4632 matches found
GO-2021-0239 Improper sanitization when resolving values from DNS in net
The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for...
GO-2020-0033 Path Traversal in aahframe.work
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2021-0095 Sensitive information exposure in github.com/google/go-tpm
Due to repeated usage of a XOR key an attacker that can eavesdrop on the TPM 1.2 transport is able to calculate usageAuth for keys created using CreateWrapKey, despite it being encrypted, allowing them to use the created key...
GO-2024-3076 Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog
Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog...
GO-2022-1218 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1135 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule
Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule...
GO-2023-2036 usememos/memos vulnerable to privilege escalation in github.com/usememos/memos
usememos/memos vulnerable to privilege escalation in github.com/usememos/memos...
GO-2023-1871 SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb...
GO-2023-1670 Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd
Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd...
GO-2023-1552 Answer has Cross-site Scripting vulnerability in github.com/answerdev/answer
Answer has Cross-site Scripting vulnerability in github.com/answerdev/answer...
GO-2024-3045 Meshery SQL Injection vulnerability in github.com/layer5io/meshery
Meshery SQL Injection vulnerability in github.com/layer5io/meshery...
GO-2024-2987 Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper
Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper...
GO-2024-2974 Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos
Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos...
GO-2024-2432 CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs
CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2784 Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher
Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher...
GO-2024-2775 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax
IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...
GO-2023-2044 Panic when processing post-handshake message on QUIC connections in crypto/tls
Processing an incomplete post-handshake message for a QUIC connection can cause a panic...
GO-2023-1546 Denial of service in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
The otelhttp package of opentelemetry-go-contrib is vulnerable to a denial-of-service attack. The otelhttp package uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.requestcontentlength, http.server.responsecontentlength, and http.server.duration...
GO-2024-3215 Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana
Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2022-1189 usememos/memos vulnerable to stored cross-site scripting (XSS) in github.com/usememos/memos
usememos/memos vulnerable to stored cross-site scripting XSS in github.com/usememos/memos...
GO-2022-1200 Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go
Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go...
GO-2022-1132 Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information in github.com/grafana/synthetic-monitoring-agent
Grafana's default installation of synthetic-monitoring-agent exposes sensitive information in github.com/grafana/synthetic-monitoring-agent...
GO-2023-2023 Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker
Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker...
GO-2023-2038 Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos...
GO-2023-1657 Answer has Guessable CAPTCHA in github.com/answerdev/answer
Answer has Guessable CAPTCHA in github.com/answerdev/answer...
GO-2023-1512 Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd
Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd...
GO-2024-3046 memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos
memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos...
GO-2024-2488 HashiCorp Vault Authentication bypass in github.com/hashicorp/vault
HashiCorp Vault Authentication bypass in github.com/hashicorp/vault...
GO-2024-2483 Grafana XSS via adding a link in General feature in github.com/grafana/grafana
Grafana XSS via adding a link in General feature in github.com/grafana/grafana...
GO-2024-2637 Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel
Account Takeover via Session Fixation in Zitadel Bypassing MFA in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2885 Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder
Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder...
GO-2023-1621 Incorrect calculation on P256 curves in crypto/internal/nistec
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...
GO-2023-1566 Cross site scripting in github.com/usememos/memos
A malicious actor can introduce links starting with a "javascript:" scheme due to insufficient checks on external resources. This can be used as a part of Cross-site Scripting XSS attack...
GO-2022-1117 Insufficient verification of proofs in github.com/codenotary/immudb
In certain scenarios, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of...
GO-2022-1144 Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate...
GO-2021-0319 Incorrect computation for some invalid field elements in crypto/elliptic
Some big.Int values that are not valid field elements negative or overflowing might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values...
GO-2024-3103 Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor
Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor...
GO-2024-3078 LF Edge eKuiper has a SQL Injection in sqlKvStore in github.com/lf-edge/ekuiper
LF Edge eKuiper has a SQL Injection in sqlKvStore in github.com/lf-edge/ekuiper...
GO-2022-1244 usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts in github.com/usememos/memos
usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts in github.com/usememos/memos...
GO-2022-1217 usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos
usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos...
GO-2023-1377 GitOps Run allows for Kubernetes workload injection in github.com/weaveworks/weave-gitops
GitOps Run allows for Kubernetes workload injection in github.com/weaveworks/weave-gitops...
GO-2024-3075 CVE-2024-7646 in github.com/kubernetes/ingress-nginx
CVE-2024-7646 in github.com/kubernetes/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2024-3049 memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos
memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos...
GO-2024-2434 CubeFS leaks users key in logs in github.com/cubefs/cubefs
CubeFS leaks users key in logs in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit t...
GO-2024-2642 Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings...
GO-2024-2670 ACL security vulnerability in github.com/hashicorp/nomad
An ACL policy using a block without label can be applied to unexpected resources in Nomad, a distributed, highly available scheduler designed for effortless operations and management of applications...
GO-2022-1052 Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint
Mishandling of timestamps during consensus process can cause a denial of service. While reaching consensus, different tendermint nodes can observe a different timestamp for a consensus evidence. This mismatch can cause the evidence to be invalid, upon which the node producing the evidence will be...
GO-2022-0761 Improper input validation in net/http and net/http/cgi
An input validation flaw in the CGI components allows the HTTPPROXY environment variable to be set by the incoming Proxy header, which changes where Go by default proxies all outbound HTTP requests. This environment variable is also used to set the outgoing proxy, enabling an attacker to insert a...
GO-2022-0400 Race condition in github.com/ntbosscher/gobase
A race condition can cause incorrect HTTP request routing...
GO-2022-0213 Panic on invalid DSA public keys in crypto/dsa
Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server tha...