Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
delayed_job_web Cross-site Scripting vulnerability CVE-2017-12097, GHSA-w7q9-xr2x-wh7x | Medium | 1.0% | 19 Jan, 2018 | RubyGems delayed_job_web |
rails_admin ruby gem XSS CVE-2017-12098, GHSA-pxr8-w3jq-rcwj | Medium | 1.3% | 19 Jan, 2018 | RubyGems rails_admin |
Cross-Site Scripting (XSS) in jquery CVE-2015-9251, GHSA-rmxg-73gg-4p98 | Medium | 29.7% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
Cross-Site Scripting in jquery CVE-2012-6708, GHSA-2pqj-h3vj-pqgw | Medium | 8.6% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
markdown2 is vulnerable to cross-site scripting CVE-2018-5773, GHSA-p6h9-gw49-rqm4, PYSEC-2018-13 | Medium | 0.8% | 18 Jan, 2018 | PyPI markdown2 |
WPGlobus plugin Stored XSS & CSRF security vulnerability CVE-2018-5367, GHSA-qf99-3qrg-g97q | Medium | 0.8% | 12 Jan, 2018 | Packagist wpglobus/wpglobus |
WPGlobus plugin Stored XSS & CSRF security vulnerability CVE-2018-5366, GHSA-35mh-f6p8-pj2c | Medium | 0.7% | 12 Jan, 2018 | Packagist wpglobus/wpglobus |
WPGlobus plugin Stored XSS & CSRF security vulnerability CVE-2018-5365, GHSA-mg4m-v9fc-9hcc | Medium | 0.7% | 12 Jan, 2018 | Packagist wpglobus/wpglobus |
WPGlobus plugin Stored XSS & CSRF security vulnerability CVE-2018-5364, GHSA-v9h6-53fx-gh4j | Medium | 0.8% | 12 Jan, 2018 | Packagist wpglobus/wpglobus |
WPGlobus plugin Stored XSS & CSRF security vulnerability CVE-2018-5363, GHSA-gpq5-vqvx-ch9j | Medium | 0.7% | 12 Jan, 2018 | Packagist wpglobus/wpglobus |
WPGlobus plugin Stored XSS & CSRF security vulnerability CVE-2018-5362, GHSA-599g-r6x7-jm4x | Medium | 0.8% | 12 Jan, 2018 | Packagist wpglobus/wpglobus |
Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink CVE-2014-5003, GHSA-g982-9r8g-6qxw | Medium | 0.4% | 10 Jan, 2018 | RubyGems ciborg |
VladTheEnterprising allows local users to write to arbitrary files via a symlink attack CVE-2014-4996, GHSA-x4vj-279x-qwf2 | Medium | 0.4% | 10 Jan, 2018 | RubyGems VladTheEnterprising |
Gyazo allows local users to write arbitrary files CVE-2014-4994, GHSA-6x45-86q6-rcmr | Medium | 0.5% | 10 Jan, 2018 | RubyGems gyazo |
Magento Cross-Site Request Forgery (CSRF) CVE-2018-5301, GHSA-w3mq-67mw-3p9f | Medium | 0.4% | 08 Jan, 2018 | Packagist magento/community-edition |
Reachable Assertion in OpenCV. CVE-2018-5269, GHSA-89rj-5ggj-3p9p, PYSEC-2026-2812, PYSEC-2026-703 | Medium | 1.4% | 08 Jan, 2018 | PyPI opencv-contrib-python PyPI opencv-python |
Out-of-bounds Write in OpenCV. CVE-2018-5268, GHSA-9g8h-pjm4-q92p, PYSEC-2026-2814, PYSEC-2026-705 | Medium | 1.5% | 08 Jan, 2018 | PyPI opencv-contrib-python PyPI opencv-python |
Radiant CMS vulnerable to Cross-site Scripting CVE-2018-5216, GHSA-mvw8-v767-qhjm | Medium | 0.5% | 04 Jan, 2018 | RubyGems radiant |
Fork CMS XSS Vulnerability CVE-2018-5215, GHSA-8fjq-cpr7-cmfp | Medium | 0.5% | 04 Jan, 2018 | Packagist forkcms/forkcms |
Plone Open Redirect CVE-2017-1000484, GHSA-xvwv-6wvx-px9x, PYSEC-2018-73 | Medium | 0.9% | 03 Jan, 2018 | PyPI Plone PyPI plone |
Products.CMFPlone Open Redirect Vulnerability CVE-2017-1000481, GHSA-8g72-gq68-6gqh, PYSEC-2018-70, PYSEC-2026-2963 | Medium | 0.7% | 03 Jan, 2018 | PyPI Plone PyPI Products.CMFPlone PyPI plone PyPI products-cmfplone |
Products.CMFPlone XSS in profile home_page property CVE-2017-1000482, GHSA-859j-668v-mrr6, PYSEC-2018-71, PYSEC-2026-2962 | Medium | 0.6% | 03 Jan, 2018 | PyPI Plone PyPI Products.CMFPlone PyPI plone PyPI products-cmfplone |
Mautic users able to download any files from server using filemanager CVE-2017-1000490, GHSA-qpgw-2c72-4c89 | Medium | 1.4% | 03 Jan, 2018 | Packagist mautic/core |
Inline JS XSS vulnerability in Mautic CVE-2017-1000488, GHSA-qjhr-c23f-w76q | Medium | 0.8% | 03 Jan, 2018 | Packagist mautic/core |
Stored XSS in LavaLite 5.2.4 CVE-2017-1000467, GHSA-h7vh-6gmm-g7h9 | Medium | 0.7% | 03 Jan, 2018 | Packagist lavalite/cms |
QuickApps CMS Cross-site Scripting CVE-2017-1000495, GHSA-825g-f3g2-6vxf | Medium | 0.6% | 03 Jan, 2018 | Packagist quickapps/cms |
Shiba vulnerable to XSS leading to code execution CVE-2017-1000491, GHSA-jr64-pggr-j8xj | Medium | 1.1% | 03 Jan, 2018 | npm shiba |
Marked vulnerable to XSS from data URIs CVE-2017-1000427, GHSA-7px7-7xjx-hxm8 | Medium | 1.5% | 02 Jan, 2018 | npm marked |
MapProxy vulnerable to cross-site scripting in demo service CVE-2017-1000426, GHSA-g4rw-82hq-8jpr, PYSEC-2026-841 | Medium | 0.8% | 02 Jan, 2018 | PyPI MapProxy PyPI mapproxy |
eZ Publish Cross-site Scripting (XSS) vulnerability CVE-2017-1000431, GHSA-m98q-p5gq-q5ff | Medium | 0.7% | 02 Jan, 2018 | Packagist ezsystems/ezpublish-legacy |
Electron vulnerable to URL spoofing via PDFium CVE-2017-1000424, GHSA-6h98-cf9g-vmg2 | Medium | 1.0% | 02 Jan, 2018 | npm Electron npm electron |
Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar CVE-2017-1000442, GHSA-j2fp-9wp5-mg66 | Medium | 0.5% | 02 Jan, 2018 | Packagist passbolt/passbolt_api |
Dolibarr ERP and CRM contain XSS Vulnerability CVE-2017-17971, GHSA-qjq9-wx5j-jrg6 | Medium | 1.0% | 29 Dec, 2017 | Packagist dolibarr/dolibarr |
Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV CVE-2017-17760, GHSA-jcxv-2j3h-mg59, PYSEC-2026-2823, PYSEC-2026-711 | Medium | 2.3% | 29 Dec, 2017 | PyPI opencv-contrib-python PyPI opencv-python |
mistune Cross-site scripting (XSS) vulnerability CVE-2017-16876, GHSA-98gj-wwxm-cj3h, PYSEC-2017-18 | Medium | 2.2% | 29 Dec, 2017 | PyPI mistune |
Denial of Service in mqtt CVE-2017-10910, GHSA-h9mj-fghc-664w | Medium | 2.3% | 28 Dec, 2017 | npm mqtt |
net-ldap Improper Certificate Validation vulnerability CVE-2017-17718, GHSA-m7p8-9w66-9frm | Medium | 1.3% | 17 Dec, 2017 | RubyGems net-ldap |
Phusion Passenger information disclosure CVE-2017-16355, GHSA-cv3f-px9r-54hm | Medium | 0.4% | 14 Dec, 2017 | RubyGems passenger |
Openstack tripleo-heat-templates unauthenticated file access CVE-2017-12155, GHSA-w8gx-hhcx-px6w, PYSEC-2026-754 | Medium | 0.3% | 12 Dec, 2017 | PyPI tripleo-heat-templates |
Aubio is vulnerable to a NULL pointer dereference CVE-2017-17554, GHSA-45h5-cqqw-9rjw, PYSEC-2017-76 | Medium | 0.8% | 12 Dec, 2017 | PyPI aubio |
The swri_audio_convert function in audioconvert.c in FFmpeg libswresample through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file. CVE-2017-17555, PYSEC-2017-77 | Medium | 1.1% | 12 Dec, 2017 | PyPI aubio |
GeniXCMS XSS Vulnerability CVE-2017-17431, GHSA-pwr7-j6g3-hmx6 | Medium | 0.7% | 05 Dec, 2017 | Packagist genix/cms |
TeamPass Improper Privilege Management CVE-2017-15053, GHSA-xvjf-394g-phrr | Medium | 0.9% | 27 Nov, 2017 | Packagist nilsteampassnet/teampass |
TeamPass Improper Privilege Management CVE-2017-15052, GHSA-5qr3-4839-88gf | Medium | 0.9% | 27 Nov, 2017 | Packagist nilsteampassnet/teampass |
TeamPass stored cross-site scripting (XSS) vulnerability CVE-2017-15051, GHSA-r68m-4v39-cf43 | Medium | 1.0% | 27 Nov, 2017 | Packagist nilsteampassnet/teampass |
Moodle Exposure of Sensitive Information to an Unauthorized Actor CVE-2017-15110, GHSA-rjh8-w8jg-xwq5 | Medium | 1.2% | 20 Nov, 2017 | Packagist moodle/moodle |
Securimage HTML Injection CVE-2017-14077, GHSA-q6v4-xjp2-8ggv | Medium | 0.8% | 18 Nov, 2017 | Packagist dapphp/securimage |
filp whoops Cross-site Scripting vulnerability CVE-2017-16880, GHSA-2jjm-6whx-p8w4 | Medium | 0.8% | 17 Nov, 2017 | Packagist filp/whoops |
Pysaml2 improperly initializes encryption vector CVE-2017-1000246, GHSA-cq94-qf6q-mf2h, PYSEC-2017-26 | Medium | 0.9% | 17 Nov, 2017 | PyPI pysaml2 |
mde ejs vulnerable to XSS CVE-2017-1000188, GHSA-hwcf-pp87-7x6p | Medium | 1.2% | 17 Nov, 2017 | npm ejs |