Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Drupal core access bypass vulnerability CVE-2017-6922, GHSA-58f3-cx8p-h8jg | Medium | 1.9% | 22 Jan, 2019 | Packagist drupal/core Packagist drupal/drupal |
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability CVE-2018-13374 | MediumExploited | 38.1% | 22 Jan, 2019 | |
Drupal file REST resource does not properly validate CVE-2017-6921, GHSA-h377-287m-w2r9 | Medium | 1.8% | 15 Jan, 2019 | Packagist drupal/core Packagist drupal/drupal |
Shopware XXE Vulnerability CVE-2017-18357, GHSA-6m27-7cqj-2mxw | Medium | 27.1% | 15 Jan, 2019 | Packagist shopware/shopware |
katello Cross-site Scripting vulnerability CVE-2018-16887, GHSA-mhhc-r88h-2qrm | Medium | 1.0% | 13 Jan, 2019 | RubyGems katello |
Bodhi Cross-site Scripting Vulnerability CVE-2017-1002152, GHSA-h896-6hcp-gj6c, PYSEC-2019-150 | Medium | 0.8% | 10 Jan, 2019 | PyPI bodhi |
Sensitive Data Exposure in elFinder CVE-2019-5884, GHSA-jcgc-vxqg-85xx | Medium | 1.3% | 10 Jan, 2019 | Packagist studio-42/elfinder |
Fork CMS XSS Vulnerability CVE-2018-20682, GHSA-xcmj-xjhg-wvhq | Medium | 0.6% | 09 Jan, 2019 | Packagist forkcms/forkcms |
EC-CUBE Open redirect vulnerability CVE-2018-16191, GHSA-fcgg-qgxg-2g2x | Medium | 1.3% | 09 Jan, 2019 | Packagist ec-cube/ec-cube |
bootstrap Cross-site Scripting vulnerability CVE-2018-20677, GHSA-ph58-4vrj-w6hr | Medium | 4.0% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap Packagist twbs/bootstrap RubyGems bootstrap +3 more |
XSS vulnerability that affects bootstrap CVE-2018-20676, GHSA-3mgp-fx93-9xv5 | Medium | 3.8% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap Packagist twbs/bootstrap RubyGems bootstrap +3 more |
Bootstrap Cross-site Scripting vulnerability CVE-2016-10735, GHSA-4p24-vmcr-4gqj | Medium | 4.0% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Dolibarr stored cross-site scripting (XSS) vulnerability CVE-2018-19995, GHSA-3v8x-286h-9pxp | Medium | 1.1% | 03 Jan, 2019 | Packagist dolibarr/dolibarr |
Dolibarr reflected cross-site scripting (XSS) vulnerability CVE-2018-19993, GHSA-2gc5-3h3p-8vpf | Medium | 1.4% | 03 Jan, 2019 | Packagist dolibarr/dolibarr |
Dolibarr stored cross-site scripting (XSS) vulnerability CVE-2018-19992, GHSA-4xfw-599q-fmp6 | Medium | 1.1% | 03 Jan, 2019 | Packagist dolibarr/dolibarr |
Cross-Site Scripting in react-dom CVE-2018-6341, GHSA-mvjj-gqq2-p4hw | Medium | 3.4% | 31 Dec, 2018 | npm react-dom |
PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) CVE-2018-20583, GHSA-qx76-c53f-5c7q | Medium | 1.9% | 30 Dec, 2018 | Packagist league/commonmark |
Evolution CMS Cross-site Scripting (XSS) CVE-2018-16638, GHSA-9mfc-gr8c-xj4m | Medium | 0.6% | 28 Dec, 2018 | Packagist evolutioncms/evolution |
Evolution CMS Stored Cross-site Scripting (XSS) CVE-2018-16637, GHSA-8h24-3cjr-xxmh | Medium | 0.6% | 28 Dec, 2018 | Packagist evolutioncms/evolution |
Kirby XSS Vulnerability CVE-2018-16630, GHSA-3gq5-r59m-mmv2 | Medium | 0.6% | 28 Dec, 2018 | Packagist getkirby/kirby |
Dolibarr ERP and CRM contain XSS Vulnerability CVE-2018-19799, GHSA-ggww-q2gv-m3g4 | Medium | 4.5% | 26 Dec, 2018 | Packagist dolibarr/dolibarr |
Craft CMS Cross-site Scripting (XSS) Vulnerability CVE-2018-20418, GHSA-72pf-cvwq-vgqg | Medium | 3.7% | 24 Dec, 2018 | Packagist craftcms/cms |
Cross Site Scripting (XSS) vulnerability in easymon CVE-2018-1000855, GHSA-c289-47qf-rvrr | Medium | 0.9% | 20 Dec, 2018 | RubyGems easymon |
Fat Free CRM vulnerable to Cross-site Scripting CVE-2018-1000842, GHSA-j5rj-g695-342r | Medium | 1.7% | 20 Dec, 2018 | RubyGems fat_free_crm |
Microweber XSS Vulnerability CVE-2018-1000826, GHSA-xmcr-x5x3-gjfx | Medium | 1.3% | 20 Dec, 2018 | Packagist microweber/microweber |
