Timing Attack

github.com/hashicorp/vault is vulnerable to timing attacks. This vulnerability is caused because passwords are not compared in constant time, allowing malicious users to guess valid passwords based on the time that a comparison takes...

Cross-site Request Forgery (CSRF)

github.com/bitly/oauth2proxy is vulnerable to cross-site request forgery CSRF attacks. The vulnerability is possible due to a flaw in OAuth flow where it uses state parameter as redirect target URL without secure randomness...

POODLE Attack

github.com/zenazn/goji is vulnerable to POODLE attacks. A malicious user can compromise the SSL 3.0 channel to listen in and execute a man-in-the-middle MitM attacks. This is related to CVE-2014-3566...

Denial Of Service (DoS)

github.com/grpc/grpc-go is vulnerable to denial of service DoS attacks. A malicious user can send an empty hpack string to the system and cause it to crash...

Cross-site Scripting (XSS)

net/http in github.com/golang/go is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the Error function as a user can control the error message...

Unauthorized Modification Of Data

github.com/go-gitea/gitea is vulnerable to unauthorized deletion of user emails. A malicious user can modify the HTTP post requests to delete another user's email...

Timing Attacks

github.com/go-gitea/gitea is vulnerable to timing attacks. This vulnerability is caused because the passwords are not compared in constant time, allowing malicious users to guess the valid passwords based on the time that a comparison takes...

Integer Overflow

github.com/golang/protobuf is vulnerable to integer overflows. A malicious user can pass an integer larger than 64-bit to the system, causing an integer overflow and crashing the system...

Cross-site Scripting (XSS)

github.com/hashicorp/consul is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the sessionName, sessionMeta and aclName strings, allowing an attacker to inject and execute arbitrary script...

Information Disclosure

github.com/tianon/gosu is vulnerable information disclosure. The library changes and leaves file descriptors open when accessing them. This can allow a malicious user to change permissions on sensitive files and read them...

Cross-site Request Forgery (CSRF)

github.com/koding/koding is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists because it does not incorporate the state parameter logic into the authorization process...

Poodle SSLv3 Vulnerability

github.com/jaytaylor/shipbuilder is vulnerable to the poodle SSLv3 vulnerability. It does not disable the use of SSL 3.0 by using proper setting in haproxy configuration...

Denial Of Service (DoS)

github.com/hlandau/acme is vulnerable to denial of service DoS attacks. A malicious user can have multiple clients connect to the redirector system and crash it because the redirector does not have a timeout...

HTTP Header Injection

net/textproto in github.com/golang/go is vulnerable to HTTP header injection attacks. These attacks are possible because it treats spaces as hyphens. This leaves net/textproto vulnerable to request smuggling...

Denial Of Service (DoS)

github.com/kubernetes/kubernetes is vulnerable to denial of service attacks. These attacks can be triggered by invalid JSON data. The invalid JSON data causes github.com/kubernetes/kubernetes to panic and cause a nil pointer dereference causing the master process to crash. This is related to...

Directory Traversal

github.com/appc/docker2aci is vulnerable to directory traversal vulnerabilities. The attacks can be conducted by including .. dot dot in the embedded layer data in an image and allows attackers to write to arbitrary files...

CVE-2016-2562

The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate...

Huawei HG253s V2 Information Disclosure

Huawei HG253s v2 Vodafone-Spain is starting to rent a new Huawei HG253v2 router to the spanish costumers. This new router is coming with a new firmware version. This bug has been found by @VicenDominguez Vulnerability Basically, it is not validating the session cookie in some administration...

XSS vulnerability in login redirect param

Security advisory: XSS vulnerability in login redirect param ScnSocialAuth version 1.15.2 has been released and includes a security for this vulnerability. Fix has been applied in 4a00966 Affected versions All versions below 1.15.2 are affected. dev-master is fixed starting from 4a00966 Exploits...

MS13-097 Registry Symlink IE Sandbox Escape

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex' require 'msf/core/exploit/exe' require 'msf/core/exploit/powershell' class Metasploit3...