Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
In RubyGem excon, interrupted Persistent Connections May Leak Response Data CVE-2019-16779, GHSA-q58g-455p-8vw9 | Medium | 1.7% | 16 Dec, 2019 | RubyGems excon |
miekg/dns insecurely generates random numbers CVE-2019-19794, GHSA-44r7-7p62-q3fr, GO-2020-0008 | Medium | 2.1% | 13 Dec, 2019 | Go github.com/miekg/dns |
Sanitizer bypass in svg-sanitizer CVE-2019-10772, GHSA-8rc5-hx3v-2jg7, SNYK-PHP-ENSHRINEDSVGSANITIZE-536969 | Medium | 0.7% | 11 Dec, 2019 | Packagist enshrined/svg-sanitize |
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware CVE-2013-7371, GHSA-6w62-83g6-rfhj | Medium | 1.4% | 11 Dec, 2019 | npm connect |
methodOverride Middleware Reflected Cross-Site Scripting in connect CVE-2013-7370, GHSA-3fw8-66wf-pr7m | Medium | 1.4% | 11 Dec, 2019 | npm connect |
Possible to circumvent title-blacklist CVE-2019-19709, GHSA-pjv5-vv93-p648 | Medium | 1.6% | 11 Dec, 2019 | Packagist mediawiki/core |
pyrad uses sequential packet IDs CVE-2013-0342, GHSA-w4px-9pgm-p2f3, PYSEC-2019-154 | Medium | 1.5% | 09 Dec, 2019 | PyPI pyrad |
Cross-Site Scripting in serialize-to-js CVE-2019-16772, GHSA-3fjq-93xj-3f3f | Medium | 0.6% | 06 Dec, 2019 | npm serialize-to-js |
Out-of-bounds Read in OpenCV CVE-2019-19624, GHSA-jggw-2q6g-c3m6, PYSEC-2026-2800, PYSEC-2026-2824, PYSEC-2026-2839, PYSEC-2026-723 | Medium | 1.8% | 06 Dec, 2019 | PyPI opencv-contrib-python PyPI opencv-contrib-python-headless PyPI opencv-python PyPI opencv-python-headless |
Cross-site Scripting in Documize CVE-2019-19619, GHSA-wmwp-pggc-h4mj, GO-2021-0086 | Medium | 1.2% | 06 Dec, 2019 | Go github.com/documize/community |
Internal exception message exposure for login action in Sylius CVE-2019-16768, GHSA-3r8j-pmch-5j2h | Medium | 0.7% | 05 Dec, 2019 | Packagist sylius/sylius |
Cross-Site Scripting in serialize-javascript CVE-2019-16769, GHSA-h9rv-jmmf-4pgx | Medium | 0.8% | 05 Dec, 2019 | npm serialize-javascript |
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access CVE-2019-11255, GHSA-f4w6-3rh6-6q4q | Medium | 2.0% | 05 Dec, 2019 | Go github.com/kubernetes-csi/external-provisioner Go github.com/kubernetes-csi/external-resizer Go github.com/kubernetes-csi/external-snapshotter/v6 |
GitBook allows Cross-site Scripting via a local .md file. CVE-2019-19596, GHSA-hwgp-c653-6684 | Medium | 0.7% | 05 Dec, 2019 | npm gitbook |
Validation bypass is possible in Json Pattern Validator CVE-2019-19507, GHSA-rh46-3fgc-mvrf | Medium | 1.0% | 02 Dec, 2019 | npm jpv |
FreeIPA logs passwords embedded in commands in calls using batch CVE-2019-10195, GHSA-w4q7-f34x-vpgc, PYSEC-2019-168, PYSEC-2019-22 | Medium | 1.8% | 27 Nov, 2019 | PyPI freeipa PyPI ipa |
Dolibarr ERP and CRM contain XSS Vulnerability CVE-2019-19206, GHSA-f6h3-66xr-hqr2 | Medium | 0.9% | 26 Nov, 2019 | Packagist dolibarr/dolibarr |
OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor CVE-2011-4076, GHSA-vcmv-6rxx-fh7r, PYSEC-2026-691 | Medium | 1.5% | 26 Nov, 2019 | PyPI nova |
Cross-Site Scripting in iobroker.web CVE-2019-10771, GHSA-6rjc-4pwr-3vp7 | Medium | 0.7% | 25 Nov, 2019 | npm iobroker.web |
Google Chromium V8 Out-of-Bounds Write Vulnerability CVE-2019-5825 | MediumExploited | 55.9% | 25 Nov, 2019 | |
Zope XSS Vulnerability CVE-2011-4924, GHSA-vh6g-786f-hxxp, PYSEC-2026-3440, PYSEC-2026-766 | Medium | 1.4% | 25 Nov, 2019 | PyPI zope PyPI zope2 |
containers/image library Insufficiently Protects Credentials CVE-2019-10214, GHSA-85p9-j7c9-v4gr, GO-2021-0081 | Medium | 1.6% | 25 Nov, 2019 | Go github.com/containers/image |
Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript CVE-2019-16763, GHSA-m52x-29pq-w3vv | Medium | 0.7% | 22 Nov, 2019 | npm pannellum |
