1010 matches found
GO-2024-2930 RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke
When RKE provisions a cluster, it stores the cluster state in a configmap called "full-cluster-state" inside the "kube-system" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data...
CVE-2024-37905 Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...
CVE-2024-37905 Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...
GO-2024-2532 Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary
Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary...
GO-2024-2449 Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport
Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2024-2549 caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting in github.com/greenpau/caddy-security
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting in github.com/greenpau/caddy-security...
GO-2024-2445 Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport
Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2559 Cross-site Scripting in github.com/greenpau/caddy-security
Cross-site Scripting in github.com/greenpau/caddy-security...
GO-2024-2476 Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2512 Classic builder cache poisoning in github.com/docker/docker
Classic builder cache poisoning in github.com/docker/docker...
GO-2024-2560 Open Redirect in github.com/greenpau/caddy-security
Open Redirect in github.com/greenpau/caddy-security...
GO-2024-2488 HashiCorp Vault Authentication bypass in github.com/hashicorp/vault
HashiCorp Vault Authentication bypass in github.com/hashicorp/vault...
GO-2024-2938 LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI
LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2024-2934 Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder
Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder...
PT-2024-40539
Name of the Vulnerable Software and Affected Versions: Teleport versions 13.0.0 through 13.4.12 Teleport versions 14.0.0 through 14.2.3 Description: The issue allows Teleport Access List owners to escalate their privileges. This is related to the github.com/gravitational/teleport module...
Command Injection
github.com/hashicorp/go-getter is vulnerable to Command Injection. The vulnerability is caused by improper handling of arguments in Git operations within getgit.go. This allows attackers to manipulate the Git configuration and execute arbitrary code...
CVE-2024-37904: Uncontrolled Resource Consumption
Minder is an open source Software Supply Chain Security Platform. Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users repositories using the github.com/go-git/go-git/v5 library on lines L55-L89. The Git provider...
PT-2024-27820
Name of the Vulnerable Software and Affected Versions Minder versions prior to v0.0.52 Description Minder's Git provider is vulnerable to a denial of service from a maliciously configured GitHub repository. The Git provider clones users' repositories using the github.com/go-git/go-git/v5 library...