHSA-rjvg-q57v-mjjc, PYSEC-2020-162 | Medium | 2.8% | 14 Jan, 2020 | PyPI apache-airflow |
DOMPDF denial of service vulnerability CVE-2014-5012, GHSA-q83c-64c9-c42m | Medium | 1.2% | 10 Jan, 2020 | Packagist dompdf/dompdf |
DOMPDF Information Disclosure CVE-2014-5011, GHSA-jwf8-mjj8-r8hq | Medium | 1.5% | 10 Jan, 2020 | Packagist dompdf/dompdf |
Moodle does not revoke role capabilities correctly CVE-2019-14879, GHSA-g9m2-c2x5-fr2v | Medium | 0.7% | 07 Jan, 2020 | Packagist moodle/moodle |
Multiple Content Injection Vulnerabilities in marked CVE-2014-3743, GHSA-9cw2-jqp5-7x39 | Medium | 1.7% | 06 Jan, 2020 | npm marked |
Plone Zope cross-site scripting (XSS) vulnerability CVE-2013-7062, GHSA-4793-w44w-m7xm, PYSEC-2020-218 | Medium | 1.4% | 02 Jan, 2020 | PyPI plone |
Symfony Host Header Injection vulnerability in the HttpFoundation component CVE-2013-4752, GHSA-22pv-7v9j-hqxp | Medium | 2.3% | 02 Jan, 2020 | Packagist symfony/http-foundation Packagist symfony/symfony |
AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes CVE-2019-14863, GHSA-r5fx-8r73-v86c | Medium | 1.2% | 02 Jan, 2020 | npm angular |
XSS in knockout CVE-2019-14862, GHSA-vcjj-xf2r-mwvc | Medium | 2.1% | 02 Jan, 2020 | npm knockout |
Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible CVE-2019-14864, GHSA-3m93-m4q6-mc6v, PYSEC-2020-160 | Medium | 1.9% | 02 Jan, 2020 | PyPI ansible |
Bolt Cross-site Scripting via the slug, teaser or title parameters CVE-2019-9553, GHSA-2g23-qmmp-fvmr | Medium | 1.8% | 31 Dec, 2019 | Packagist bolt/bolt |
XSS injection in the Grid component of Sylius CVE-2019-12186, GHSA-rc5r-697f-28x6 | Medium | 0.6% | 31 Dec, 2019 | Packagist sylius/grid Packagist sylius/grid-bundle Packagist sylius/sylius |
In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page. CVE-2019-20008, PYSEC-2019-112 | Medium | 0.9% | 26 Dec, 2019 | PyPI pyarchery |
Features file injection vulnerability CVE-2013-4318, GHSA-42gq-h7xj-33r4 | Medium | 0.8% | 26 Dec, 2019 | RubyGems features |
Improper Neutralization of Input During Web Page Generation in swagger-ui CVE-2016-1000229, GHSA-h8wp-wgcq-qhrf | Medium | 4.0% | 20 Dec, 2019 | npm swagger-ui |
Possible Information Leak / Session Hijack Vulnerability in Rack CVE-2019-16782, GHSA-hrqr-hxpp-chr3 | Medium | 3.7% | 18 Dec, 2019 | RubyGems rack |
Insert tag injection in the Contao login module CVE-2019-19714, GHSA-jc43-qrrp-98f5 | Medium | 0.8% | 17 Dec, 2019 | Packagist contao/contao Packagist contao/core-bundle |
Information disclosure in the Contao backend CVE-2019-19712, GHSA-4mvc-qc5w-v5qr | Medium | 0.9% | 17 Dec, 2019 | Packagist contao/contao Packagist contao/core-bundle |
Users able to query database metadata in Apache Superset CVE-2019-12413, GHSA-p5w7-qmq6-pmjr, PYSEC-2019-172 | Medium | 2.8% | 16 Dec, 2019 | PyPI apache-superset |
Users can view database names in Apache Superset CVE-2019-12414, GHSA-9c29-9h4m-wg5p, PYSEC-2019-173 | Medium | 2.8% | 16 Dec, 2019 | PyPI apache-superset |