16522 matches found
HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack
Summary HashiCorp’s go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9. Background HashiCorp’s go-getter is a...
Security update for go1.23-openssl
This update for go1.23-openssl fixes the following issues: Updated to go1.23.12 released 2025-08-06 bsc1229122: - CVE-2025-4674: Fixed unexpected command execution in untrusted VCS repositories in cmd/go bsc1246118 - CVE-2025-47906: Fixed incorrect expansion of "", "." and ".." in some PATH...
SUSE-SU-2025:02812-1 Security update for go1.23-openssl
This update for go1.23-openssl fixes the following issues: Updated to go1.23.12 released 2025-08-06 bsc1229122: - CVE-2025-4674: Fixed unexpected command execution in untrusted VCS repositories in cmd/go bsc1246118 - CVE-2025-47906: Fixed incorrect expansion of '', '.' and '..' in some PATH...
PT-2025-33508
Name of the Vulnerable Software and Affected Versions: go-getter versions prior to 1.7.9 Description: The go-getter library subdirectory download feature is susceptible to symlink attacks, potentially allowing unauthorized read access beyond the intended directory boundaries. Recommendations:...
Golang 1.23 < 1.23.12 / 1.24 < 1.24.6 Multiple Vulnerabilities
The version of Golang running on the remote host is 1.23 prior to 1.23.12 or 1.24 prior to 1.24.6. It is, therefore, is affected by multiple vulnerabilities: - os/exec: LookPath may return unexpected paths CVE-2025-47906 - database/sql: incorrect results returned from Rows.Scan CVE-2025-47907 Not...
HashiCorp go-getter 安全漏洞
HashiCorp go-getter is a library for Go golang from HashiCorp, Inc. for downloading files or directories from various sources using URLs as the primary form of input. A security vulnerability exists in HashiCorp go-getter versions prior to 1.7.9, which stems from a symbolic link attack and could...
Malicious code in planett-go-back-to-top-text (npm)
The package planett-go-back-to-top-text was found to contain malicious code...
go-api-starter (>=0.0.0, <=1.3.0), redux-starter (>=0.0.0, <=1.1.0) potentially affected by unknown CVE via kik-starter (>=0.0.1, <=2.2.1)
kik-starter NPM version =0.0.1, =0.0.0, =0.0.0, =1.1.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-24454...
Malicious code in go-api-starter (npm)
The package go-api-starter was found to contain malicious code...
Malicious code in @zalastax/nolb-go_ (npm)
The package @zalastax/nolb-go was found to contain malicious code...
MAL-2025-29368 Malicious code in planett-go-back-to-top-text (npm)
The package planett-go-back-to-top-text was found to contain malicious code...
MAL-2025-21618 Malicious code in go-api-starter (npm)
The package go-api-starter was found to contain malicious code...
MAL-2025-11608 Malicious code in @zalastax/nolb-go (npm)
The package @zalastax/nolb-go was found to contain malicious code...
Malicious code in xdh-go (npm)
The package xdh-go was found to contain malicious code...
Malicious code in @zalastax/nolb-go (npm)
The package @zalastax/nolb-go was found to contain malicious code...
Malicious code in jquery-double-tap-to-go (npm)
The package jquery-double-tap-to-go was found to contain malicious code...
Malicious code in @zalastax/nolb-_go_ (npm)
The package @zalastax/nolb-go was found to contain malicious code...
MAL-2025-10041 Malicious code in @zalastax/nolb-_go_ (npm)
The package @zalastax/nolb-go was found to contain malicious code...