4632 matches found
GO-2022-0708 Arbitrary File Override in Docker Engine in github.com/docker/docker
Arbitrary File Override in Docker Engine in github.com/docker/docker...
GO-2022-0620 HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault
HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault...
GO-2022-0591 Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad
Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad...
GO-2022-0547 aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator
aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator...
GO-2022-0556 OS Command Injection in file editor in Gogs in gogs.io/gogs
OS Command Injection in file editor in Gogs in gogs.io/gogs...
GO-2022-0498 Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd
Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd...
GO-2022-0304 Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd
Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd...
GO-2023-2330 Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...
GO-2023-2069 Croc may expose secret to local users in github.com/schollz/croc
Croc may expose secret to local users in github.com/schollz/croc...
GO-2023-2072 Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc
Cros secrets may be disclosed to untrusted relay in github.com/schollz/croc...
GO-2023-2078 Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium
Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium...
GO-2023-1959 Kubernetes arbitrary file overwrite in k8s.io/kubernetes
Kubernetes arbitrary file overwrite in k8s.io/kubernetes...
GO-2023-1977 Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes
Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes...
GO-2023-1922 Gitea XSS Vulnerability in code.gitea.io/gitea
Gitea XSS Vulnerability in code.gitea.io/gitea...
GO-2023-1864 Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes
Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes...
GO-2023-1764 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen...
GO-2023-1707 HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation in github.com/hashicorp/nomad
HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation in github.com/hashicorp/nomad...
GO-2023-1629 Kubernetes vulnerable to validation bypass in k8s.io/kubernetes
Kubernetes vulnerable to validation bypass in k8s.io/kubernetes...
GO-2023-1628 Kubernetes vulnerable to path traversal in k8s.io/kubernetes
Kubernetes vulnerable to path traversal in k8s.io/kubernetes...
GO-2023-1469 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2024-3039 Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean
Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean...
GO-2024-2984 Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2
Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2...
GO-2024-2972 Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs
Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs...
GO-2024-2512 Classic builder cache poisoning in github.com/docker/docker
Classic builder cache poisoning in github.com/docker/docker...
GO-2024-2528 Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd
Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd...
GO-2024-2941 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik...
GO-2024-2755 Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes
Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes...
GO-2024-2697 Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana
Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2880 Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik...
GO-2024-2856 Grafana Race condition allowing privilege escalation in github.com/grafana/grafana
Grafana Race condition allowing privilege escalation in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2024-2727 Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation
Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation...
GO-2024-2703 Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia...
GO-2024-2694 Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go
Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go...
GO-2024-2490 Path traversal in github.com/anchore/stereoscope
It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory...
GO-2024-2451 IV collision in github.com/bincyber/go-sqlcrypter
There is a risk of an IV collision using the awskms or aesgcm provider. NIST SP 800-38D section 8.3 states that it is unsafe to encrypt more than 2^32 plaintexts under the same key when using a random IV. The limit could easily be reached given the use case of database column encryption...
GO-2024-2471 Chain halt panic in github.com/cometbft/cometbft
A vulnerability in CometBFT’s validation logic for VoteExtensionsEnableHeight can result in a chain halt when triggered through a governance parameter change proposal on an ABCI2 Application Chain. If a parameter change proposal including a VoteExtensionsEnableHeight modification is passed, nodes...
GO-2024-2469 Kyberslash timing attack possible in github.com/kudelskisecurity/crystals-go
Kyberslash timing attack possible in github.com/kudelskisecurity/crystals-go...
GO-2023-2333 Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark
Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark...
GO-2023-1535 Panic during unmarshal of Server Hello in github.com/pion/dtls/v2
Unmarshalling a Server Hello can panic, which could allow a denial of service...
GO-2022-0503 Denial of service via malformed CAR data in github.com/ipld/go-car and go-car/v2
Decoding malformed CAR data can cause panics or excessive memory usage...
GO-2022-0251 Panic on NUL character in ROA in github.com/cloudflare/cfrpki
OctoRPKI crashes when a repository returns an invalid ROA that is only an encoded NUL character \0...
GO-2022-0233 Resource exhaustion in github.com/pires/go-proxyproto
The PROXY protocol server does not impose a timeout on reading the header from new connections, allowing a malicious client to cause resource exhaustion and a denial of service by opening many connections and sending no data on them. v0.6.0 of the proxyproto package adds support for a user-define...
GO-2022-0563 Cross-site request forgery in github.com/filebrowser/filebrowser/v2
A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim...
GO-2020-0006 Denial of service via open idle connection in github.com/miekg/dns
An attacker may prevent TCP connections to a Server by opening a connection and leaving it idle, until the connection is closed by the server no other connections will be accepted...
GO-2020-0014 Infinite loop due to improper handling of "select" tags in golang.org/x/net/html
html.Parse does not properly handle "select" tags, which can lead to an infinite loop. If parsing user supplied input, this may be used as a denial of service vector...
GO-2021-0097 Panic due to out-of-bounds read in github.com/dhowden/tag
Due to improper bounds checking, a number of methods can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack...
GO-2026-6473 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel
ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2026-6454 Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik...
GO-2026-6388 SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) in github.com/siyuan-note/siyuan/kernel
SiYuan: Password protected tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password publish mode in github.com/siyuan-note/siyuan/kernel...
GO-2026-6411 MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox...