Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Subrion Cross-site Scripting (XSS) CVE-2018-16327, GHSA-9738-c49q-4rgc | Medium | 0.6% | 01 Sep, 2018 | Packagist intelliants/subrion |
Pimcore XSS Vulnerability CVE-2018-14059, GHSA-276r-24xq-hwg8 | Medium | 3.1% | 24 Aug, 2018 | Packagist pimcore/pimcore |
phpMyAdmin Cross-site Scripting (XSS) in the import dialog CVE-2018-15605, GHSA-c958-4j9x-q7w4 | Medium | 1.7% | 24 Aug, 2018 | Packagist phpmyadmin/phpmyadmin |
Privilege Escalation in fscrypt CVE-2018-6558, GHSA-qj26-7grj-whg3, GO-2020-0027 | Medium | 0.6% | 23 Aug, 2018 | Go github.com/google/fscrypt |
Cobbler Arbitrary File Read CVE-2016-9605, GHSA-4vc9-4xpq-77vm, PYSEC-2026-623 | Medium | 0.8% | 22 Aug, 2018 | PyPI cobbler |
katello Improper Privilege Management vulnerability CVE-2017-2662, GHSA-cpv6-pfq6-j2v7 | Medium | 0.9% | 22 Aug, 2018 | RubyGems katello |
Paymorrow Improper Input Validation vulnerability CVE-2018-14020, GHSA-489x-ccjw-q7c4 | Medium | 1.1% | 20 Aug, 2018 | Packagist oxid-esales/paymorrow-module |
Cobbler XSS Vulnerability CVE-2018-1000225, GHSA-q9g5-98pm-w6q7, PYSEC-2026-796 | Medium | 1.3% | 20 Aug, 2018 | PyPI cobbler |
OpenCart-Overclocked Cross-site Scripting Vulnerability CVE-2018-1000640, GHSA-cr3q-658v-qv3x | Medium | 0.9% | 20 Aug, 2018 | Packagist villagedefrance/opencart-overclocked |
Pimcore SQLi Vulnerability CVE-2018-14058, GHSA-q4hw-c66h-4xqc | Medium | 28.6% | 17 Aug, 2018 | Packagist pimcore/pimcore |
Withdrawn Advisory: Pulp Improper Path Parsing CVE-2018-10917, GHSA-574p-6fw4-4hw8 | Medium | 1.1% | 15 Aug, 2018 | PyPI pulpcore |
Cloudtoken Insufficiently Protects Credentials CVE-2018-13390, GHSA-4fpg-j5mp-783g, PYSEC-2018-1 | Medium | 0.5% | 10 Aug, 2018 | PyPI cloudtoken |
Improper Authorization in aedes CVE-2018-3778, GHSA-4cmx-hrq9-c23p | Medium | 1.4% | 08 Aug, 2018 | npm aedes |
Open Redirect CVE-2018-15178, GHSA-cpgw-2wxr-pww3, GO-2022-0822 | Medium | 1.3% | 08 Aug, 2018 | Go gogs.io/gogs |
Symfony SSRF Vulnerability via Form Component CVE-2017-16790, GHSA-cqqh-94r6-wjrg | Medium | 1.6% | 06 Aug, 2018 | Packagist symfony/form Packagist symfony/symfony |
Symfony CSRF Vulnerability CVE-2017-16653, GHSA-92x6-h2gr-8gxq | Medium | 1.5% | 06 Aug, 2018 | Packagist symfony/security Packagist symfony/security-csrf Packagist symfony/symfony |
Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint CVE-2017-12614, GHSA-rv25-9wgj-xg75, PYSEC-2018-45 | Medium | 2.0% | 06 Aug, 2018 | PyPI apache-airflow |
MantisBT allows XSS on the Edit Filter page via crafted filter name CVE-2018-14504, GHSA-74gh-5j33-vg4w | Medium | 1.6% | 03 Aug, 2018 | Packagist mantisbt/mantisbt |
MantisBT allows XSS via View Filters page CVE-2018-13055, GHSA-mjp7-97w4-jwhc | Medium | 1.5% | 03 Aug, 2018 | Packagist mantisbt/mantisbt |
Symfony HTTP Foundation web cache poisoning CVE-2018-14773, GHSA-8wgj-6wx8-h5hq | Medium | 57.6% | 03 Aug, 2018 | Packagist symfony/http-foundation Packagist symfony/symfony |
Django open redirect CVE-2018-14574, GHSA-5hg3-6c2f-f3wr, PYSEC-2018-2 | Medium | 25.5% | 03 Aug, 2018 | PyPI Django PyPI django |
paypal/permissions-sdk-php reflected Cross-site Scripting (XSS) CVE-2017-6215, GHSA-2qfv-wwfx-fh34 | Medium | 0.8% | 02 Aug, 2018 | Packagist paypal/permissions-sdk-php |
paypal/invoice-sdk-php reflected XSS CVE-2017-6213, GHSA-626w-hmpw-x74j | Medium | 0.8% | 02 Aug, 2018 | Packagist paypal/invoice-sdk-php |
Subrion CMS Cross-site Scripting CVE-2018-14840, GHSA-vhqr-3gr2-7px9 | Medium | 3.7% | 02 Aug, 2018 | Packagist intelliants/subrion |
Subrion CMS XSS CVE-2018-14835, GHSA-c8mg-wp7h-f2pf | Medium | 0.7% | 02 Aug, 2018 | Packagist intelliants/subrion |
metascraper before v5.2.0 vulnerable to stored cross-site scripting CVE-2018-3773, GHSA-8f64-q7jc-ccgp | Medium | 0.9% | 30 Jul, 2018 | npm metascraper |
OpenStack Neutron Race Condition vulnerability CVE-2017-7543, GHSA-hvxr-2fvv-c3wq, PYSEC-2026-686 | Medium | 1.8% | 26 Jul, 2018 | PyPI neutron |
Improper Input Validation in ansible CVE-2016-8647, GHSA-x4cm-m36h-c6qj, PYSEC-2018-58 | Medium | 1.4% | 26 Jul, 2018 | PyPI ansible |
Arbitrary File Write via Archive Extraction in mholt/archiver CVE-2018-1002207, GHSA-5wmg-j84w-4jj4, GO-2022-0799, SNYK-GOLANG-GITHUBCOMMHOLTARCHIVERCMDARCHIVER-50071 | Medium | 2.5% | 25 Jul, 2018 | Go github.com/mholt/archiver |
Arbitrary File Write in adm-zip CVE-2018-1002204, GHSA-3v6h-hqm4-2rg6 | Medium | 13.5% | 25 Jul, 2018 | npm adm-zip |
Arbitrary File Write via Archive Extraction in unzipper CVE-2018-1002203, GHSA-884w-698f-927f | Medium | 10.6% | 25 Jul, 2018 | npm unzipper |
Macro in MathJax running untrusted Javascript within a web browser CVE-2018-1999024, GHSA-3c48-6pcv-88rm | Medium | 1.4% | 23 Jul, 2018 | npm mathjax |
Gleez Cms Cross-site Scripting in Profile Page CVE-2018-1999021, GHSA-q9g7-pff4-548r | Medium | 0.7% | 23 Jul, 2018 | Packagist gleez/cms |
statics-server Cross-site Scripting vulnerability CVE-2018-3771, GHSA-393x-fr59-r8fg | Medium | 0.9% | 20 Jul, 2018 | npm statics-server |
Remote Code Execution in markdown-pdf CVE-2018-3770, GHSA-p7c9-jqhq-vr3v | Medium | 0.5% | 20 Jul, 2018 | npm markdown-pdf |
Pagekit open redirect vulnerability CVE-2018-14381, GHSA-v47j-rw9h-6m47 | Medium | 1.0% | 18 Jul, 2018 | Packagist pagekit/pagekit |
Bootstrap Cross-site Scripting vulnerability CVE-2018-14042, GHSA-7mvr-5x2g-wfc8 | Medium | 4.0% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Bootstrap Cross-site Scripting vulnerability CVE-2018-14041, GHSA-pj7m-g53m-7638 | Medium | 4.3% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Bootstrap vulnerable to Cross-Site Scripting (XSS) CVE-2018-14040, GHSA-3wqf-4x89-9g79 | Medium | 4.1% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +3 more |
Moderate severity vulnerability that affects mailman CVE-2018-13796, GHSA-xqvg-xm9m-p2c4, PYSEC-2026-661 | Medium | 2.5% | 12 Jul, 2018 | PyPI mailman |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark CVE-2018-1334, GHSA-6mqq-8r44-vmjc, PYSEC-2018-25 | Medium | 0.5% | 12 Jul, 2018 | Maven org.apache.spark:spark-core_2.10 Maven org.apache.spark:spark-core_2.11 PyPI pyspark |
Moodle Exposure of Sensitive Information to an Unauthorized Actor CVE-2018-10890, GHSA-5w4h-xrr5-7273 | Medium | 2.1% | 10 Jul, 2018 | Packagist moodle/moodle |
Moodle sensitive information disclosure CVE-2018-10889, GHSA-wmvq-q9h8-7j4g | Medium | 2.3% | 10 Jul, 2018 | Packagist moodle/moodle |
Angular Redactor XSS Vulnerability CVE-2018-13339, GHSA-88fh-8979-q2rr | Medium | 0.9% | 05 Jul, 2018 | npm angular-redactor |
Singularity Incorrect Access Control CVE-2018-12021, GHSA-4x32-h296-rg6j | Medium | 1.5% | 05 Jul, 2018 | Go github.com/hpcng/singularity |
grape subject to Cross-site Scripting CVE-2018-3769, GHSA-f599-5m7p-hcpf | Medium | 1.4% | 05 Jul, 2018 | RubyGems grape |
Cross-Site Scripting in glance CVE-2018-3748, GHSA-7375-vjr2-3g7w | Medium | 0.9% | 03 Jul, 2018 | npm glance |
Cross-Site Scripting in public CVE-2018-3747, GHSA-8p5p-ff7x-hw7q | Medium | 0.9% | 03 Jul, 2018 | npm public |
xapian-core Cross-site Scripting vulnerability CVE-2018-0499, GHSA-7qw4-w7hf-22q3 | Medium | 1.0% | 02 Jul, 2018 | RubyGems xapian-core |
Json-jwt did not verify the cryptographic signature for data CVE-2018-1000539, GHSA-mj4x-wcxf-hm8x | Medium | 0.8% | 26 Jun, 2018 | RubyGems json-jwt |