Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
October CMS XSS CVE-2017-1000193, GHSA-3p6c-9xhm-8x7h | Medium | 1.0% | 17 Nov, 2017 | Packagist october/october |
Gemirro Stored XSS in Gemspec "homepage" value CVE-2017-16833, GHSA-x7p2-x2j6-mwhr | Medium | 0.8% | 15 Nov, 2017 | RubyGems gemirro |
OpenStack Nova Filter Scheduler Bypass CVE-2017-16239, GHSA-w2wf-cgwh-vpqg, PYSEC-2026-694 | Medium | 1.4% | 14 Nov, 2017 | PyPI nova |
Kirby XSS Vulnerability CVE-2017-16807, GHSA-275c-v3rc-xghx | Medium | 2.4% | 13 Nov, 2017 | Packagist getkirby/cms |
Geminabox contains Cross-site Scripting CVE-2017-16792, GHSA-653m-r33x-39ff | Medium | 1.1% | 13 Nov, 2017 | RubyGems geminabox |
Withdrawn Advisory: Home Assistant Frontend XSS Vulnerability CVE-2017-16782, GHSA-7wfq-wmx2-3wr4 | Medium | 0.8% | 10 Nov, 2017 | npm home-assistant-frontend |
Bolt Improper Access Control CVE-2017-16754, GHSA-wr23-m9m2-jjf4 | Medium | 1.8% | 10 Nov, 2017 | Packagist bolt/bolt |
LibreNMS Arbitrary File Read CVE-2017-16759, GHSA-4ccx-wjqp-5fww | Medium | 2.2% | 09 Nov, 2017 | Packagist librenms/librenms |
Docker Moby /proc/scsi Path Exposure Allows Host Data Loss (SCSI MICDROP) CVE-2017-16539, GHSA-vfjc-2qcw-j95j | Medium | 1.8% | 04 Nov, 2017 | Go github.com/moby/moby |
tar-split memory exhaustion CVE-2017-14992, GHSA-hqwh-8xv9-42hw, GO-2025-3640 | Medium | 2.5% | 01 Nov, 2017 | Go github.com/vbatts/tar-split |
Cross-Site Scripting in keystone CVE-2017-15881, GHSA-7cv6-gvx3-m54m | Medium | 1.2% | 24 Oct, 2017 | npm keystone |
Cross-Site Scripting in keystone CVE-2017-15878, GHSA-7qcx-jmrc-h2rr | Medium | 3.4% | 24 Oct, 2017 | npm keystone |
Pallets Werkzeug cross-site scripting vulnerability CVE-2016-10516, GHSA-h2fp-xgx6-xh6f, PYSEC-2017-43 | Medium | 2.0% | 23 Oct, 2017 | PyPI Werkzeug PyPI werkzeug |
TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms CVE-2010-3659, GHSA-jr79-65xr-q7cx | Medium | 1.3% | 20 Oct, 2017 | Packagist typo3/cms-backend |
Cross-site Scripting in Mistune CVE-2017-15612, GHSA-hpv5-v8g5-c864, PYSEC-2017-80 | Medium | 0.9% | 19 Oct, 2017 | PyPI mistune |
Shopware XSS Vulnerability CVE-2017-15374, GHSA-mvrx-cmqw-2jgj | Medium | 4.8% | 16 Oct, 2017 | Packagist shopware/shopware |
ccsv Double Free vulnerability CVE-2017-15364, GHSA-5gxp-c379-pj42 | Medium | 1.4% | 15 Oct, 2017 | RubyGems ccsv |
Silverstripe CMS User Enumeration CVE-2017-12849, GHSA-fwhr-g5r4-xgxf | Medium | 1.1% | 12 Oct, 2017 | Packagist silverstripe/cms |
OctoberCMS Cross-Site Scripting CVE-2017-15284, GHSA-gvgf-fp4m-2hw6 | Medium | 4.0% | 12 Oct, 2017 | Packagist october/rain |
TeamPass Cross-Site Scripting (XSS) CVE-2017-15278, GHSA-28pv-2j2h-fmhc | Medium | 0.9% | 12 Oct, 2017 | Packagist nilsteampassnet/teampass |
salt leaks git usernames and passwords to the log CVE-2015-6918, GHSA-q2x6-8gfj-hjxw, PYSEC-2017-70 | Medium | 1.2% | 10 Oct, 2017 | PyPI salt |
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2015-1828, GHSA-6wpv-cj6x-v3jw | Medium | 1.5% | 06 Oct, 2017 | RubyGems http |
Cleartext transmission of credentials in net/smtp CVE-2017-15042, GO-2021-0178 | Medium | 1.3% | 05 Oct, 2017 | Go stdlib |
eGroupware Community Edition Stored XSS vulnerability CVE-2017-14920, GHSA-qfg7-wc25-r3j2 | Medium | 1.1% | 30 Sep, 2017 | Packagist egroupware/egroupware |
Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability CVE-2017-12238 | MediumExploited | 2.0% | 29 Sep, 2017 | |
Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability CVE-2017-12232 | MediumExploited | 2.2% | 29 Sep, 2017 | |
Laravel Sensitive Data Exposure CVE-2017-14775, GHSA-c2v7-j5gq-wcq4 | Medium | 1.2% | 28 Sep, 2017 | Packagist illuminate/auth Packagist laravel/framework |
GeniXCMS Cross-site Scripting (XSS) via the Menu ID field CVE-2017-14765, GHSA-3c7g-p9jx-8cgm | Medium | 0.7% | 27 Sep, 2017 | Packagist genix/cms |
GeniXCMS Cross-site Scripting (XSS) via id parameter CVE-2017-14762, GHSA-jgc6-jr94-h442 | Medium | 0.7% | 27 Sep, 2017 | Packagist genix/cms |
GeniXCMS Cross-site Scripting (XSS) vulnerability via id parameter CVE-2017-14761, GHSA-xf2g-c66g-5f5r | Medium | 0.7% | 27 Sep, 2017 | Packagist genix/cms |
Plone Cross-site Scripting Vulnerability CVE-2015-7316, GHSA-vf8g-m3vq-6p4p, PYSEC-2017-53 | Medium | 1.4% | 25 Sep, 2017 | PyPI Plone PyPI plone |
Gem in a Box vulnerable to Cross-site Scripting CVE-2017-14506, GHSA-98hq-3qvg-pg78 | Medium | 0.7% | 25 Sep, 2017 | RubyGems geminabox |
instack-undercloud vulnerable to symlink attack on tmp files CVE-2017-7549, GHSA-53wm-97p6-582f, PYSEC-2017-152, PYSEC-2026-645 | Medium | 0.4% | 21 Sep, 2017 | PyPI instack PyPI instack-undercloud |
NodeBB Cross-site Scripting Vulnerability in Markdown Processing CVE-2015-3296, GHSA-9g4f-5rpg-4948 | Medium | 1.3% | 21 Sep, 2017 | npm nodebb npm nodebb-plugin-markdown |
Improper Neutralization of Input During Web Page Generation in IPython CVE-2015-4706, GHSA-q326-jhw3-699g, PYSEC-2017-45 | Medium | 2.1% | 21 Sep, 2017 | PyPI ipython |
ember-source vulnerable to Cross-site Scripting CVE-2015-1866, GHSA-mp78-r56v-45qc | Medium | 1.1% | 20 Sep, 2017 | RubyGems ember-source |
Improper Neutralization of Input During Web Page Generation in IPython CVE-2015-4707, GHSA-66gw-5xpf-gfp5, PYSEC-2017-46 | Medium | 2.3% | 20 Sep, 2017 | PyPI ipython |
phpBB Open Redirect CVE-2015-3880, GHSA-hwq7-cvp8-6hm3 | Medium | 2.0% | 19 Sep, 2017 | Packagist phpbb/phpbb |
Kallithea cross-site scripting (XSS) vulnerability CVE-2015-1864, GHSA-fh5c-7gmg-xmp6, PYSEC-2017-17 | Medium | 0.9% | 19 Sep, 2017 | PyPI Kallithea PyPI kallithea |
Moodle sensitive information disclosure CVE-2017-12157, GHSA-gw95-48xq-gqf9 | Medium | 1.1% | 18 Sep, 2017 | Packagist moodle/moodle |
Moodle XSS Vulnerability CVE-2017-12156, GHSA-7mfw-g8x4-rq2w | Medium | 1.2% | 18 Sep, 2017 | Packagist moodle/moodle |
Silverstripe CMS XSS Vulnerability CVE-2017-14498, GHSA-j696-6m57-mcrv | Medium | 1.3% | 15 Sep, 2017 | Packagist silverstripe/cms |
Fastly Magento2 sensitive information disclosure CVE-2017-13761, GHSA-vpq9-c67q-23fq | Medium | 1.2% | 14 Sep, 2017 | Packagist fastly/magento2 |
python-fedora vulnerable to an open redirect resulting in loss of CSRF protection CVE-2017-1002150, GHSA-m242-wc86-8768, PYSEC-2017-27 | Medium | 1.0% | 14 Sep, 2017 | PyPI python-fedora |
Dolibarr ERP and CRM contain XSS Vulnerability CVE-2017-14241, GHSA-h3vg-4x76-v28w | Medium | 0.7% | 11 Sep, 2017 | Packagist dolibarr/dolibarr |
Dolibarr cross-site scripting (XSS) vulnerability CVE-2017-14239, GHSA-74c7-r9m3-hvj4 | Medium | 0.7% | 11 Sep, 2017 | Packagist dolibarr/dolibarr |
GeniXCMS denial of service (account blockage) CVE-2017-14231, GHSA-2m9r-pm7q-wr6f | Medium | 1.4% | 10 Sep, 2017 | Packagist genix/cms |
Centreon Cross-site Scripting Vulnerability CVE-2015-7672, GHSA-8w3f-236q-53m4 | Medium | 1.3% | 07 Sep, 2017 | Packagist centreon/centreon |
Django vulnerable to XSS on 500 pages CVE-2017-12794, GHSA-9r8w-6x8c-6jr9, PYSEC-2017-44 | Medium | 23.6% | 07 Sep, 2017 | PyPI Django PyPI django |
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP) CVE-2015-7225, GHSA-x489-jjwm-52g7 | Medium | 2.1% | 06 Sep, 2017 | RubyGems devise-two-factor |