4073 matches found
GO-2023-1660 Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
Answer vulnerable to Business Logic Errors in github.com/answerdev/answer...
GO-2023-1542 Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
Pterodactyl Wings contains UNIX Symbolic Link Symlink Following in github.com/pterodactyl/wings...
GO-2022-0646 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...
GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator...
GO-2022-1032 Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow...
GO-2023-2338 Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno
Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno...
GO-2023-1553 Answer vulnerable to Race Condition in github.com/answerdev/answer
Answer vulnerable to Race Condition in github.com/answerdev/answer...
GO-2024-2981 SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend
SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend...
GO-2021-0100 Denial of service via deadlock in github.com/containers/storage
Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an...
GO-2025-3930 Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve
Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve...
GO-2025-3542 LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI
LocalAI Cross-Site Scripting XSS vulnerability in its search functionality in github.com/mudler/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2022-0350 Code injection in Stripe CLI on windows in github.com/stripe/stripe-cli
Code injection in Stripe CLI on windows in github.com/stripe/stripe-cli...
GO-2024-3054 Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast
Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast...
GO-2022-1178 JWT leak in github.com/bradleyfalzon/ghinstallation
Errors returned by ghinstallation.Transport can include the JWT used for the failed operation. If the error is exposed to an untrusted party, this JWT could be extracted and used to authenticate further requests...
GO-2022-1114 ZipSlip when unzipping files in github.com/duke-git/lancet
A ZipSlip vulnerability exists when using the fileutil package to unzip files...
GO-2022-0564 Signature forgery in github.com/biscuit-auth/biscuit-go
An attacker can forge Biscuit v1 tokens with any access level. There is no known workaround for Biscuit v1. The Biscuit v2 specification avoids this vulnerability...
GO-2026-5935 netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil...
GO-2024-2641 Insecure Variable Substitution in Vela in github.com/go-vela/worker
Insecure Variable Substitution in Vela in github.com/go-vela/worker...
GO-2022-1113 Server-side request forgery in github.com/oam-dev/kubevela
When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability...
GO-2022-0524 Stack exhaustion when reading certain archives in compress/gzip
Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion...
GO-2022-0273 Panic due to crafted inputs in archive/zip
The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196...
GO-2020-0016 Infinite loop in github.com/ulikunitz/xz
An attacker can construct a series of bytes such that calling Reader.Read on the bytes could cause an infinite loop. If parsing user supplied input, this may be used as a denial of service vector...
GO-2022-0792 Privilege Escalation in Kubernetes in github.com/kubernetes/kubernetes
Privilege Escalation in Kubernetes in github.com/kubernetes/kubernetes...
GO-2023-1543 mrpack-install vulnerable to path traversal with dependency in github.com/nothub/mrpack-install
mrpack-install vulnerable to path traversal with dependency in github.com/nothub/mrpack-install...
GO-2023-1461 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2024-3057 NetBird uses a static initialization vector (IV) in github.com/netbirdio/netbird
NetBird uses a static initialization vector IV in github.com/netbirdio/netbird...
GO-2023-2042 Arbitrary code execution via go.mod toolchain directive in cmd/go
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules...
GO-2023-1923 Panic when handling invalid HAProxy PROXY v2 request in github.com/mastercactapus/proxyprotocol
Panic when handling invalid HAProxy PROXY v2 request in github.com/mastercactapus/proxyprotocol...
GO-2023-1883 Denial of service via OOM in github.com/cometbft/cometbft
A bug in the CometBFT middleware causes the mempool's two data structures to fall out of sync. This can lead to duplicate transactions that cannot be removed, even after they are committed in a block. The only way to remove the transaction is to restart the node. This can be exploited by an...
GO-2023-1571 Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests...
GO-2023-1559 Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfsnode
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by a bogus fanout parameter in the HAMT directory nodes. There are no known workarounds users are advised to...
GO-2022-1201 Timing attack in github.com/openshift/osin
Client secret checks are vulnerable to timing attacks, which could permit an attacker to determine client secrets...
GO-2022-0229 Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte
On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte can lead to a panic. The malformed certificate can be delivered via a crypto/tls connection to a client, or to a server that accepts client certificates. net/http clients can...
GO-2021-0113 Out-of-bounds read in golang.org/x/text/language
Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...
GO-2020-0043 Authentication bypass in github.com/mholt/caddy
Due to improper TLS verification when serving traffic for multiple SNIs, an attacker may bypass TLS client authentication by indicating an SNI during the TLS handshake that is different from the name in the HTTP Host header...
GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintaine...
GO-2025-3505 Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet
Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2022-1240 usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos...
GO-2024-2905 Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter
Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter...
GO-2024-2903 Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos
Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos...
GO-2024-2576 registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library
registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2636 1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel
1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel...
GO-2023-1611 Path traversal in github.com/gookit/goutil
fsutil.Unzip is vulnerable to path traversal attacks due to improper validation of paths...
GO-2023-1557 Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfs
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus "fanout" parameter in the HAMT directory nodes. A workaround is to not feed untrusted user data to th...
GO-2022-1026 Incorrect validation of root DNSSEC public keys in github.com/peterzen/goresolver
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain...
GO-2022-0988 Failure to strip relative path components in net/url
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath"https://go.dev", "../go" returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result...
GO-2022-0942 Infinite recursion in parser in github.com/graphql-go/graphql
graphql-go aka GraphQL for Go has infinite recursion in the type definition parser...
GO-2022-0322 Uncontrolled resource consumption in github.com/prometheus/client_golang
The Prometheus clientgolang HTTP server is vulnerable to a denial of service attack when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of the promhttp.InstrumentHandler middleware except RequestsInFlight; not filter any specific...
GO-2021-0070 Privilege escalation in github.com/opencontainers/runc
GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges...
GO-2022-1215 usememos/memos Authorization Bypass Through User-Controlled Key vulnerability in github.com/usememos/memos
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability in github.com/usememos/memos...