4632 matches found
GO-2024-3357 Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome
Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome...
GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator
The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...
GO-2024-3314 Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo...
GO-2024-3304 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2024-3300 sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo
sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo...
GO-2024-3291 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs...
GO-2024-3208 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium...
GO-2024-3179 Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium...
GO-2024-3116 sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go
sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go...
GO-2024-3082 CWA-2024-005: Stackoverflow in wasmd in github.com/CosmWasm/wasmd
CWA-2024-005: Stackoverflow in wasmd in github.com/CosmWasm/wasmd...
GO-2022-0887 Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap
Access Restriction Bypass in go-ldap in github.com/go-ldap/ldap...
GO-2022-0833 Denial of Service in docker2aci in github.com/appc/docker2aci
Denial of Service in docker2aci in github.com/appc/docker2aci...
GO-2022-0803 containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd
containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd...
GO-2022-0705 Directory Traversal in Docker in github.com/docker/docker
Directory Traversal in Docker in github.com/docker/docker...
GO-2022-0770 Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad
Path Traversal in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0630 Arbitrary Code Execution in Docker in github.com/docker/docker
Arbitrary Code Execution in Docker in github.com/docker/docker...
GO-2022-0495 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd
DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd...
GO-2022-0440 Woodpecker allows cross-site scripting (XSS) via build logs in github.com/woodpecker-ci/woodpecker
Woodpecker allows cross-site scripting XSS via build logs in github.com/woodpecker-ci/woodpecker...
GO-2022-0314 Cross-site Scripting in Gitea in github.com/go-gitea/gitea
Cross-site Scripting in Gitea in github.com/go-gitea/gitea...
GO-2022-0278 Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux in github.com/containerd/containerd
Unprivileged pod using hostPath can side-step active LSM when it is SELinux in github.com/containerd/containerd...
GO-2022-0250 Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki
Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki...
GO-2023-2088 Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability in github.com/hashicorp/vault...
GO-2023-1972 Gogs XSS Vulnerability in gogs.io/gogs
Gogs XSS Vulnerability in gogs.io/gogs...
GO-2023-1718 Answer vulnerable to Exposure of Sensitive Information Through Metadata in github.com/answerdev/answer
Answer vulnerable to Exposure of Sensitive Information Through Metadata in github.com/answerdev/answer...
GO-2023-1658 Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
Answer vulnerable to Business Logic Errors in github.com/answerdev/answer...
GO-2023-1622 Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation
Constellation allows Emergency shell access during initramfs boot phase in github.com/edgelesssys/constellation...
GO-2024-3006 The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd
The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd...
GO-2024-3009 snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd
snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2476 Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2941 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik...
GO-2024-2699 Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama
Ollama DNS rebinding vulnerability in github.com/jmorganca/ollama...
GO-2024-2468 snapd Race Condition vulnerability in github.com/snapcore/snapd
snapd Race Condition vulnerability in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2660 Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl
Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack...
GO-2023-1788 Incorrect permissions in github.com/goreleaser/nfpm/v2
When nfpm packages files without additional configuration to enforce its own permissions, the files could be packaged with incorrect permissions chmod 666 or 777. Anyone who uses nfpm to create packages and does not check or set file permissions before packaging could result in files or folders...
GO-2022-0251 Panic on NUL character in ROA in github.com/cloudflare/cfrpki
OctoRPKI crashes when a repository returns an invalid ROA that is only an encoded NUL character \0...
GO-2022-0233 Resource exhaustion in github.com/pires/go-proxyproto
The PROXY protocol server does not impose a timeout on reading the header from new connections, allowing a malicious client to cause resource exhaustion and a denial of service by opening many connections and sending no data on them. v0.6.0 of the proxyproto package adds support for a user-define...
GO-2022-0461 Unbounded memory consumption in github.com/pion/dtls/v2
Attacker can cause unbounded memory consumption. The Pion DTLS client and server buffer handshake data with no upper limit, permitting an attacker to cause unbounded memory consumption by sending an unterminated handshake...
GO-2022-0563 Cross-site request forgery in github.com/filebrowser/filebrowser/v2
A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim...
GO-2021-0084 Incorrect permissions for critical resource in github.com/astaxie/beego
Session data is stored using permissive permissions, allowing local users with filesystem access to read arbitrary data...
GO-2026-6395 SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) in github.com/siyuan-note/siyuan/kernel
SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles publish mode in github.com/siyuan-note/siyuan/kernel...
GO-2026-6402 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel
SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle in github.com/siyuan-note/siyuan/kernel...
GO-2026-6237 Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp
In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in ...
GO-2026-6181 Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone
Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone...
GO-2026-6224 Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API in github.com/kubev2v/migration-planner
Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API in github.com/kubev2v/migration-planner...
GO-2026-6229 Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs in github.com/kubev2v/migration-planner
Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs in github.com/kubev2v/migration-planner...
GO-2026-6097 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account in github.com/cloudreve/Cloudreve
Cloudreve: Path Traversal in WOPI PUTRELATIVE Allows Arbitrary File Creation in Owner Account in github.com/cloudreve/Cloudreve...
GO-2026-6137 goshs has a Path Traversal issue in github.com/patrickhener/goshs
goshs has a Path Traversal issue in github.com/patrickhener/goshs...
GO-2026-6075 Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea
Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea...
GO-2026-6085 Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev
Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...
GO-2026-5886 GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber...