⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Dismissed suggestions

These automatic suggestions were dimissed after initial triaging.

Restore to select a suggestion for a revision.

CVE-2014-125026
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 4 days ago
  • @LeSuisse dismissed 1 week, 6 days ago
Out-of-bounds write in github.com/cloudflare/golz4

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.

github.com/cloudflare/golz4
<0.0.0-20140711154735-199f5f787806
CVE-2013-10005
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 5 days ago
  • @LeSuisse dismissed 1 week, 6 days ago
Infinite loop in github.com/btcsuite/go-socks

The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.

github.com/btcsuite/go-socks
<0.0.0-20130808000456-233bccbb1abe
github.com/btcsuitereleases/go-socks
<0.0.0-20130808000456-233bccbb1abe
CVE-2024-52337
5.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): HIGH
  • Availability impact (A): NONE
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 3 days ago
  • @LeSuisse dismissed 1 week, 6 days ago
CVE Program Container

None

tuned
*
Notify package maintainers: 2
CVE-2024-49506
0.0 NONE
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 3 days ago
  • @LeSuisse dismissed 1 week, 6 days ago
Fixed temporary file path in aeon-checks allows fixing of disk encryption key

Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem

tik
<1.2.4
aeon-check
<1.0.2

pkgs.tika

A toolkit for extracting metadata and text from over a thousand different file types

pkgs.batik

Java based toolkit for handling SVG

pkgs.qtikz

Editor for the TikZ language

pkgs.statik

Embed files into a Go executable

pkgs.tikzit

Graphical tool for rapidly creating graphs and diagrams using PGF/TikZ

pkgs.tootik

Federated nanoblogging service with a Gemini frontend

pkgs.semantik

Mind-mapping application for KDE

pkgs.svg2tikz

Set of tools for converting SVG graphics to TikZ/PGF code

pkgs.authentik

Authentication glue you need

pkgs.liberastika

Liberation Sans fork with improved cyrillic support

pkgs.python311Packages.tika

Python binding to the Apache Tika™ REST services

pkgs.python312Packages.tika

Python binding to the Apache Tika™ REST services

pkgs.authentik-outposts.ldap

The authentik ldap outpost. Needed for the external ldap API.

pkgs.authentik-outposts.radius

Authentik radius outpost which is used for the external radius API

pkgs.luaPackages.tiktoken_core

An experimental port of OpenAI's Tokenizer to lua

pkgs.python311Packages.svg2tikz

Set of tools for converting SVG graphics to TikZ/PGF code

pkgs.python311Packages.tiktoken

tiktoken is a fast BPE tokeniser for use with OpenAI's models

pkgs.python312Packages.svg2tikz

Set of tools for converting SVG graphics to TikZ/PGF code

pkgs.python312Packages.tiktoken

tiktoken is a fast BPE tokeniser for use with OpenAI's models

pkgs.lua51Packages.tiktoken_core

An experimental port of OpenAI's Tokenizer to lua

pkgs.lua53Packages.tiktoken_core

An experimental port of OpenAI's Tokenizer to lua

pkgs.lua54Packages.tiktoken_core

An experimental port of OpenAI's Tokenizer to lua

pkgs.luajitPackages.tiktoken_core

An experimental port of OpenAI's Tokenizer to lua

pkgs.prometheus-mikrotik-exporter

Prometheus MikroTik device(s) exporter

pkgs.python311Packages.tika-client

Modern Python REST client for Apache Tika server

pkgs.python311Packages.tikzplotlib

Save matplotlib figures as TikZ/PGFplots for smooth integration into LaTeX

pkgs.python312Packages.tika-client

Modern Python REST client for Apache Tika server

pkgs.python312Packages.tikzplotlib

Save matplotlib figures as TikZ/PGFplots for smooth integration into LaTeX

pkgs.python311Packages.pytikz-allefeld

Python interface to TikZ

pkgs.python312Packages.pytikz-allefeld

Python interface to TikZ

pkgs.python311Packages.sphinxcontrib-tikz

TikZ extension for Sphinx

pkgs.python312Packages.sphinxcontrib-tikz

TikZ extension for Sphinx

pkgs.home-assistant-component-tests.mikrotik

Open source home automation that puts local control and privacy first
Notify package maintainers: 24
CVE-2024-52336
7.8 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 3 days ago
  • @LeSuisse dismissed 1 week, 6 days ago
Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.

tuned
*
Notify package maintainers: 2
CVE-2024-8553
6.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 3 days ago
  • @LeSuisse dismissed 1 week, 6 days ago
Foreman: read-only access to entire db from templates

A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.

foreman
*

pkgs.foreman

Process manager for applications with multiple components
Notify package maintainers: 1
CVE-2023-27456
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks ago
  • @LeSuisse dismissed 1 week, 6 days ago
WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.

total
=<2.1.19

pkgs.autotalent

Real-time pitch correction LADSPA plugin (no MIDI control)

pkgs.texlivePackages.totalcount

Commands for typesetting total values of counters
Notify package maintainers: 6
CVE-2024-54245
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 1 week, 6 days ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks ago
  • @LeSuisse dismissed 1 week, 6 days ago
WordPress Clients plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients allows Stored XSS.This issue affects Clients: from n/a through 1.1.4.

clients
=<1.1.4

pkgs.haskellPackages.wai-session-clientsession

Session store based on clientsession
Notify package maintainers: 1
CVE-2024-54322
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated 2 weeks ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks ago
  • @LeSuisse removed
    2 packages
    • pkgs.media-downloader 4.6.0
    • pkgs.media-downloader 5.2.0
    2 weeks ago
  • @LeSuisse dismissed 2 weeks ago
WordPress Media Downloader plugin <= 0.4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through 0.4.7.4.

media-downloader
=<0.4.7.4
CVE-2024-45770
4.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
updated 2 weeks ago by @LeSuisse Activity log
  • Created automatic suggestion 2 weeks, 1 day ago
  • @LeSuisse dismissed 2 weeks ago
Pcp: pmpost symlink attack allows escalating pcp to root user

A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.

pcp
*

pkgs.ncmpcpp

A featureful ncurses based MPD client inspired by ncmpc

pkgs.python311Packages.pcpp

C99 preprocessor written in pure Python

pkgs.python312Packages.pcpp

C99 preprocessor written in pure Python
Notify package maintainers: 5