GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement

Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a package dependency chain. These attacks are especially concerning for the Go language ecosystem, which is extensively...

bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +82 more potentially affected by CVE-2025-24898 via openssl (>=0.10.7, <=0.10.68)

openssl CARGO version =0.10.7, =0.5.0, =0.2.0, =0.0.0, =0.0.1, =0.3.3, =0.6.25, =0.1.0-alpha.0, =0.0.3, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.38.0 and more Source cves: CVE-2025-24898 Source advisory: OSV:GHSA-RPMJ-RPGJ-QMPM...

CVE-2023-52516

In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under freeentrieslock dmaentryalloccheckleak calls into printk - serial console output qcom geni and grabs port-lock under freeentrieslock spin lock, which is a reverse locking...

CVE-2023-52516

In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under freeentrieslock dmaentryalloccheckleak calls into printk - serial console output qcom geni and grabs port-lock under freeentrieslock spin lock, which is a reverse locking...

CVE-2023-52516

In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under freeentrieslock dmaentryalloccheckleak calls into printk - serial console output qcom geni and grabs port-lock under freeentrieslock spin lock, which is a reverse locking...

CVE-2023-52516 dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock

In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under freeentrieslock dmaentryalloccheckleak calls into printk - serial console output qcom geni and grabs port-lock under freeentrieslock spin lock, which is a reverse locking...

CVE-2023-52516 dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock

In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under freeentrieslock dmaentryalloccheckleak calls into printk - serial console output qcom geni and grabs port-lock under freeentrieslock spin lock, which is a reverse locking...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2) +63 more potentially affected by CVE-2021-4435 via yarn (>=1.0.2, <=1.22.11)

yarn NPM version =1.0.2, =1.17.6-next.0, =1.0.2-6river, =0.0.9, =0.0.1, =1.6.0, =0.3.0-next.1, =0.3.0-next.1, =0.3.0-next.1, =0.4.0-next.7, =0.3.0-next.1, =0.3.0-next.1, =1.1.0-dev.2, =5.6.4, =3.1.264, =1.15.3, =1.15.5 and more Source cves: CVE-2021-4435 Source advisory: OSV:GHSA-MPWJ-FCR6-X34C...

@51jbs/incremental-coverage-plugin (1.0.5), @51jbs/spec-plugin (2.0.0) +202 more potentially affected by CVE-2022-25860 via simple-git (>=3.0.3, <=3.15.1)

simple-git NPM version =3.0.3, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =1.4.0, =5.15.0, =10.0.0-version-usage.0, =1.0.1, =2.0.0, =1.1.0, =1.1.0, =0.0.0-semantic-release, =0.0.1-semantic-release - @colliercz/gatsby-transformer-gitinfo 1.3.0 and more Source cves: CVE-2022-25860 Source advisory:...

GHSA-GFH2-7JG5-653P Denial of Service in docker2aci

docker2aci = 0.12.3 has an infinite loop when handling local images with cyclic dependency chain...

421752593pro (5.6.0), @concisejs/docz-theme-ext (>=0.0.1, <=0.0.3) +81 more potentially affected by CVE-2021-23362 via hosted-git-info (>=2.1.5, <=2.8.8)

hosted-git-info NPM version =2.1.5, =0.0.1, =0.1.0, =1.3.13, =3.0.0, =2.0.0, =1.16.0, =0.0.2, =2.3.1, =1.0.0, =1.0.0, =1.3.0, =1.3.16 and more Source cves: CVE-2021-23362 Source advisory: OSV:GHSA-43F8-2H32-F4CJ...

@hytong-yarn/cli (1.4.0), @yym-yarn/cli (1.0.0) +10 more potentially affected by CVE-2013-6393 via libyaml (>=0.0.2, <=0.2.2)

libyaml NPM version =0.0.2, =0.3.0, =1.0.24, =2.0.8, =0.0.1, =0.1.2, =0.0.10, =0.0.4, =0.0.5 Source cves: CVE-2013-6393 Source advisory: OSV:GHSA-M75H-CGHQ-C8H5...

0.workspace (>=0.1.0, <=0.1.1), 00ld8nuivn (2.1.0) +60348 more potentially affected by CVE-2020-8203 via lodash (>=3.7.0, <=4.17.18)

lodash NPM version =3.7.0, =0.1.0, =1.0.0, =1.1.0 - 02rjq8i863 1.1.0 - 02vx8qsp01 2.1.0 - 05y6tjgmws 1.1.0 - 066m7q8o0z 2.1.0 - 06buj9h3su 2.1.0 - 06dre15t8r 2.1.0 - 07fgapmu9l 1.1.0 - 07t2xvu6t4 2.1.0 - 0850u4lkpu 1.1.0 - 08cms 1.0.0 and more Source cves: CVE-2020-8203 Source advisory:...

Denial Of Service (DoS) Through Infinite Loop

github.com/appc/docker2aci is vulnerable to denial of service DoS attacks. A local attacker could cause an infinite loop with a crafted image due to lack of essential checks in the cyclic dependency chain in getAncestry function resulting in an application crash...

CVE-2016-8579

docker2aci = 0.12.3 has an infinite loop when handling local images with cyclic dependency chain...

CVE-2016-8579

docker2aci = 0.12.3 has an infinite loop when handling local images with cyclic dependency chain...

CVE-2016-8579

docker2aci = 0.12.3 has an infinite loop when handling local images with cyclic dependency chain...

CVE-2016-8579

docker2aci = 0.12.3 has an infinite loop when handling local images with cyclic dependency chain...

CVE-2016-8579

CVE-2016-8579 affects docker2aci

Fedora 20 : erlang-R16B-03.10.fc20 (2014-16214)

Disable SSLv3 - Backport useful os:getenv/2 from master. See this GitHub pull request for further details - https://github.com/erlang/otp/pull/535 - Fixed CVE-2014-1693 backported fix from ver. 17.x.x, see patch no. 17 - Trimmed dependency chain Note that Tenable Network Security has extracted...