4074 matches found
GO-2022-1171 Alist vulnerable to Path Traversal in github.com/alist-org/alist
Alist vulnerable to Path Traversal in github.com/alist-org/alist...
GO-2023-2084 OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga
OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga...
GO-2024-3050 Meshery SQL Injection vulnerability in github.com/layer5io/meshery
Meshery SQL Injection vulnerability in github.com/layer5io/meshery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2024-2612 Artica Proxy Loopback Services Remotely Accessible Unauthenticated in github.com/gvalkov/tailon
Artica Proxy Loopback Services Remotely Accessible Unauthenticated in github.com/gvalkov/tailon...
GO-2024-2798 Mattermost fails to limit the number of active sessions in github.com/mattermost/mattermost-server
Mattermost fails to limit the number of active sessions in github.com/mattermost/mattermost-server...
GO-2024-2669 API token secret ID leak to Sentinel in github.com/hashicorp/nomad
A vulnerability exists in Nomad where the API caller's ACL token secret ID is exposed to Sentinel policies...
GO-2023-1832 Verification bypass in github.com/notaryproject/notation-go
An attacker who controls or compromises a registry can lead a user to verify the wrong artifact...
GO-2022-0171 Mishandled trust preferences for root certificates on Darwin in crypto/x509
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate...
GO-2021-0103 Denial of service in github.com/holiman/uint256
Due to improper bounds checking, certain mathematical operations can cause a panic via an out of bounds read. If this package is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...
GO-2021-0110 Token reuse in github.com/ory/fosite
Uniqueness of JWT IDs jti are not checked, allowing the JWT to be replayed...
GO-2026-6180 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
GO-2024-3323 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel...
GO-2022-1261 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1259 usememos/memos Improper Authorization vulnerability in github.com/usememos/memos
usememos/memos Improper Authorization vulnerability in github.com/usememos/memos...
GO-2022-1081 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2022-0964 SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo
SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo...
GO-2022-0781 Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788) in github.com/goharbor/harbor
Harbor is vulnerable to a limited Server-Side Request Forgery SSRF CVE-2020-13788 in github.com/goharbor/harbor...
GO-2023-2115 CSRF token reuse vulnerability in github.com/gofiber/fiber/v2
A cross-site request forgery vulnerability in this package can allow an attacker to inject arbitrary values and forge malicious requests on behalf of a user. The attacker may inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated use...
GO-2021-0163 Privilege escalation on Windows via malicious DLL in syscall
Untrusted search path vulnerability on Windows related to LoadLibrary allows local users to gain privileges via a malicious DLL in the current working directory...
GO-2020-0024 Infinite loop in github.com/btcsuite/go-socks
The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow...
GO-2020-0048 Denial of service in github.com/antchfx/xmlquery
LoadURL does not check the Content-Type of loaded resources, which can cause a panic due to nil pointer deference if the loaded resource is not XML. If user supplied URLs are loaded, this may be used as a denial of service vector...
GO-2022-0500 CloudCore UDS Server: Malicious Message can crash CloudCore in github.com/kubeedge/kubeedge
CloudCore UDS Server: Malicious Message can crash CloudCore in github.com/kubeedge/kubeedge...
GO-2023-1993 Helm Improper Certificate Validation in helm.sh/helm
Helm Improper Certificate Validation in helm.sh/helm...
GO-2024-2764 Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them in github.com/rancher/rancher
Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them in github.com/rancher/rancher...
GO-2023-1600 Arbitrary code execution in github.com/kitabisa/teler-waf
Improper handling of payload with special characters, such as CR/LF and horizontal tab, can lead to execution of arbitrary JavaScript code...
GO-2022-0220 DLL injection on Windows in runtime and syscall
Go on Windows misused certain LoadLibrary functionality, leading to DLL injection...
GO-2021-0095 Sensitive information exposure in github.com/google/go-tpm
Due to repeated usage of a XOR key an attacker that can eavesdrop on the TPM 1.2 transport is able to calculate usageAuth for keys created using CreateWrapKey, despite it being encrypted, allowing them to use the created key...
GO-2020-0033 Path Traversal in aahframe.work
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2024-3215 Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana
Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3076 Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog
Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog...
GO-2022-1189 usememos/memos vulnerable to stored cross-site scripting (XSS) in github.com/usememos/memos
usememos/memos vulnerable to stored cross-site scripting XSS in github.com/usememos/memos...
GO-2022-1200 Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go
Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go...
GO-2023-2023 Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker
Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker...
GO-2023-2038 Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos...
GO-2023-1871 SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb...
GO-2023-1670 Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd
Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd...
GO-2023-1657 Answer has Guessable CAPTCHA in github.com/answerdev/answer
Answer has Guessable CAPTCHA in github.com/answerdev/answer...
GO-2023-1512 Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd
Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd...
GO-2023-1552 Answer has Cross-site Scripting vulnerability in github.com/answerdev/answer
Answer has Cross-site Scripting vulnerability in github.com/answerdev/answer...
GO-2024-3045 Meshery SQL Injection vulnerability in github.com/layer5io/meshery
Meshery SQL Injection vulnerability in github.com/layer5io/meshery...
GO-2024-2987 Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper
Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper...
GO-2024-2974 Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos
Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos...
GO-2024-2488 HashiCorp Vault Authentication bypass in github.com/hashicorp/vault
HashiCorp Vault Authentication bypass in github.com/hashicorp/vault...
GO-2024-2432 CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs
CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2023-1546 Denial of service in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
The otelhttp package of opentelemetry-go-contrib is vulnerable to a denial-of-service attack. The otelhttp package uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.requestcontentlength, http.server.responsecontentlength, and http.server.duration...
GO-2023-1621 Incorrect calculation on P256 curves in crypto/internal/nistec
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...
GO-2023-1566 Cross site scripting in github.com/usememos/memos
A malicious actor can introduce links starting with a "javascript:" scheme due to insufficient checks on external resources. This can be used as a part of Cross-site Scripting XSS attack...
GO-2024-3103 Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor
Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor...