16488 matches found
Fedora 41 : yq (2025-d8a379a267)
The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-d8a379a267 advisory. Add shell-completions ---- Update to 4.47.1 and adopt go-vendor-tools Tenable has extracted the preceding description block directly from the Fedora...
Fedora 42 : yq (2025-99309ef35f)
The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-99309ef35f advisory. Add shell-completions ---- Update to 4.47.1 and adopt go-vendor-tools Tenable has extracted the preceding description block directly from the Fedora security...
CVE-2025-58445 Atlantis Exposes Service Version Publicly on /status API Endpoint
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known...
Vuls
Vuls: VULnerability Scanner Vulnerability scanner for Linux/FreeBSD, agent-less, written in Go. We have a slack team. Join slack team Twitter: @vulsen ---- Abstract For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. ...
go1.25-1.25.1-1.1 on GA media (moderate)
go1.25-1.25.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15525-1 Rating: moderate Cross-References: CVE-2025-47910 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the go1.25-1.25.1-1.1...
CVE-2025-48102
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership gourl-bitcoin-payment-gateway-paid-downloads-membership allows Stored XSS.This issue affects GoUrl Bitcoin Payment Gateway & Paid...
CVE-2025-48102
CVE-2025-48102 describes a stored XSS in the WordPress plugin GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership versions up to 1.6.6 . The vulnerability arises from improper neutralization of input during web page generation, enabling stored cross-site scripting. Public sources in conne...
OESA-2025-2223 skopeo security update
A command line utility that performs various operations on container images and image repositories Security Fixes: A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by...
OESA-2025-2224 skopeo security update
A command line utility that performs various operations on container images and image repositories Security Fixes: A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by...
OESA-2025-2222 skopeo security update
A command line utility that performs various operations on container images and image repositories Security Fixes: A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by...
OESA-2025-2183 golang security update
. Security Fixes: A vulnerability was found in Google Go up to 1.23.11/1.24.5 Programming Language Software. It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to versio...
OESA-2025-2181 golang security update
. Security Fixes: The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS e.g. Git, but contains metadata for another VC...
OESA-2025-2180 golang security update
. Security Fixes: A vulnerability was found in Google Go up to 1.23.11/1.24.5 Programming Language Software. It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to versio...
OESA-2025-2177 buildah security update
The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...
OESA-2025-2176 buildah security update
The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...
OESA-2025-2184 golang security update
. Security Fixes: A vulnerability was found in Google Go up to 1.23.11/1.24.5 Programming Language Software. It has been declared as problematic.The manipulation of the argument PATH with an unknown input leads to a unknown weakness.As an impact it is known to affect integrity.Upgrading to versio...
Symlink Attack
github.com/hashicorp/go-getter is vulnerable to Symlink Attack. The vulnerability is due to the subdirectory download feature allowing symbolic links to escape designated directory boundaries and access unauthorized files...
Golang 1.24.x < 1.24.7 / 1.25.x < 1.25.1 Insecure Bypass (75054)
The version of Golang running on the remote host is 1.24.x prior to 1.24.7, 1.25.x prior to 1.25.1. It is, therefore, affected by a vulnerability as referenced in 75054 advisory. - When passing patterns to CrossOriginProtection.AddInsecureBypassPattern, requests that would have redirected to thos...
