1010 matches found
go-grpc-compression has a zstd decompression bombing vulnerability
Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...
GHSA-87M9-RV8P-RGMG go-grpc-compression has a zstd decompression bombing vulnerability
Impact A malicious user could cause a denial of service DoS when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v1.2.2 made use of the Decoder.DecodeAll...
GO-2024-2776 Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection in github.com/apache/trafficcontrol
Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection in github.com/apache/trafficcontrol...
GO-2024-2684 CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs
CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs...
Improper Input Validation
github.com/golang/go/ is vulnerable to Improper Input Validation. The vulnerability is due to a misalignment in the behavior of zip implementations, which can be exploited to create zip files with varying contents based on the implementation reading the file...
Path Traversal
github.com/cri-o/cri-o is vulnerable to Path Traversal. The vulnerability is due to the path of the /etc directory being relative to the base of the container, which could lead to a container escape...
GO-2024-2875 Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki
Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki...
GO-2024-2664 ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel
ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2793 Mattermost allows team admins to promote guests to team admins in github.com/mattermost/mattermost-server
Mattermost allows team admins to promote guests to team admins in github.com/mattermost/mattermost-server...
GO-2024-2737 IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker
IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker...
GO-2024-2468 snapd Race Condition vulnerability in github.com/snapcore/snapd
snapd Race Condition vulnerability in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2717 LocalAI Command Injection in audioToWav in github.com/go-skynet/LocalAI
LocalAI Command Injection in audioToWav in github.com/go-skynet/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2705 LocalAI cross-site request forgery vulnerability in github.com/go-skynet/LocalAI
LocalAI cross-site request forgery vulnerability in github.com/go-skynet/LocalAI...
GO-2024-2771 Rancher's Steve API Component Improper authorization check allows privilege escalation in github.com/rancher/rancher
Rancher's Steve API Component Improper authorization check allows privilege escalation in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2809 CVE-2024-32359 in github.com/carina-io/carina
CVE-2024-32359 in github.com/carina-io/carina...
GO-2024-2885 Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder
Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder...
GO-2024-2729 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2024-2792 Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd...
GO-2024-2644 Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid
Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid...