3197 matches found
GO-2022-1208 gotify/server vulnerable to Cross-site Scripting in the application image file upload in github.com/gotify/server
gotify/server vulnerable to Cross-site Scripting in the application image file upload in github.com/gotify/server...
GO-2023-2077 Authentication bypass in github.com/sagernet/sing
Authentication bypass in github.com/sagernet/sing...
GO-2023-2394 Spoofed source IP address in github.com/shift72/caddy-geo-ip
The caddy-geo-ip aka GeoIP middleware for Caddy 2 allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictions...
GO-2025-3936 Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos
Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos...
GO-2022-1236 usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos
usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos...
GO-2024-2431 Insecure random string generator used for sensitive data in github.com/cubefs/cubefs
Insecure random string generator used for sensitive data in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2023-2046 Unbounded memory consumption in github.com/ethereum/go-ethereum
Unbounded memory consumption in github.com/ethereum/go-ethereum...
GO-2022-0203 Remote command execution via "go get" command with "-insecure" option in cmd/go
The "go get" command is vulnerable to remote code execution. When the -insecure command-line option is used, "go get" does not validate the import path get/vcs.go only checks for "://" anywhere in the string, which allows remote attackers to execute arbitrary OS commands via a crafted web site...
GO-2023-1940 1Panel command injection vulnerability in Firewall ip functionality in github.com/1Panel-dev/1Panel
1Panel command injection vulnerability in Firewall ip functionality in github.com/1Panel-dev/1Panel...
GO-2023-2402 Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto
A protocol weakness allows a MITM attacker to compromise the integrity of the secure channel before it is established, allowing the attacker to prevent transmission of a number of messages immediately after the secure channel is established without either side being aware. The impact of this atta...
GO-2023-1733 Timing attack from non-constant time scalar arithmetic in github.com/bnb-chain/tss-lib
Timing attack from non-constant time scalar arithmetic in github.com/bnb-chain/tss-lib...
GO-2025-3977 Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server...
GO-2023-1912 mx-chain-go's relayed transactions always increment nonce in github.com/multiversx/mx-chain-go
mx-chain-go's relayed transactions always increment nonce in github.com/multiversx/mx-chain-go...
GO-2024-2989 projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei
projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei...
GO-2024-2963 Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail...
GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd
Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd...
GO-2024-2645 Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei
Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei...
GO-2022-1130 Authentication bypass in github.com/prometheus/exporter-toolkit
If an attacker has access to a Prometheus web.yml file and users' bcrypted passwords, it would be possible to bypass security via the built-in authentication cache...
GO-2022-0475 Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol name in a linked object file...
GO-2020-0018
UUIDs generated using NewV1 and NewV4 may not read the expected number of random bytes. These UUIDs may contain a significantly smaller amount of entropy than expected, possibly leading to collisions...
GO-2024-3088 memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos
memos CORS Misconfiguration in server.go GHSL-2024-034 in github.com/usememos/memos...
GO-2022-1219 usememos/memos Denial of Service vulnerability in github.com/usememos/memos
usememos/memos Denial of Service vulnerability in github.com/usememos/memos...
GO-2024-2824 Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop...
GO-2023-2024 Out-of-memory vulnerability in github.com/libp2p/go-libp2p
A malicious actor can store an arbitrary amount of data in the memory of a remote node by sending the node a message with a signed peer record. Signed peer records from randomly generated peers can be sent by a malicious actor. This memory does not get garbage collected and so the remote node can...
GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd
Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd...
GO-2022-1118 Improper validation of UUIDs in github.com/codenotary/immudb
A malicious server can trick a client into treating it as a different server by changing the reported UUID. immudb client SDKs use the server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple server...
GO-2021-0090 Denial of service in github.com/tendermint/tendermint
Proposed commits may contain signatures for blocks not contained within the commit. Instead of skipping these signatures, they cause failure during verification. A malicious proposer can use this to force consensus failures...
GO-2023-1656 Answer vulnerable to Stored Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Stored Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1294 easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt
easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt...
GO-2023-1713 Path traversal in github.com/sjqzhang/go-fastdfs
An attacker can craft a remote request to upload a file to "/group1/upload" that uses path traversal to instead write the file contents to an attacker controlled path on the server...
GO-2023-1602 Denial of service via deflate decompression bomb in github.com/russellhaering/gosaml2
A bug in SAML authentication library can result in Denial of Service attacks. Attackers can craft a "deflate"-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process bein...
GO-2024-3327 SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel...
GO-2024-3305 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2022-1266 usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos...
GO-2023-1542 Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
Pterodactyl Wings contains UNIX Symbolic Link Symlink Following in github.com/pterodactyl/wings...
GO-2021-0069 Panic during division of very large numbers in math/big
A number of math/big.Int methods can panic when provided large inputs due to a flawed division method...
GO-2022-1032 Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow...
GO-2022-0459 Smokescreen SSRF via deny list bypass (square brackets) in github.com/stripe/smokescreen
Smokescreen SSRF via deny list bypass square brackets in github.com/stripe/smokescreen...
GO-2023-1660 Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
Answer vulnerable to Business Logic Errors in github.com/answerdev/answer...
GO-2023-1553 Answer vulnerable to Race Condition in github.com/answerdev/answer
Answer vulnerable to Race Condition in github.com/answerdev/answer...
GO-2024-3055 gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc
gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc...
GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator...
GO-2023-2338 Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno
Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno...
GO-2024-3054 Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast
Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast...
GO-2024-2981 SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend
SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend...
GO-2021-0100 Denial of service via deadlock in github.com/containers/storage
Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an...
GO-2025-3930 Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve
Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve...
GO-2022-0350 Code injection in Stripe CLI on windows in github.com/stripe/stripe-cli
Code injection in Stripe CLI on windows in github.com/stripe/stripe-cli...
GO-2022-1178 JWT leak in github.com/bradleyfalzon/ghinstallation
Errors returned by ghinstallation.Transport can include the JWT used for the failed operation. If the error is exposed to an untrusted party, this JWT could be extracted and used to authenticate further requests...