4526 matches found
GO-2024-3208 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium...
GO-2024-3161 Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher
Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3160 Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials in github.com/ory/kratos
Ory Kratos's setting requiredaal highestavailable does not properly respect code + mfa credentials in github.com/ory/kratos...
GO-2024-3116 sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go
sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go...
GO-2024-3110 Can be confused to create empty files/directories on the host in github.com/opencontainers/runc
Can be confused to create empty files/directories on the host in github.com/opencontainers/runc...
GO-2024-3083 Openshift Console insufficient entropy vulnerability in github.com/openshift/console
Openshift Console insufficient entropy vulnerability in github.com/openshift/console...
GO-2022-0987 Gophish before 0.12.0 vulnerable to Open Redirect in github.com/gophish/gophish
Gophish before 0.12.0 vulnerable to Open Redirect in github.com/gophish/gophish...
GO-2022-1014 CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure in github.com/cri-o/cri-o
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure in github.com/cri-o/cri-o...
GO-2022-0905 BLS Signature "Malleability" in github.com/filecoin-project/lotus
BLS Signature "Malleability" in github.com/filecoin-project/lotus...
GO-2022-0887 Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap
Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap...
GO-2022-0833 Denial of Service in docker2aci in github.com/appc/docker2aci
Denial of Service in docker2aci in github.com/appc/docker2aci...
GO-2022-0831 SQL Injection in Gogs in gogs.io/gogs
SQL Injection in Gogs in gogs.io/gogs...
GO-2022-0803 containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd
containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd...
GO-2022-0495 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd
DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd...
GO-2022-0448 Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2
Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2...
GO-2022-0314 Cross-site Scripting in Gitea in github.com/go-gitea/gitea
Cross-site Scripting in Gitea in github.com/go-gitea/gitea...
GO-2022-0278 Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd
Unprivileged pod using hostPath can side-step active LSM when it is SELinux in github.com/containerd/containerd...
GO-2022-0270 Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server...
GO-2022-0250 Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki
Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki...
GO-2023-2330 Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...
GO-2023-2088 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault...
GO-2023-1959 Kubernetes arbitrary file overwrite in k8s.io/kubernetes
Kubernetes arbitrary file overwrite in k8s.io/kubernetes...
GO-2023-1972 Gogs XSS Vulnerability in gogs.io/gogs
Gogs XSS Vulnerability in gogs.io/gogs...
GO-2023-1915 containernetworking/plugins vulnerable to MitM attacks in github.com/containernetworking/plugins
containernetworking/plugins vulnerable to MitM attacks in github.com/containernetworking/plugins...
GO-2023-1819 Kyverno resource with a deletionTimestamp may allow policy circumvention in github.com/kyverno/kyverno
Kyverno resource with a deletionTimestamp may allow policy circumvention in github.com/kyverno/kyverno...
GO-2023-1795 malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor
malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor...
GO-2023-1774 Answer Missing Authorization vulnerability in github.com/answerdev/answer
Answer Missing Authorization vulnerability in github.com/answerdev/answer...
GO-2023-1764 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen...
GO-2023-1723 SpiceDB binding metrics port to untrusted networks and can leak command-line flags in github.com/authzed/spicedb
SpiceDB binding metrics port to untrusted networks and can leak command-line flags in github.com/authzed/spicedb...
GO-2023-1658 Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
Answer vulnerable to Business Logic Errors in github.com/answerdev/answer...
GO-2023-1622 Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation
Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation...
GO-2023-1614 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1628 Kubernetes vulnerable to path traversal in k8s.io/kubernetes
Kubernetes vulnerable to path traversal in k8s.io/kubernetes...
GO-2024-3009 snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd
snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2442 Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport
Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2024-2476 Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2937 Panic when parsing invalid palette-color images in golang.org/x/image
Parsing a corrupt or malicious image with invalid color indices can cause a panic...
GO-2024-2780 Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes
Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes...
GO-2024-2699 Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama
Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama...
GO-2024-2734 1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel
1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2024-2848 Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana
Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2581 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs...
GO-2024-2571 Invalid block proposal in github.com/cosmos/cosmos-sdk
Invalid block proposal in github.com/cosmos/cosmos-sdk...
GO-2024-2744 Access control change may take longer than expected in github.com/authelia/authelia/v4
If the file authentication backend is being used, the ewatch option is set to true, the refresh interval is configured to a non-disabled value, and an administrator changes a user's groups, then that user may be able to access resources that their previous groups had access to...
GO-2023-2379 Denial of service due to malicious parameters in github.com/lestrrat-go/jwx
The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force...
GO-2023-1788 Incorrect permissions in github.com/goreleaser/nfpm/v2
When nfpm packages files without additional configuration to enforce its own permissions, the files could be packaged with incorrect permissions chmod 666 or 777. Anyone who uses nfpm to create packages and does not check or set file permissions before packaging could result in files or folders...
GO-2026-6571 Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei
Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei...
GO-2026-6441 Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc
In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules such as DENY referencing headers with uppercase or mixed-case characters, the rule fails to match, causing...
GO-2026-6431 SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel
SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo in github.com/siyuan-note/siyuan/kernel...
GO-2026-6299 statping-ng allows attackers to escalate privileges to Administrator and access sensitive components in github.com/statping-ng/statping-ng
statping-ng allows attackers to escalate privileges to Administrator and access sensitive components in github.com/statping-ng/statping-ng...