Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Sensitive Data Exposure in parse-server CVE-2019-1020013, GHSA-8w3j-g983-8jh5 | Medium | 1.2% | 11 Jul, 2019 | npm parse-server |
Cross-Site Scripting in @nuxt/devalue CVE-2019-13506, GHSA-6677-83pp-f862 | Medium | 1.3% | 11 Jul, 2019 | npm @nuxt/devalue |
Path Traversal in serve-here.js CVE-2019-5444, GHSA-4448-rc82-fcr7 | Medium | 1.5% | 10 Jul, 2019 | npm serve-here.js |
Wikimedia MediaWik exposed suppressed log in RevisionDelete page CVE-2019-12470, GHSA-733q-m38x-q7cc | Medium | 1.4% | 10 Jul, 2019 | Packagist mediawiki/core |
MediaWiki Incorrect Access Control vulnerability CVE-2019-12469, GHSA-x3fr-w7r5-x7rg | Medium | 1.3% | 10 Jul, 2019 | Packagist mediawiki/core |
MediaWiki Cross-site Scripting (XSS) CVE-2019-12471, GHSA-2rm7-xxx8-35jh | Medium | 1.3% | 10 Jul, 2019 | Packagist mediawiki/core |
MediaWiki Incorrect Access Control vulnerability CVE-2019-12467, GHSA-6vfg-8ppv-h5hg | Medium | 1.3% | 10 Jul, 2019 | Packagist mediawiki/core |
paypal/adaptivepayments-sdk-php vulnerable to a reflected XSS CVE-2017-6217, GHSA-9r4x-3534-w3f9 | Medium | 1.2% | 10 Jul, 2019 | Packagist paypal/adaptivepayments-sdk-php |
field_test gem contains injection vulnerability CVE-2019-13146, GHSA-wg9m-gw3h-hg83 | Medium | 1.4% | 09 Jul, 2019 | RubyGems field_test |
Typo3 Cross-Site Scripting in Link Handling CVE-2019-12748, GHSA-r6fv-56gp-j3r4 | Medium | 0.7% | 09 Jul, 2019 | Packagist typo3/cms Packagist typo3/cms-core |
Denial of Service in mem GHSA-4xcv-9jjx-gfj3 | Medium | Not scored | 05 Jul, 2019 | npm mem |
infusionsoft-php-sdk reflected Cross-site Scripting CVE-2017-6216, GHSA-8jmj-4p32-mc9p | Medium | 1.2% | 03 Jul, 2019 | Packagist novaksolutions/infusionsoft-php-sdk |
Subrion CMS XSS CVE-2018-11317, GHSA-2cmg-vxvh-8h7h | Medium | 0.9% | 03 Jul, 2019 | Packagist intelliants/subrion |
mxGraph vulnerable to cross-site scripting in color field CVE-2019-13127, GHSA-xm59-jvxm-cp3v | Medium | 1.5% | 01 Jul, 2019 | npm mxgraph |
Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS CVE-2019-12781, GHSA-6c7v-2f49-8h26, PYSEC-2019-10 | Medium | 1.7% | 01 Jul, 2019 | PyPI Django PyPI django |
Uninitialized read in Nokogiri gem CVE-2019-13117, GHSA-4hm9-844j-jmxp | Medium | 6.5% | 01 Jul, 2019 | RubyGems nokogiri |
http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by returning a crafted response that lacks a space character. CVE-2019-13114, PYSEC-2019-257 | Medium | 2.0% | 30 Jun, 2019 | |
Grafana Cross-site Scripting vulnerability CVE-2019-13068, GHSA-7phr-6cc9-4m5q | Medium | 51.9% | 30 Jun, 2019 | Go github.com/grafana/grafana |
Cross-Site Scripting via JSONP GHSA-28hp-fgcr-2r4h | Medium | Not scored | 27 Jun, 2019 | npm angular |
Arbitrary Code Injection in mobile-icon-resizer GHSA-mxjr-xmcg-fg7w | Medium | Not scored | 27 Jun, 2019 | npm mobile-icon-resizer |
Use-After-Free in puppeteer CVE-2019-5786, GHSA-c2gp-86p4-5935 | MediumExploited | 61.1% | 27 Jun, 2019 | npm puppeteer |
Moodle Private files uploaded via incoming mail processing could bypass quota restrictions CVE-2019-10134, GHSA-j8wr-7xxj-c2fr | Medium | 1.1% | 26 Jun, 2019 | Packagist moodle/moodle |
Moodle Open Redirect Vulnerability CVE-2019-10133, GHSA-5xp2-rv4h-mm2q | Medium | 0.9% | 26 Jun, 2019 | Packagist moodle/moodle |
Shopware Cross-site Scripting Vulnerability CVE-2019-12935, GHSA-8qxh-hcr9-2379 | Medium | 2.7% | 23 Jun, 2019 | Packagist shopware/shopware |
Out-of-bounds Read in stringstream CVE-2018-21270, GHSA-mf6x-7mm4-x2g7 | Medium | 3.7% | 20 Jun, 2019 | npm stringstream |
Reverse Tabnapping in swagger-ui GHSA-x9p2-fxq6-2m5f | Medium | Not scored | 20 Jun, 2019 | npm swagger-ui |
Regular Expression Denial of Service GHSA-qx4v-6gc5-f2vv | Medium | Not scored | 20 Jun, 2019 | npm esm |
MantisBT cross-site scripting (XSS) vulnerability through crafted PATH_INFO CVE-2018-16514, GHSA-3qv7-98vm-xx2v | Medium | 0.9% | 20 Jun, 2019 | Packagist mantisbt/mantisbt |
Craft CMS XSS Vulnerability CVE-2019-12823, GHSA-w5q4-q7wp-qww6 | Medium | 0.9% | 18 Jun, 2019 | Packagist craftcms/cms |
Regular Expression Denial of Service in underscore.string GHSA-v2p6-4mp7-3r9v | Medium | Not scored | 14 Jun, 2019 | npm underscore.string |
Prototype Pollution in lutils-merge GHSA-f7qw-5pvg-mmwp | Medium | Not scored | 13 Jun, 2019 | npm lutils-merge |
Out-of-bounds Read in npmconf GHSA-57cf-349j-352g | Medium | Not scored | 12 Jun, 2019 | npm npmconf |
SQL Injection in sql GHSA-8f93-rv4p-x4jw | Medium | Not scored | 12 Jun, 2019 | npm sql |
Forced Logout in keycloak-connect CVE-2019-10157, GHSA-68hw-vfh7-xvg8 | Medium | 0.2% | 12 Jun, 2019 | npm keycloak-connect |
Path Traversal in m-server GHSA-vc6r-4x6g-mmqc | Medium | Not scored | 11 Jun, 2019 | npm m-server |
Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability CVE-2019-10226, GHSA-gmg5-r3c4-3fm9 | Medium | 4.7% | 10 Jun, 2019 | RubyGems fat_free_crm |
Rancher Login Parameter Can Be Edited CVE-2019-11881, GHSA-2p4g-jrmx-r34m, GO-2024-2761 | Medium | 2.0% | 10 Jun, 2019 | Go github.com/rancher/rancher |
Twisted CRLF Injection CVE-2019-12387, GHSA-6cc5-2vg4-cc7m, PYSEC-2019-128 | Medium | 2.5% | 10 Jun, 2019 | PyPI twisted |
Regular Expression Denial of Service GHSA-6394-6h9h-cfjg | Medium | Not scored | 07 Jun, 2019 | npm nwmatcher |
Rate Limiting Bypass in express-brute GHSA-984p-xq9m-4rjw | Medium | Not scored | 07 Jun, 2019 | npm express-brute |
Prototype Pollution in upmerge GHSA-gm9g-2g8v-fvxj | Medium | Not scored | 06 Jun, 2019 | npm upmerge |
Insecure Default Configuration in redbird GHSA-8948-ffc6-jg52 | Medium | Not scored | 06 Jun, 2019 | npm redbird |
Path Traversal in servey GHSA-rv49-54qp-fw42 | Medium | Not scored | 06 Jun, 2019 | npm servey |
Cross-site Scripting in Chartkick CVE-2019-12732, GHSA-g45g-g52h-39rg | Medium | 0.8% | 06 Jun, 2019 | RubyGems chartkick |
Command Injection in dot GHSA-4859-gpc7-4j66 | Medium | Not scored | 05 Jun, 2019 | npm dot |
Insecure Default Configuration in tesseract.js GHSA-83rx-c8cr-6j8q | Medium | Not scored | 05 Jun, 2019 | npm tesseract.js |
Denial of Service in js-yaml GHSA-2pr6-76vf-7546 | Medium | Not scored | 05 Jun, 2019 | npm js-yaml |
Denial of Service in canvas GHSA-vpq5-4rc8-c222 | Medium | Not scored | 05 Jun, 2019 | npm canvas |
Denial of Service in url-relative GHSA-86p3-4gfq-38f2 | Medium | Not scored | 05 Jun, 2019 | npm url-relative |
Path Traversal in statics-server GHSA-74cp-qw7f-7hpw | Medium | Not scored | 05 Jun, 2019 | npm statics-server |