Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Out-of-bounds Write in OpenCV CVE-2017-14136, GHSA-634c-v2xv-ffpg, PYSEC-2026-2808, PYSEC-2026-700 | Medium | 1.6% | 04 Sep, 2017 | PyPI opencv-contrib-python PyPI opencv-python |
SimpleSAMLphp allows timing side-channel attacks CVE-2017-12872, GHSA-v882-949x-6v28 | Medium | 1.5% | 01 Sep, 2017 | Packagist simplesamlphp/simplesamlphp |
SimpleSAMLphp Incorrect IV generation for encryption CVE-2017-12871, GHSA-ww3w-592j-5qrw | Medium | 0.5% | 01 Sep, 2017 | Packagist simplesamlphp/simplesamlphp |
SimpleSAMLphp Unauthenticated encryption in CBC mode CVE-2017-12870, GHSA-44pr-mgcp-v36r | Medium | 0.9% | 01 Sep, 2017 | Packagist simplesamlphp/simplesamlphp |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script. CVE-2017-3150, GHSA-wvmq-w7m8-g9xm, PYSEC-2017-106 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality. CVE-2017-3151, GHSA-236h-r3w7-c85c, PYSEC-2017-107 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality. CVE-2017-3152, GHSA-9xwq-72vp-5j3c, PYSEC-2017-108 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality. CVE-2017-3153, GHSA-frqh-x6r7-h6mq, PYSEC-2017-109 | Medium | 2.2% | 29 Aug, 2017 | PyPI apache-atlas |
Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting. CVE-2017-3155, GHSA-q586-7p8w-9pg8, PYSEC-2017-111 | Medium | 2.1% | 29 Aug, 2017 | PyPI apache-atlas |
SimpleSAMLphp Invalid token creation and validation CVE-2017-12867, GHSA-597c-mh7m-48v7 | Medium | 1.3% | 29 Aug, 2017 | Packagist simplesamlphp/simplesamlphp |
zend-diactoros Cross-site Scripting (XSS) CVE-2015-3257, GHSA-rh3c-7wqx-6w95 | Medium | 0.9% | 25 Aug, 2017 | Packagist zendframework/zend-diactoros |
simplejson before 2.6.1 vulnerable to array index error CVE-2014-4616, GHSA-9772-cwx9-r4cj, PSF-2017-1, PYSEC-2026-921 | Medium | 7.8% | 24 Aug, 2017 | PyPI simplejson |
Openstack DBaaS (Trove) Improper Link Resolution Before File Access CVE-2015-3156, GHSA-98c8-36p9-gw66, PYSEC-2026-1053 | Medium | 0.5% | 11 Aug, 2017 | PyPI trove |
No Charset in Content-Type Header in express CVE-2014-6393, GHSA-gpvr-g6gh-9mc2 | Medium | 1.1% | 09 Aug, 2017 | npm express |
Restkit Does Not Validate TLS certificates CVE-2015-2674, GHSA-p9cv-hrxr-fxx8, PYSEC-2017-69 | Medium | 1.4% | 09 Aug, 2017 | PyPI restkit |
OpenStack Compute (Nova) Improper Access Control CVE-2015-2687, GHSA-97fv-22hc-mrgj, PYSEC-2017-145 | Medium | 0.3% | 09 Aug, 2017 | PyPI nova |
Zope Cross-site scripting (XSS) vulnerability in ZMI pages CVE-2009-5145, GHSA-5r4x-qc7q-vj27, PYSEC-2026-763 | Medium | 2.1% | 07 Aug, 2017 | PyPI Zope2 PyPI zope2 |
Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability CVE-2017-6663 | MediumExploited | 2.1% | 07 Aug, 2017 | |
MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php CVE-2017-12062, GHSA-w93w-rx52-24qh | Medium | 3.9% | 01 Aug, 2017 | Packagist mantisbt/mantisbt |
MantisBT XSS allows unsanitized input via admin/install.php CVE-2017-12061, GHSA-98xr-mmq5-vc5h | Medium | 2.9% | 01 Aug, 2017 | Packagist mantisbt/mantisbt |
sosreport sensitive information disclosure via weak permissions of the generated archives CVE-2015-3171, GHSA-gw46-8559-cggp, PYSEC-2017-72 | Medium | 0.3% | 25 Jul, 2017 | PyPI sosreport |
Yii Cross-site Scripting Framework vulnerability CVE-2017-11516, GHSA-4c64-w8fg-xcq2 | Medium | 0.8% | 21 Jul, 2017 | Packagist yiisoft/yii2 Packagist yiisoft/yii2-dev |
Cross-site scripting in PHPMailer CVE-2017-11503, GHSA-58mj-pw57-4vm2 | Medium | 2.4% | 20 Jul, 2017 | Packagist phpmailer/phpmailer |
Bolt stored Cross-site Scripting (XSS) CVE-2017-11128, GHSA-5r9j-698h-2h5m | Medium | 0.6% | 17 Jul, 2017 | Packagist bolt/bolt |
Bolt CMS Stored XSS CVE-2017-11127, GHSA-hqxc-w9vw-3hp5 | Medium | 0.6% | 17 Jul, 2017 | Packagist bolt/bolt |
