Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
lawn-login exposes database password to unauthorized users CVE-2014-5000, GHSA-rhgq-vv9x-j4p5 | High | 0.5% | 10 Jan, 2018 | RubyGems lawn-login |
kajam allows local users to obtain sensitive information by listing the process CVE-2014-4999, GHSA-4ph7-5c44-pppv | High | 0.5% | 10 Jan, 2018 | RubyGems kajam |
lean-ruport allows local users to obtain sensitive information by listing the process CVE-2014-4998, GHSA-5g7f-p7jg-v6mv | High | 0.5% | 10 Jan, 2018 | RubyGems lean-ruport |
point-cli allows local users to obtain sensitive information by listing the process CVE-2014-4997, GHSA-mc8m-x6hf-cw2g | High | 0.5% | 10 Jan, 2018 | RubyGems point-cli |
VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file CVE-2014-4995, GHSA-86cf-g34f-7462 | High | 0.3% | 10 Jan, 2018 | RubyGems VladTheEnterprising |
backup-agoddard and backup_checksum have Information Exposure vulnerability CVE-2014-4993, GHSA-wr5j-q359-6vr2 | High | 0.5% | 10 Jan, 2018 | RubyGems backup-agoddard RubyGems backup_checksum |
Cap-Strap gem for Ruby places credentials on the useradd command line CVE-2014-4992, GHSA-pcm6-g2qp-9gw8 | High | 0.5% | 10 Jan, 2018 | RubyGems cap-strap |
codders-dataset Process Table Local Plaintext Credential Disclosure CVE-2014-4991, GHSA-w9vv-fvw8-j6q3 | High | 0.5% | 10 Jan, 2018 | RubyGems codders-dataset |
Microsoft Office Memory Corruption Vulnerability CVE-2018-0802 | HighExploited | 93.3% | 10 Jan, 2018 | |
Microsoft Office Memory Corruption Vulnerability CVE-2018-0798 | HighExploited | 95.1% | 10 Jan, 2018 | |
Arbitrary file write in NumPy CVE-2014-1858, GHSA-cw6w-4rcx-xphc, PYSEC-2018-33 | High | 0.4% | 08 Jan, 2018 | PyPI numpy |
Numpy arbitrary file write via symlink attack CVE-2014-1859, GHSA-2fc2-6r4j-p65h, PYSEC-2018-34 | High | 0.5% | 08 Jan, 2018 | PyPI numpy |
Cisco node-jose improper validation of JWT signature CVE-2018-0114, GHSA-jfxm-w8g2-4rcv | High | 42.7% | 04 Jan, 2018 | npm node-jose |
XXE Vulnerability in XMLBundle 0.1.7 CVE-2017-1000477, GHSA-qvwf-w35m-6r95 | High | 1.1% | 03 Jan, 2018 | Packagist desperado/xml-bundle |
Plone Unauthorized Access Vulnerability CVE-2017-1000483, GHSA-qc57-h2f7-p4hx, PYSEC-2018-72 | High | 0.9% | 03 Jan, 2018 | PyPI Plone PyPI plone |
Disabled users able to log in with third party SSO plugin CVE-2017-1000489, GHSA-6x98-fx9j-7c78 | High | 1.1% | 03 Jan, 2018 | Packagist mautic/core |
phpMyAdmin CSRF Vulnerability CVE-2017-1000499, GHSA-f9hx-5jq4-fgjm | High | 8.5% | 03 Jan, 2018 | Packagist phpmyadmin/phpmyadmin |
Syncthing vulnerable to symlink traversal and arbitrary file overwrite CVE-2017-1000420, GHSA-28xp-g7f6-7mhf | High | 1.5% | 02 Jan, 2018 | Go github.com/syncthing/syncthing |
phpBB Server-Side Request Forgery (SSRF) CVE-2017-1000419, GHSA-9jm4-rg99-566c | High | 1.3% | 02 Jan, 2018 | Packagist phpbb/phpbb |
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames CVE-2017-1000452, GHSA-8jjf-w7j6-323c | High | 1.4% | 02 Jan, 2018 | npm samlify |
fs-git command injection vulnerability CVE-2017-1000451, GHSA-wp3j-gv53-4pg8 | High | 0.8% | 02 Jan, 2018 | npm fs-git |
Integer Overflow or Wraparound in OpenCV. CVE-2017-1000450, GHSA-m43c-649m-pm48, PYSEC-2026-2825, PYSEC-2026-712 | High | 3.3% | 02 Jan, 2018 | PyPI opencv-contrib-python PyPI opencv-python |
Craft CMS PHP Code Injection Vulnerability CVE-2018-3814, GHSA-r342-vjc4-wrmj | High | 1.9% | 01 Jan, 2018 | Packagist craftcms/cms |
Out-of-bounds Read in OpenCV CVE-2017-18009, GHSA-83rh-hx5x-q9p5, PYSEC-2026-2810, PYSEC-2026-702 | High | 2.5% | 01 Jan, 2018 | PyPI opencv-contrib-python PyPI opencv-python |
The Direct Mail (direct_mail) TYPO3 extension improperly discloses sensitive information CVE-2013-7400, GHSA-4mh5-jj5w-3f9q | High | 1.6% | 29 Dec, 2017 | Packagist directmailteam/direct-mail |
Dolibarr sensitive information disclosure CVE-2017-17898, GHSA-jm38-vmgp-j7rx | High | 2.1% | 27 Dec, 2017 | Packagist dolibarr/dolibarr |
passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token CVE-2017-16897, GHSA-77fw-rf4v-vfp9 | High | 1.4% | 27 Dec, 2017 | npm passport-wsfed-saml2 |
GitHub Git LFS Arbitrary command execution vulnerability CVE-2017-17831, GHSA-w4xh-w33p-4v29, GO-2021-0073 | High | 3.7% | 21 Dec, 2017 | Go github.com/git-lfs/git-lfs |
Information Exposure in Heketi CVE-2017-15104, GHSA-q9vw-wr57-xjv3, GO-2022-0866 | High | 0.4% | 18 Dec, 2017 | Go github.com/heketi/heketi |
Heketi Arbitrary Code Execution CVE-2017-15103, GHSA-6g56-v9qg-jp92, GO-2024-2763 | High | 5.5% | 18 Dec, 2017 | Go github.com/heketi/heketi |
Denial of Service in ecstatic CVE-2016-10703, GHSA-pm9p-9926-w68m | High | 2.6% | 14 Dec, 2017 | npm ecstatic |
Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks CVE-2017-17516, GHSA-336h-q7mh-8vf8, PYSEC-2026-914 | High | 1.2% | 14 Dec, 2017 | PyPI rtv |
Embedthis GoAhead Remote Code Execution Vulnerability CVE-2017-17562 | HighExploited | 97.1% | 12 Dec, 2017 | |
Denial of Service in Packetbeat CVE-2017-11480, GHSA-9q3g-m353-cp4p, GO-2022-0643 | High | 1.4% | 08 Dec, 2017 | Go github.com/elastic/beats |
auth0-js Privilege Escalation Vulnerability CVE-2017-17068, GHSA-3rpr-mg43-xhq4 | High | 1.4% | 06 Dec, 2017 | npm auth0-js |
OpenStack Nova DoS by rebuilding the same instance with a new image multiple times CVE-2017-17051, GHSA-vq76-rxx3-4r4r, PYSEC-2026-692 | High | 2.0% | 05 Dec, 2017 | PyPI nova |
Aubio Divide-By-Zero DoS vulnerability in new_aubio_source_wavread function CVE-2017-17054, GHSA-vcwx-8mqh-2557, PYSEC-2017-75 | High | 0.8% | 29 Nov, 2017 | PyPI aubio |
Arbitrary file read vulnerability in yard server CVE-2017-17042, GHSA-gj4p-3wh3-2rmf | High | 2.9% | 28 Nov, 2017 | RubyGems yard |
TeamPass Improper Privilege Management CVE-2017-15055, GHSA-7ghm-6p42-h226 | High | 1.1% | 27 Nov, 2017 | Packagist nilsteampassnet/teampass |
TeamPass arbitrary file upload vulnerability CVE-2017-15054, GHSA-rm3q-qfrm-frrv | High | 3.5% | 27 Nov, 2017 | Packagist nilsteampassnet/teampass |
Arbitrary JavaScript Execution in typed-function CVE-2017-1001004, GHSA-3qh4-r86r-grvm | High | 1.9% | 27 Nov, 2017 | npm typed-function |
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname CVE-2017-14176, GHSA-jjxg-hpm7-g95f, PYSEC-2017-149 | High | 6.3% | 27 Nov, 2017 | PyPI bzr |
Nokogiri gem, via libxml, is affected by DoS vulnerabilities CVE-2017-16932, GHSA-x2fm-93ww-ggvx | High | 6.5% | 23 Nov, 2017 | RubyGems nokogiri |
jqueryFileTree vulnerable to Directory Traversal CVE-2017-1000170, GHSA-p739-9479-5wr2 | High | 59.1% | 17 Nov, 2017 | npm jqueryfiletree |
Next.js Directory Traversal Vulnerability CVE-2017-16877, GHSA-3f5c-4qxj-vmpf | High | 14.1% | 17 Nov, 2017 | npm next |
CodeIgniter HTTP Header Injection CVE-2017-1000247, GHSA-j9f9-8j39-4g97 | High | 0.9% | 17 Nov, 2017 | Packagist codeigniter4/framework |
ejs vulnerable to DoS due to weak input validation CVE-2017-1000189, GHSA-6x77-rpqf-j6mw | High | 2.3% | 17 Nov, 2017 | npm ejs |
Zeta Components Mail Arbitrary code execution via a crafted email address CVE-2017-15806, GHSA-hgr8-g756-vmg9 | High | 10.7% | 15 Nov, 2017 | Packagist zetacomponents/mail |
Microsoft Office Memory Corruption Vulnerability CVE-2017-11882 | HighExploited | 99.9% | 15 Nov, 2017 | |
private_address_check vulnerable to bypass of Resolv.getaddresses method CVE-2017-0904, GHSA-hxhj-hp9m-qwc4 | High | 2.4% | 13 Nov, 2017 | RubyGems private_address_check |