Lucene search
+L

143 matches found

OSV
OSV
added 2022/10/14 7:00 p.m.45 views

GHSA-69CH-W2M2-3VJP golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

7.5CVSS7.6AI score0.0155EPSS
SaveExploits0References9
OSV
OSV
added 2022/10/05 5:23 a.m.10 views

MGASA-2022-0356 Updated golang packages fix security vulnerability

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. CVE-2022-27664 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path...

7.5CVSS7.5AI score0.03269EPSS
SaveExploits0References5
Photon
Photon
added 2022/09/20 12:00 a.m.34 views

Important Photon OS Security Update - PHSA-2022-3.0-0455

Updates of 'ImageMagick', 'go' packages of Photon OS have been released...

7.5CVSS6.9AI score0.03269EPSS
SaveExploits1
Photon
Photon
added 2022/09/07 12:00 a.m.48 views

Important Photon OS Security Update - PHSA-2022-0242

Updates of 'go' packages of Photon OS have been released...

1.7AI score0.02484EPSS
SaveExploits5
Photon
Photon
added 2022/09/07 12:00 a.m.44 views

Important Photon OS Security Update - PHSA-2022-4.0-0242

Updates of 'go' packages of Photon OS have been released...

7.5CVSS8.2AI score0.02484EPSS
SaveExploits2
Photon
Photon
added 2022/07/20 12:00 a.m.45 views

Moderate Photon OS Security Update - PHSA-2022-0498

Updates of 'go' packages of Photon OS have been released...

5.3CVSS2.1AI score0.02789EPSS
SaveExploits1
IBM Security Bulletins
IBM Security Bulletins
added 2022/07/08 7:37 a.m.38 views

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to an issue in OPM and Golang Go packages (CVE-2020-15257, CVE-2021-21334 and CVE-2021-41771)

Summary IBM MQ Operator catalog container image is vulnerable to an issue in OPM package from Red Hat openshift4/ose-operator-registry and IBM MQ Operator, IBM Supplied Queue Manager container images are vulnerable to an issue in the Golang Go packages. CVE-2020-15257, CVE-2021-21334 and...

7.5CVSS1.1AI score0.04698EPSS
SaveExploits4Affected Software1
Photon
Photon
added 2022/06/02 12:00 a.m.64 views

Important Photon OS Security Update - PHSA-2022-0480

Updates of 'go' packages of Photon OS have been released...

7.5CVSS1.7AI score0.0995EPSS
SaveExploits1
Github Security Blog
Github Security Blog
added 2022/05/24 4:44 p.m.27 views

LXD vulnerable to Race Condition

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer has an unsafe Chmod call that races against the stat in the Filepath.Walk function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice. Specific Go Packages Affected...

8.1CVSS7.7AI score0.00896EPSS
SaveExploits0References6Affected Software1
Github Security Blog
Github Security Blog
added 2022/05/14 12:55 a.m.34 views

GitHub Git LFS Arbitrary command execution vulnerability

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a url = line in a .lfsconfig file within a repository. Specific Go Packages Affected github.com/git-lfs/git-lfs/lfsapi...

8.8CVSS8.9AI score0.03677EPSS
SaveExploits1References11Affected Software1
Github Security Blog
Github Security Blog
added 2022/05/13 1:16 a.m.42 views

Docker Registry has Allocation of Resources Without Limits or Throttling

Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service memory consumption via the manifest endpoint. Specific Go Packages Affected...

7.5CVSS7AI score0.03192EPSS
SaveExploits0References9Affected Software1
OSV
OSV
added 2022/02/15 1:57 a.m.49 views

GHSA-XJQR-G762-PXWP containernetworking/cni improper limitation of path name

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the syste...

7.2CVSS7AI score0.01525EPSS
SaveExploits0References6
OSV
OSV
added 2022/02/15 1:57 a.m.28 views

GHSA-XX8C-M748-XR4J Access Restriction Bypass in kubernetes

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object. Specific Go Packages Affected github.com/kubernetes/kubernetes/pkg/apiserver...

7.7CVSS7.1AI score0.01583EPSS
SaveExploits0References7
OSV
OSV
added 2022/02/15 1:57 a.m.68 views

GHSA-H5RH-W6VM-9GHC Denial of service in Grafana

The snapshot feature in Grafana before 7.4.2 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set. Specific Go Packages Affected github.com/grafana/grafana/pkg/middleware...

8.2CVSS6.6AI score0.83042EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2022/02/15 1:57 a.m.37 views

Directory traversal in Kubernetes Secrets Store CSI Driver

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that...

6.5CVSS6.2AI score0.01312EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
added 2022/02/15 1:57 a.m.24 views

Pivotal Concourse Open Redirect in Login Flow

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse...

7.6CVSS5.8AI score0.01145EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2022/02/15 1:57 a.m.34 views

Kubernetes Arbitrary Command Injection

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection. Specific Go Packages Affected k8s.io/kubernetes/pkg/util/mount...

9.8CVSS8.9AI score0.04107EPSS
SaveExploits0References7Affected Software1
Github Security Blog
Github Security Blog
added 2022/02/15 1:57 a.m.26 views

Gitea Exposes Private Email Addresses

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

5.3CVSS5.5AI score0.01293EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2022/02/15 1:57 a.m.30 views

Gitea Improper Input Validation

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress. Specific Go Packages Affected github.com/go-gitea/gitea/models...

7.5CVSS7.3AI score0.01349EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2022/02/15 1:57 a.m.80 views

GHSA-X5F3-QMWJ-4F84 Authentication bypass by capture-replay in github.com/cosmos/ethermint

Cosmos Network Ethermint = v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg conte...

7.5CVSS7.4AI score0.01309EPSS
SaveExploits0References4
Rows per page
Query Builder