Moodle Improper Privilege Management CVE-2017-7532, GHSA-jjhx-5jff-rc8m | Medium | 1.0% | 17 Jul, 2017 | Packagist moodle/moodle |
Moodle Information Disclosure CVE-2017-7531, GHSA-w2pj-r8m3-r4jc | Medium | 0.9% | 17 Jul, 2017 | Packagist moodle/moodle |
Moodle User fullname disclosure on user preferences page CVE-2017-2642, GHSA-54r2-r67g-fr9m | Medium | 1.2% | 17 Jul, 2017 | Packagist moodle/moodle |
Open Redirect in oauth2_proxy CVE-2017-1000070, GHSA-jm34-xm8m-w958 | Medium | 1.0% | 17 Jul, 2017 | Go github.com/bitly/oauth2_proxy |
Content Injection via TileJSON Name in mapbox.js CVE-2017-1000043, GHSA-q69p-5h74-w36f | Medium | 0.9% | 17 Jul, 2017 | RubyGems mapbox-rails npm mapbox.js |
Content Injection via TileJSON attribute in mapbox.js CVE-2017-1000042, GHSA-qr28-7j6p-9hmv | Medium | 0.9% | 17 Jul, 2017 | RubyGems mapbox-rails npm mapbox.js |
phpMyAdmin CSS Injection Vulnerability CVE-2017-1000015, GHSA-3fgq-cmr4-97rr | Medium | 1.2% | 17 Jul, 2017 | Packagist phpmyadmin/phpmyadmin |
phpMyAdmin Open Redirect CVE-2017-1000013, GHSA-5h5m-fj48-qpjw | Medium | 1.1% | 17 Jul, 2017 | Packagist phpmyadmin/phpmyadmin |
Cross Site Scripting (XSS) in plotly.js CVE-2017-1000006, GHSA-2fqv-h3r5-m4vf | Medium | 0.9% | 17 Jul, 2017 | npm plotly.js |
Incorrect computation for P-256 curves in crypto/elliptic CVE-2017-8932, GO-2022-0187 | Medium | 2.2% | 06 Jul, 2017 | Go stdlib |
Subrion Cross-site scripting (XSS) vulnerability CVE-2017-10795, GHSA-2xv7-fwh6-x7fc | Medium | 1.1% | 02 Jul, 2017 | Packagist intelliants/subrion |
Logstash Logs Sensitive Information CVE-2016-10362, GHSA-3gg4-6hqg-2vjx | Medium | 1.1% | 16 Jun, 2017 | RubyGems logstash-core |
Mail Gem CRLF Injection vulnerability CVE-2015-9097, GHSA-q86f-fmqf-qrf6 | Medium | 3.4% | 12 Jun, 2017 | RubyGems mail |
Craft CMS XSS Vulnerability CVE-2017-9516, GHSA-6pvw-hh48-jx7p | Medium | 2.8% | 08 Jun, 2017 | Packagist craftcms/cms |
Laravel does not properly constrain the host portion of a password-reset URL CVE-2017-9303, GHSA-rc8x-jrrc-frfv | Medium | 1.0% | 29 May, 2017 | Packagist illuminate/auth Packagist laravel/framework Packagist laravel/laravel |
Contao Core directory traversal vulnerability CVE-2015-0269, GHSA-4r6g-xhx7-fm36 | Medium | 2.1% | 26 May, 2017 | Packagist contao/core |
An issue was discovered in Exiv2 0.26. When the data structure of the structure ifd is incorrect, the program assigns pValue_ to 0x0, and the value of pValue() is 0x0. TiffImageEntry::doWriteImage will use the value of pValue() to cause a segmentation fault. To exploit this vulnerability, someone mu CVE-2017-9239, PYSEC-2017-112 | Medium | 2.6% | 26 May, 2017 | PyPI exiv2 |
ViMbAdmin Cross-site Scripting Vulnerabilities CVE-2017-5870, GHSA-jj4j-cwgq-fx7g | Medium | 1.0% | 23 May, 2017 | Packagist opensolutions/vimbadmin |
OpenEXR invalid read CVE-2017-9112, GHSA-8m57-j273-2qg9, PYSEC-2026-727 | Medium | 1.9% | 21 May, 2017 | PyPI OpenEXR PyPI openexr |
MantisBT vulnerable to CSRF and Open Redirect attacks CVE-2017-7620, GHSA-9x76-mp7r-2xc5 | Medium | 1.4% | 21 May, 2017 | Packagist mantisbt/mantisbt |
cairo is vulnerable to denial of service due to a null pointer dereference CVE-2017-7475, GHSA-5v3f-73gv-x7x5 | Medium | 1.8% | 19 May, 2017 | RubyGems cairo |
MODX Revolution XSS via HTTP Host header CVE-2017-9071, GHSA-p2j4-vrgx-96qg | Medium | 0.6% | 18 May, 2017 | Packagist modx/revolution |
MODX Revolution cross-site scripting vulnerability CVE-2017-9070, GHSA-7hhg-xj2h-5vq9 | Medium | 0.6% | 18 May, 2017 | Packagist modx/revolution |
MODX Revolution Reflected XSS CVE-2017-9068, GHSA-vrw6-7vgj-vj7x | Medium | 0.7% | 18 May, 2017 | Packagist modx/revolution |
admidio CSRF Vulnerability CVE-2017-8382, GHSA-c4v8-2hg8-jv77 | Medium | 2.6% | 16 May, 2017 | Packagist admidio/admidio |