GO-2021-0084 Incorrect permissions for critical resource in github.com/astaxie/beego

Session data is stored using permissive permissions, allowing local users with filesystem access to read arbitrary data...

Unauthorized Access Vulnerability in Beego Framework

beego is an application framework developed in Go. An unauthorized access vulnerability exists in the Beego framework, which can be exploited by an attacker to obtain sensitive information...

Cross-Site Scripting (XSS)

github.com/astaxie/beego/issues is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the Router Pattern...

Information Disclosure

github.com/astaxie/beego is vulnerable to information disclosure. Local users are able to access and read session files due to excessive permissions 0777 configured on the files upon creation...

Beego File Session Manager Information Disclosure Vulnerability

Beego is an open source web framework based on the Go language . File Session Manager is one of the file Session Manager. An information disclosure vulnerability exists in File Session Manager in Beego version 1.10.0, which can be exploited by a local attacker to read session files...

Beego File Session Manager Information Disclosure Vulnerability (CNVD-2019-32482)

Beego is an open source web framework based on the Go language . File Session Manager is one of the file Session Manager. An information disclosure vulnerability exists in File Session Manager in Beego version 1.10.0, which can be exploited by a local attacker to read session files...

CVE-2019-16354

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

CVE-2019-16355

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files...

CVE-2019-16354

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

CVE-2019-16355

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files...

Session fixation

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files...

Race condition

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

CVE-2019-16355

The CVE-2019-16355 entry concerns Beego’s File Session Manager in Beego 1.10.0, where local attackers can read session files due to weak per-file permissions. Multiple connected sources (Red Hat, OSV entries) reiterate that Beego’s File Session Manager permits information disclosure via improper ...

CVE-2019-16355

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files...

CVE-2019-16354

CVE-2019-16354 affects Beego’s File Session Manager. A race condition in file creation within a directory with weak permissions allows a local attacker to read session files. Publicly documented impact centers on Beego 1.10.0; multiple advisories indicate the issue persists across older Beego rel...

Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

The File Session Manager in Beego allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

Incorrect Default Permissions

The File Session Manager in Beego allows local users to read session files because of weak permissions for individual files...

Directory Traversal

github.com/astaxie/beego is vulnerable to directory traversal. The library does not properly sanitize the sessionID field, allowing a malicious user to pass a string with the ./ characters through this field to traverse the directory and gain access to sensitive files...

Directory Traversal

github.com/astaxie/beego is vulnerable to directory traversal attacks. The library does not properly sanitize URL paths, allowing a malicious user to gain access to sensitive information...

Cross-site Scripting (XSS)

github.com/astaxie/beego is vulnerable to cross-site scripting XSS. The vulnerability exists due to the lack of sanitization on resultLists in qpsIndex...