Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2023-45765
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP ERP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.12.6.

References

Affected products

erp
  • =<1.12.6

Matching in nixpkgs

pkgs.lerpn

Curses RPN calculator written in straight Python

pkgs.serpl

Simple terminal UI for search and replace, ala VS Code

  • nixos-unstable -

pkgs.sherpa

Monte Carlo event generator for the Simulation of High-Energy Reactions of PArticles

  • nixos-unstable -

pkgs.makerpm

Clean, simple RPM packager reimplemented completely from scratch

  • nixos-unstable -

pkgs.serpent

Compiler for the Serpent language for Ethereum

pkgs.overpass

Font heavily inspired by Highway Gothic

  • nixos-unstable -

pkgs.overpush

Self-hosted, drop-in replacement for Pushover that can use XMPP

  • nixos-unstable -

pkgs.powerpipe

Dynamically query your cloud, code, logs & more with SQL

  • nixos-unstable -

pkgs.featherpad

Lightweight Qt5 Plain-Text Editor for Linux

  • nixos-unstable -

pkgs.filterpath

Retrieve a valid path from a messy piped line

  • nixos-unstable -
    • nixpkgs-unstable

pkgs.ciderpress2

File archive utility for Apple II disk images and file archives

  • nixos-unstable -

pkgs.letterpress

Create beautiful ASCII art

  • nixos-unstable -

pkgs.pufferpanel

Free, open source game management panel

  • nixos-unstable -

pkgs.fingerprintx

Standalone utility for service discovery on open ports

  • nixos-unstable -

pkgs.hyperpotamus

YAML based HTTP script processing engine

  • nixos-unstable -

pkgs.etherpad-lite

Modern really-real-time collaborative document editor

  • nixos-unstable -

pkgs.open-interpreter

OpenAI's Code Interpreter in your terminal, running locally

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-37458
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Highlight theme <= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ExtendThemes Highlight allows Cross Site Request Forgery.This issue affects Highlight: from n/a through 1.0.29.

References

Affected products

highlight
  • =<1.0.29

Matching in nixpkgs

pkgs.highlight

Source code highlighting tool

  • nixos-unstable -

pkgs.kohighlights

Utility for viewing and/or exporting KOReader's highlights

pkgs.gnomeExtensions.preedit-highlight-popup

Waylandセッション向け日本語入力補助ツールです。かな漢字変換時に未確定文字列を表示するポップアップを追加します。ポップアップ内では変換範囲が太字かつ下線つきで表示されるので、変換範囲の指定が簡単になります。

  • nixos-unstable -
    • nixpkgs-unstable 2
Permalink CVE-2024-38764
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress i-transform theme <= 3.0.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9.

References

Affected products

i-transform
  • =<3.0.9

Matching in nixpkgs

Permalink CVE-2024-38765
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Oceanic theme <= 1.0.48 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Freelancelot Oceanic allows Cross Site Request Forgery.This issue affects Oceanic: from n/a through 1.0.48.

References

Affected products

oceanic
  • =<1.0.48

Matching in nixpkgs

Package maintainers

Permalink CVE-2023-23672
5.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
WordPress GiveWP plugin <= 2.25.1 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

References

Affected products

give
  • =<2.25.1

Matching in nixpkgs

Permalink CVE-2024-7260
4.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
Keycloak-core: open redirect on account page

An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.

References

Affected products

keycloak
  • <24.0.7
keycloak-core
rhbk/keycloak-rhel9
  • *
rhbk/keycloak-rhel9-operator
  • *
rhbk/keycloak-operator-bundle
  • *

Matching in nixpkgs

pkgs.keycloak

Identity and access management for modern applications and services

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-37490
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Bard theme <= 2.210 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WP Royal Bard allows Cross Site Request Forgery.This issue affects Bard: from n/a through 2.210.

References

Affected products

bard
  • =<2.210

Matching in nixpkgs

pkgs.bombardier

Fast cross-platform HTTP benchmarking tool written in Go

  • nixos-unstable -

Package maintainers

Permalink CVE-2024-38789
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
WordPress Telegram Bot & Channel plugin <= 3.8.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through 3.8.2.

References

Affected products

telegram-bot
  • =<3.8.2

Matching in nixpkgs

Package maintainers

Permalink CVE-2024-37478
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Ashe theme <= 2.233 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WP Royal Ashe allows Cross Site Request Forgery.This issue affects Ashe: from n/a through 2.233.

References

Affected products

ashe
  • =<2.233

Matching in nixpkgs

pkgs.ashell

Ready to go Wayland status bar for Hyprland

  • nixos-unstable -

pkgs.dasher

Information-efficient text-entry interface, driven by natural continuous pointing gestures

pkgs.hashes

Simple hash algorithm identification GUI

  • nixos-unstable -

pkgs.seashells

Pipe command-line programs to seashells.io

  • nixos-unstable -

pkgs.gcfflasher

CFFlasher is the tool to program the firmware of dresden elektronik's Zigbee products

  • nixos-unstable -

pkgs.pixelflasher

Pixel™ phone flashing GUI utility with features

Package maintainers

Permalink CVE-2024-38766
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Matomo Analytics plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) leading to Notice Dismissal vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Matomo Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from n/a through 5.1.1.

References

Affected products

matomo
  • =<5.1.1

Matching in nixpkgs

pkgs.matomo_5

Real-time web analytics application

  • nixos-unstable -

Package maintainers