Designate does not enforce the DNS protocol limit concerning record set sizes CVE-2015-5694, GHSA-c33m-22cr-j9x4, PYSEC-2019-243 | Medium | 1.8% | 22 Nov, 2019 | PyPI designate |
User enumeration leak using switch user functionality in Symfony CVE-2019-18886, GHSA-4vpc-5jx4-cfqg | Medium | 1.6% | 21 Nov, 2019 | Packagist symfony/security-http Packagist symfony/symfony |
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability CVE-2019-6693 | MediumExploited | 6.6% | 21 Nov, 2019 | |
openshift-origin-node Improper Input Validation vulnerability CVE-2014-0084, GHSA-756m-3qf2-hp58 | Medium | 0.3% | 21 Nov, 2019 | RubyGems openshift-origin-node |
Link Following in rply CVE-2014-1938, GHSA-m8qc-mf6p-pfq9, PYSEC-2019-202 | Medium | 0.4% | 21 Nov, 2019 | PyPI rply |
net-ldap has weak salt when generating passwords CVE-2014-0083, GHSA-qwgm-mxm4-3q2c | Medium | 0.3% | 21 Nov, 2019 | RubyGems net-ldap |
cookie-signature Timing Attack CVE-2016-1000236, GHSA-92vm-wfm5-mxvv | Medium | 0.9% | 19 Nov, 2019 | npm cookie-signature |
Data leakage via SQL Injection in Pimcore CVE-2019-10763, GHSA-fpff-384j-vxq7, SNYK-PHP-PIMCOREPIMCORE-480391 | Medium | 0.9% | 18 Nov, 2019 | Packagist pimcore/pimcore |
Pimcore Cross-site Scripting (XSS) vulnerability CVE-2019-18982, GHSA-m4x3-xmjv-r778 | Medium | 1.1% | 15 Nov, 2019 | Packagist pimcore/pimcore |
The rack-cors rubygem may allow directory traveral CVE-2019-18978, GHSA-pf8f-w267-mq2h | Medium | 2.5% | 14 Nov, 2019 | RubyGems rack-cors |
Moodle included private user files in course backups CVE-2012-1159, GHSA-p9hr-f4xj-8w8r | Medium | 1.4% | 14 Nov, 2019 | Packagist moodle/moodle |
Moodle default permissions too permissive CVE-2012-1157, GHSA-2x36-7xfm-pgm7 | Medium | 1.2% | 14 Nov, 2019 | Packagist moodle/moodle |
Pomelo allows external control of critical state data CVE-2019-18954, GHSA-4x6v-rwh4-55jw | Medium | 1.2% | 14 Nov, 2019 | npm pomelo |
Elgg Reflected XSS Vulnerability CVE-2011-2935, GHSA-mcfm-j5g6-w26f | Medium | 1.1% | 12 Nov, 2019 | Packagist elgg/elgg |
Typo3 Improper Access Control CVE-2011-4904, GHSA-qf79-34j4-54m6 | Medium | 1.1% | 06 Nov, 2019 | Packagist typo3/cms |
Typo3 XSS in RemoveXSS function CVE-2011-4903, GHSA-q22w-r5qq-v3wf | Medium | 0.8% | 06 Nov, 2019 | Packagist typo3/cms |
Typo3 Arbitrary File Delete CVE-2011-4902, GHSA-9vxq-mxw5-mcgp | Medium | 1.0% | 06 Nov, 2019 | Packagist typo3/cms |
Typo3 Arbitrary Information Disclosure CVE-2011-4901, GHSA-8grp-3j5v-543g | Medium | 1.1% | 06 Nov, 2019 | Packagist typo3/cms |
Typo3 Information Disclosure CVE-2011-4900, GHSA-rwx5-7x5r-jgrm | Medium | 1.0% | 06 Nov, 2019 | Packagist typo3/cms |
Typo3 XSS Vulnerabilities CVE-2011-4632, GHSA-h86g-796f-hhfq | Medium | 0.7% | 06 Nov, 2019 | Packagist typo3/cms |
Typo3 XSS Vulnerability CVE-2011-4630, GHSA-29wr-24h5-95r5 | Medium | 0.7% | 06 Nov, 2019 | Packagist typo3/cms |
Typo3 Information Disclosure CVE-2011-4627, GHSA-frf4-5p2c-c3ff | Medium | 1.0% | 06 Nov, 2019 | Packagist typo3/cms |
Magento Cross-Site Scripting via admin panel CVE-2019-8157, GHSA-vrw4-34p5-pjg5 | Medium | 0.6% | 06 Nov, 2019 | Packagist magento/community-edition |
Magento Cross-Site Scripting via Attribute Set Name CVE-2019-8145, GHSA-xv69-f7x5-r4qw | Medium | 0.6% | 06 Nov, 2019 | Packagist magento/community-edition |
Magento 2 Community Edition XSS Vulnerability CVE-2019-8132, GHSA-g378-6fg4-gx3v | Medium | 0.6% | 06 Nov, 2019 | Packagist magento/community-edition |
Composer JavaScript injection possible via html comments CVE-2019-8233, GHSA-fm68-89m8-4gjj | Medium | 0.7% | 06 Nov, 2019 | Packagist magento/community-edition |
Magento 2 Community Edition RCE Vulnerability CVE-2019-8232, GHSA-6vc8-3xf2-qrxx | Medium | 0.9% | 06 Nov, 2019 | Packagist magento/community-edition |