16826 matches found
SUSE CVE-2020-8912
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...
SUSE CVE-2024-55885
beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256...
Malicious code in go-dependency-submission (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa0e3837d434167d18ab0ba251b0ce73d56ed83a0c773df12c8ebd99542f8eaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
[SECURITY] Fedora 41 Update: golang-github-task-3.40.1-1.fc41
A task runner / simpler Make alternative written in Go...
GHSA-W32M-9786-JP63 Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
GO-2024-3333 Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
Malicious code in flybook-table (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...
Malicious code in @dz-lib/icon (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48177d2f5e82546462b55524174635af9b9c224b960955ce998919a80db4d812 Any computer that has this package installed or...
Malicious code in interview-question (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...
Malicious code in @hisdk/mail-mac (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 396c6b416f2f3b292fa9331c7d139c100af0b05e27f9f92ab265b9767c90ec41 Any computer that has this package installed or...
MAL-2024-12183 Malicious code in interview-question (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...
MAL-2024-12182 Malicious code in flybook-table (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...
Malicious code in @hi.editor/core (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...
Malicious code in @dz-lib/dz-cli (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec9421e5d1892420fe8194f8361f8c856ef3b31d6996e2554d840fc850e59a1e Any computer that has this package installed or...
MAL-2024-12180 Malicious code in @hi.editor/core (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon...
Malicious code in bs-auto-dark-mode (npm)
This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a5c6958e14a49e20ebdd6902cdb4cad7872983ed4d39e94b625cc50a20314ac The OpenSSF Package Analysis project...
Google Go 安全漏洞
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google USA. A security vulnerability exists in Google Go that stems from the fact that an attacker can write an input to a parsing function that will be processed non-linearly based on it...
encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion
A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...
encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion
A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...
