Open Redirection

github.com/go-macaron/macaron is vulnerable to open redirection. Lack of validation of the path URL allows a remote attacker to redirect users to a malicious site to steal user credentials...

Improper Access Control

github.com/gorilla/handlers is vulnerable to improper access control. The vulnerability exists because it does not perform sufficient origin header access checks due to the misconfiguration of CORS, allowing an attacker to send malicious AJAX requests or HTML Document through it bypassing the sam...

Denial Of Service (DoS)

github.com/go-yaml/yaml is vulnerable to denial of service. An authorized user is able to crash the application by sending malicious YAML payloads to cause kube-apiserver to consume excessive CPU cycles...

Denial Of Service (DoS)

github.com/gambol99/go-marathon is vulnerable to denial of service DoS attacks. The vulnerability is possible due to the nil panic occurrence in the function 'NewClient' in client.go when accessing an empty debug log allowing an attacker to cause an application crash...

Denial Of Service (DoS)

github.com/micro/go-plugins is vulnerable to denial of service DoS attacks. The vulnerability is possible due to an invalid memory access in 'Leader' function in leader.go allowing an attacker to cause an application crash...

Denial Of Service (DoS)

github.com/containers/image is vulnerable to denial of service DoS. The vulnerability exists because it does not restrict the sizes of blobs copied into memory such as the manifest, the config, signatures, etc, allowing an attacker to hijack registries leading to a big blobs and triggering an out...

Information Leakage Through Denial Of Service (DoS)

github.com/ gammazero/nexus is vulnerable to information leakage through denial of service attacks. The router can reassign call results to the wrong session when two clients are connecting concurrently and performing long running calls with the same request ID, resulting in denial of service...

HTTP Request Smuggling

github.com/kubernetes/ingress-nginx is vulnerable to HTTP request smuggling. The library does not use a named location for authSignURL, allowing a malicious user to read unauthorized web pages in environments where NGINX is being fronted by a load balancer...

Insecure Random Generator

github.com/miekg/dns uses an insecure random generation for transaction IDs. The default Id function uses an insecure math/rand function, resulting in predictable output and allowing an attacker to exploit the vulnerability to forge responses without being on path...

Information Disclosure

github.com/cactus/go-camo is vulnerable to information disclosure through content-type smuggling. The vulnerability exists as it allows malformed content type records to bypass the validation checks, allowing non-media content to be served. This vulnerability can potentially be exploited to perfo...

Symlink Attack

github.com/helm/helm is vulnerable to symlink attack. During loading or packaging of a chart as a directory, a malicious chart containing symlinks could be used to obtain system files such as /etc/passwd. The vulnerability can also be used to cause a denial of service condition when special files...

destination-nz.com Cross Site Scripting vulnerability

Security Researcher MrRain1996 Helped patch 915 vulnerabilities Received 4 Coordinated Disclosure badges Received 9 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting destination-nz.com website and its users. Following...

Denial Of Service (DoS)

github.com/docker/cli is vulnerable to denial of service. The vulnerability exists as it was possible to cause the billion laughs attack through parsing a malicious yaml file causing an application crash...

HTTP Request Smuggling

github.com/golang/go is vulnerable to HTTP request smuggling. The vulnerability exists as invalid HTTP/1.1 headers were accepted and normalized with a space before the colon, allowing a reverse proxy to interpret the headers differently...

Denial Of Service (DoS) Via Settings Flood

github.com/grpc/grpc-go is vulnerable to denial of service DoS attacks. The attack can be triggered by sending a flood of settings by a HTTP/2 peer, leading to an excessive data queue and causing high CPU and resource consumption...

Information Disclosure

github.com/wtfutil/wtf is vulnerable to information disclosure. The permissions of config.yml is not set. This allows local attackers to access the file and retrieve confidential information such as passwords or API keys if permissions are incorrectly configured or configured with unsafe OS...

Authorization Bypass

github.com/golang/go is vulnerable to authorization bypass. The vulnerability exists as URL.Parse incorrectly parses host and port when given malformed URLs...

Arbitrary File Write

github.com/mholt/archiver is vulnerable to arbitrary file write attacks. The vulnerability exists as the library does not properly sanitize the destination filepath when extracting archived files, allowing a malicious user to extract files to an arbitrary filepath and overwrite files...

keystone/fuzz_asm_x86_64: Bad-cast to llvm_ks::X86OperandX86AsmParser::MatchAndEmitATTInstruction in AsmParser::parseStatement

Detailed report: https://oss-fuzz.com/testcase?key=5121855985287168 Project: keystone Fuzzer: libFuzzerkeystonefuzzasmx8664 Fuzz target binary: fuzzasmx8664 Job Type: libfuzzerubsankeystone Platform Id: linux Crash Type: Bad-cast Crash Address: 0x00000210d120 Crash State: Bad-cast to...

Information Disclosure

github.com/hashicorp/vault is vulnerable to information disclosure. The vulnerability exists as the in-memory cache that exists on performance standby nodes is not purged if a mount filter was used to exclude the secondary cluster. This allows an attacker to retrieve mount configuration data whic...