Grafana XSS Vulnerability CVE-2018-1000816, GHSA-x5fh-fvvr-892f | Medium | 0.7% | 20 Dec, 2018 | Go github.com/grafana/grafana |
Pivotal Concourse Open Redirect in Login Flow CVE-2018-15798, GHSA-9689-rx4v-cqgc | Medium | 1.1% | 19 Dec, 2018 | Go github.com/concourse/concourse |
Symfony Open Redirect CVE-2018-19790, GHSA-89r2-5g34-2g47 | Medium | 1.5% | 18 Dec, 2018 | Packagist symfony/security Packagist symfony/security-http Packagist symfony/symfony |
Symfony Path Disclosure CVE-2018-19789, GHSA-x3cf-w64x-4cp2 | Medium | 3.6% | 18 Dec, 2018 | Packagist symfony/form Packagist symfony/symfony |
CSRF in PHP Server Monitor before 3.3.2 CVE-2018-18921, GHSA-w2g4-g8xr-px4x | Medium | 0.6% | 18 Dec, 2018 | Packagist phpservermon/phpservermon |
Bolt Cross-site Scripting (XSS) via text input click preview button CVE-2018-19933, GHSA-gjx6-58xh-p7pw | Medium | 3.5% | 17 Dec, 2018 | Packagist bolt/bolt |
rendertron XSS vulnerability CVE-2017-18352, GHSA-j88m-953w-8r2c | Medium | 0.6% | 17 Dec, 2018 | npm rendertron |
** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should CVE-2018-20170, PYSEC-2018-9 | Medium | 1.1% | 17 Dec, 2018 | PyPI keystone |
katello SQL Injection vulnerability CVE-2018-14623, GHSA-jx5v-788g-qw58 | Medium | 1.4% | 14 Dec, 2018 | RubyGems katello |
There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. CVE-2018-20096, PYSEC-2018-117 | Medium | 2.7% | 12 Dec, 2018 | PyPI exiv2 |
There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. CVE-2018-20097, PYSEC-2018-118 | Medium | 2.3% | 12 Dec, 2018 | PyPI exiv2 |
There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. CVE-2018-20098, PYSEC-2018-119 | Medium | 2.5% | 12 Dec, 2018 | PyPI exiv2 |
There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack. CVE-2018-20099, PYSEC-2018-120 | Medium | 2.3% | 12 Dec, 2018 | PyPI exiv2 |
phpMyAdmin Cross-site Scripting (XSS) vulnerability CVE-2018-19970, GHSA-8987-93fh-rcwq | Medium | 2.2% | 11 Dec, 2018 | Packagist phpmyadmin/phpmyadmin |
phpMyAdmin Local file inclusion through transformation feature CVE-2018-19968, GHSA-xc97-r49q-cxgc | Medium | 2.9% | 11 Dec, 2018 | Packagist phpmyadmin/phpmyadmin |
HashiCorp Consul can use cleartext agent-to-agent RPC communication CVE-2018-19653, GHSA-4qvx-qq5w-695p, GO-2023-1850 | Medium | 1.2% | 09 Dec, 2018 | Go github.com/hashicorp/consul |
Subrion CMS XSS CVE-2018-16629, GHSA-mxv3-qcmf-r6wj | Medium | 0.6% | 04 Dec, 2018 | Packagist intelliants/subrion |
Path Traversal in simplehttpserver CVE-2018-16478, GHSA-vwr2-wj63-86gr | Medium | 1.3% | 04 Dec, 2018 | npm simplehttpserver |
Improper Neutralization of Input During Web Page Generation in LXML CVE-2018-19787, GHSA-xp26-p53h-6h2p, PYSEC-2018-12 | Medium | 2.4% | 02 Dec, 2018 | PyPI lxml |
XSS in PHP-Proxy-App through v3.0 CVE-2018-19785, GHSA-cghj-w42g-hqmr | Medium | 0.9% | 01 Dec, 2018 | Packagist athlon1600/php-proxy-app |
Exposure of Sensitive Information to an Unauthorized Actor in activestorage CVE-2018-16477, GHSA-7rr7-rcjw-56vj | Medium | 1.3% | 30 Nov, 2018 | RubyGems activestorage |
Ansible Logs Passwords If PowerShell ScriptBlock is Enabled CVE-2018-16859, GHSA-v735-2pp6-h86r, PYSEC-2018-60 | Medium | 0.5% | 29 Nov, 2018 | PyPI ansible |
Showdoc CSRF Vulnerability CVE-2018-19621, GHSA-3p87-gqw8-4pf2 | Medium | 0.4% | 28 Nov, 2018 | Packagist showdoc/showdoc |
Showdoc Unauthenticated Access CVE-2018-19620, GHSA-pfrc-5hhq-6hvr | Medium | 1.3% | 28 Nov, 2018 | Packagist showdoc/showdoc |
Showdoc Forced Browsing CVE-2018-19609, GHSA-6xx7-cphv-pxgr | Medium | 1.2% | 27 Nov, 2018 | Packagist showdoc/showdoc |