GO-2024-2644 Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid

Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid...

GO-2024-2766 Information disclosure in podman in github.com/containers/libpod

Information disclosure in podman in github.com/containers/libpod...

GO-2024-2741 Owncast Path Traversal vulnerability in github.com/owncast/owncast

Owncast Path Traversal vulnerability in github.com/owncast/owncast...

GO-2024-2692 Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble

Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble...

GO-2024-2803 Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome

Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome...

GO-2024-2729 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2024-2747 Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo

Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo...

GO-2024-2792 Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd

Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd...

github.com/huandu/facebook may expose access_token in error message.

Summary accesstoken can be exposed in error message on fail in HTTP request. Details Using this module, when HTTP request fails, error message can contain accesstoken. This can be happen when: - module is sending HTTP request with query parameter ?accesstoken=.... - and HTTP request fails errors...

CVE-2024-35232: Generation of Error Message Containing Sensitive Information

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...

PT-2024-26397

Name of the Vulnerable Software and Affected Versions github.com/huandu/facebook versions prior to 2.7.2 Description The issue concerns the exposure of access token in error messages when HTTP requests fail. This can occur when the module sends HTTP requests with a query parameter ?access token=...

GO-2024-2694 Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go

Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go...

CVE-2024-35183

wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than github.com. Most git-dependent functionality in wolfictl relies on its own git package, which contains...

CVE-2024-35183 wolfictl leaks GitHub tokens to remote non-GitHub git servers

wolfictl is a command line tool for working with Wolfi. A git authentication issue in versions prior to 0.16.10 allows a local user’s GitHub token to be sent to remote servers other than github.com. Most git-dependent functionality in wolfictl relies on its own git package, which contains...

Improper TLS Ciphers Configuration

github.com/nats-io/nats-server/ is vulnerable to Improper TLS Ciphers Configuration. The vulnerability is due to the loss of restricted ciphersuite settings when using CLI options to set a key/cert for TLS, enabling all ciphersuites supported by Go by default...

Command Injection

github.com/cea-hpc/sshproxy is vulnerable to Command Injection. The vulnerability is due to missing input santization when constructing the ssh command string, which allows an authorized user to inject options into the ssh command executed by sshproxy...

PT-2024-26364

Name of the Vulnerable Software and Affected Versions wolfictl versions prior to 0.16.10 Description A git authentication issue allows a local user’s GitHub token to be sent to remote servers other than github.com. Most git-dependent functionality in wolfictl relies on its own git package, which...

CVE-2024-3727: Improper Validation of Integrity Check Value

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...

GO-2024-2821 Denial of Service from untrusted requests in github.com/stacklok/minder

HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. An untrusted request can cause the server to allocate large amounts of memory resulting in a denial of service...

CVE-2024-3727

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...