Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site Scripting in loofah CVE-2018-8048, GHSA-x7rv-cr6v-4vm4 | Medium | 1.9% | 21 Mar, 2018 | RubyGems loofah RubyGems nokogiri |
Grav CMS Cross-site scripting (XSS) vulnerability CVE-2018-5233, GHSA-977g-93f5-rqjx | Medium | 3.7% | 19 Mar, 2018 | Packagist getgrav/grav |
Kubernetes arbitrary file overwrite CVE-2017-1002102, GHSA-mm7g-f2gg-cw8g, GO-2023-1977 | Medium | 1.1% | 13 Mar, 2018 | Go k8s.io/kubernetes |
Doorkeeper is vulnerable to stored XSS and code execution CVE-2018-1000088, GHSA-hwhh-2fwm-cfgw | Medium | 1.4% | 13 Mar, 2018 | RubyGems doorkeeper |
RubyGems Path Traversal vulnerability CVE-2018-1000079, GHSA-8qxg-mff5-j3wc | Medium | 2.8% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Cross-site Scripting vulnerability CVE-2018-1000078, GHSA-87qx-g5wg-mwmj | Medium | 2.7% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Improper Input Validation vulnerability CVE-2018-1000077, GHSA-gv86-43rv-79m2 | Medium | 3.6% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as being a normal user. This attack appear to be exploitable via By knowing how the requisition is made, and sending it as a normal user, the server, in response, CVE-2018-1000080, PYSEC-2018-109 | Medium | 0.8% | 13 Mar, 2018 | PyPI ajenti-panel |
Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the serve CVE-2018-1000083, PYSEC-2018-112 | Medium | 1.5% | 13 Mar, 2018 | PyPI ajenti-panel |
Django denial-of-service possibility in urlize and urlizetrunc template filters CVE-2018-7536, GHSA-r28v-mw67-m5p9, PYSEC-2018-5 | Medium | 4.6% | 09 Mar, 2018 | PyPI Django PyPI django |
Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters CVE-2018-7537, GHSA-2f9x-5v75-3qv4, PYSEC-2018-6 | Medium | 4.4% | 09 Mar, 2018 | PyPI django |
Directory traversal vulnerability in Jubatus 1.0.2 and earlier allows remote attackers to read arbitrary files via unspecified vectors. CVE-2018-0525, PYSEC-2018-115 | Medium | 3.2% | 09 Mar, 2018 | PyPI jubatus |
rack-protection gem timing attack vulnerability when validating CSRF token CVE-2018-1000119, GHSA-688c-3x49-6rqj | Medium | 2.4% | 07 Mar, 2018 | RubyGems rack-protection |
Regular Expression Denial of Service in ssri CVE-2018-7651, GHSA-325j-24f4-qv5x | Medium | 1.7% | 04 Mar, 2018 | npm ssri |
Drupal external link injection vulnerability CVE-2017-6932, GHSA-wm86-w3cf-h6vm | Medium | 1.2% | 01 Mar, 2018 | Packagist drupal/core Packagist drupal/drupal |
Drupal Settings Tray access bypass CVE-2017-6931, GHSA-7ffh-cjvg-fpr4 | Medium | 1.1% | 01 Mar, 2018 | Packagist drupal/core Packagist drupal/drupal |
Drupal cross site scripting vulnerability CVE-2017-6929, GHSA-5vpr-v24w-mmjj | Medium | 1.2% | 01 Mar, 2018 | Packagist drupal/core Packagist drupal/drupal |
Drupal access bypass vulnerability CVE-2017-6928, GHSA-66mv-q8r2-hj8w | Medium | 1.0% | 01 Mar, 2018 | Packagist drupal/core Packagist drupal/drupal |
Drupal cross-site scripting vulnerability CVE-2017-6927, GHSA-585j-5449-mf5m | Medium | 1.6% | 01 Mar, 2018 | Packagist drupal/core Packagist drupal/drupal |
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability CVE-2018-2380 | MediumExploited | 28.9% | 01 Mar, 2018 | |
Ox gem stack overflow in sax_parse CVE-2017-16229, GHSA-wfwm-chj7-w59r | Medium | 1.0% | 26 Feb, 2018 | RubyGems ox |
Tiki Wiki CMS XSS Vulnerability CVE-2018-7302, GHSA-7f2f-crxg-cpfv | Medium | 0.6% | 21 Feb, 2018 | Packagist tikiwiki/tiki-manager |
radiant vulnerable to Cross-site Scripting CVE-2018-7261, GHSA-gp82-xr77-88f4 | Medium | 0.6% | 21 Feb, 2018 | RubyGems radiant |
phpMyAdmin Cross-site scripting (XSS) vulnerability in central columns feature CVE-2018-7260, GHSA-gqmj-f46x-wqhw | Medium | 1.6% | 21 Feb, 2018 | Packagist phpmyadmin/phpmyadmin |
Yab Quarx persistent cross-site scripting vulnerability CVE-2018-7274, GHSA-h4fh-gpvh-753g | Medium | 1.0% | 21 Feb, 2018 | Packagist yab/quarx |
Converse.js Exposure of Sensitive Information CVE-2018-6591, GHSA-mv4h-qm24-x4gh | Medium | 1.1% | 19 Feb, 2018 | Packagist jcbrand/converse.js npm converse.js |
Sinatra Path Traversal vulnerability CVE-2018-7212, GHSA-h29f-7f56-j8wh | Medium | 1.8% | 18 Feb, 2018 | RubyGems sinatra |
October CMS - RainLab Blog Plugin XSS CVE-2018-7198, GHSA-96mh-7xpr-qcgw | Medium | 2.3% | 18 Feb, 2018 | Packagist rainlab/blog-plugin |
ember-source Cross-site Scripting vulnerability CVE-2014-0014, GHSA-rcx6-7jp6-pqf2 | Medium | 1.2% | 15 Feb, 2018 | RubyGems ember-source |
Ember.js Cross-site Scripting vulnerability CVE-2014-0013, GHSA-8xm3-gm7c-5fjx | Medium | 0.7% | 15 Feb, 2018 | RubyGems ember-source |
Insight API transaction broadcast endpoint can result in Full Path Disclosure CVE-2018-1000023, GHSA-8p2p-p8mg-x3cw | Medium | 1.2% | 09 Feb, 2018 | npm insight-api |
Cross site scripting in Croogo CVE-2017-1000510, GHSA-r4h9-gv2m-9x97 | Medium | 0.8% | 09 Feb, 2018 | Packagist croogo/croogo |
Dolibarr ERP and CRM contain XSS Vulnerability CVE-2017-1000509, GHSA-hqfh-p9h7-m6v5 | Medium | 0.9% | 09 Feb, 2018 | Packagist dolibarr/dolibarr |
Canvs Canvas XSS Vulnerability CVE-2017-1000507, GHSA-94hc-7qc9-34rf | Medium | 0.8% | 09 Feb, 2018 | Packagist austintoddj/canvas |
Mautic Cross Site Scripting (XSS) vulnerability CVE-2017-1000506, GHSA-358v-cqjc-2pcq | Medium | 1.1% | 09 Feb, 2018 | Packagist mautic/core |
Tarball permission preservation in puppet CVE-2017-10689, GHSA-vw22-465p-8j5w | Medium | 0.4% | 09 Feb, 2018 | RubyGems puppet |
web2py exposure of sensitive information CVE-2016-3954, GHSA-jr83-vr4j-mp6p, PYSEC-2026-1062 | Medium | 1.4% | 06 Feb, 2018 | PyPI web2py |
dijit editor cross-site scripting vulnerability CVE-2018-6561, GHSA-wp32-wq34-2rqh | Medium | 1.2% | 02 Feb, 2018 | npm dijit |
SimpleSAMLphp XSS Vulnerability CVE-2017-18121, GHSA-fv7m-wc3v-wr3w | Medium | 1.2% | 02 Feb, 2018 | Packagist simplesamlphp/simplesamlphp |
SimpleSAMLphp Open redirection protection bypass CVE-2018-6520, GHSA-2qfc-48v5-4w5h | Medium | 0.9% | 02 Feb, 2018 | Packagist simplesamlphp/simplesamlphp |
Simditor XSS Vulnerability CVE-2018-6464, GHSA-p9wj-wrrm-84m5 | Medium | 0.7% | 31 Jan, 2018 | npm simditor |
SilverStripe CSV Excel Macro Injection CVE-2017-18049, GHSA-2jvj-mhf2-g99w | Medium | 0.9% | 23 Jan, 2018 | Packagist silverstripe/framework |
Moodle XSS Vulnerability CVE-2018-1045, GHSA-595j-wpfg-23w4 | Medium | 1.0% | 22 Jan, 2018 | Packagist moodle/moodle |
Moodle Privilege escalation in quiz web services CVE-2018-1044, GHSA-332g-xh34-5c96 | Medium | 1.1% | 22 Jan, 2018 | Packagist moodle/moodle |
Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames CVE-2018-1043, GHSA-hpwm-84h5-vqr8 | Medium | 1.5% | 22 Jan, 2018 | Packagist moodle/moodle |
Moodle SSRF Vulnerability CVE-2018-1042, GHSA-qqjv-mc2v-p7mc | Medium | 16.2% | 22 Jan, 2018 | Packagist moodle/moodle |
keycloak-httpd-client-install symlink attack vulnerability CVE-2017-15111, GHSA-vqf9-v3hc-wr54, PYSEC-2026-829 | Medium | 0.4% | 20 Jan, 2018 | PyPI keycloak-httpd-client-install |
delayed_job_web Cross-site Scripting vulnerability CVE-2017-12097, GHSA-w7q9-xr2x-wh7x | Medium | 1.0% | 19 Jan, 2018 | RubyGems delayed_job_web |
rails_admin ruby gem XSS CVE-2017-12098, GHSA-pxr8-w3jq-rcwj | Medium | 1.3% | 19 Jan, 2018 | RubyGems rails_admin |
Cross-Site Scripting (XSS) in jquery CVE-2015-9251, GHSA-rmxg-73gg-4p98 | Medium | 29.7% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |