4632 matches found
GO-2024-3218 Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht
Content Censorship in the InterPlanetary File System IPFS via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht...
GO-2024-3311 NULL Pointer Dereference on moby image history in github.com/moby/moby
NULL Pointer Dereference on moby image history in github.com/moby/moby...
GO-2024-3294 Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb
Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb...
GO-2024-3254 Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus
Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus...
GO-2024-3252 gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign...
GO-2024-3233 Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server
Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server...
GO-2024-3226 Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows
Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows...
GO-2024-3189 Consensus failure in github.com/btcsuite/btcd
The btcd Bitcoin client versions 0.10 to 0.24 did not correctly re-implement Bitcoin Core's 'FindAndDelete' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split accepting an invalid block or Denial of Service DoS attacks rejecting a valid block...
GO-2024-3185 XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready
XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready...
GO-2022-1151 Buildah (as part of Podman) vulnerable to Link Following in github.com/containers/podman
Buildah as part of Podman vulnerable to Link Following in github.com/containers/podman...
GO-2022-1006 Casdoor arbitrary file write vulnerability in github.com/casdoor/casdoor
Casdoor arbitrary file write vulnerability in github.com/casdoor/casdoor...
GO-2022-0928 Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows
Workflow re-write vulnerability using input parameter in github.com/argoproj/argo-workflows...
GO-2022-0886 Kubernetes Arbitrary Command Injection in k8s.io/kubernetes
Kubernetes Arbitrary Command Injection in k8s.io/kubernetes...
GO-2022-0854 Authorization bypass in Openshift in github.com/openshift/origin
Authorization bypass in Openshift in github.com/openshift/origin...
GO-2022-0823 Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea
Gitea Exposes Private Email Addresses in github.com/go-gitea/gitea...
GO-2022-0815 Improper input validation in umoci in github.com/opencontainers/umoci
Improper input validation in umoci in github.com/opencontainers/umoci...
GO-2022-0760 Ethermint vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos
Ethermint vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos...
GO-2022-0516 Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd
Argo CD improper access control bug can allow malicious user to escalate privileges to admin level in github.com/argoproj/argo-cd...
GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...
GO-2023-2066 NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server
NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server...
GO-2023-2080 Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium
Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium...
GO-2023-2063 HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault
HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault...
GO-2023-1985 Kubernetes in OpenShift3 Access Control Misconfiguration in k8s.io/kubernetes
Kubernetes in OpenShift3 Access Control Misconfiguration in k8s.io/kubernetes...
GO-2023-1965 Ineffective privileges drop when requesting container network in github.com/apptainer/apptainer
Ineffective privileges drop when requesting container network in github.com/apptainer/apptainer...
GO-2023-1995 Answer has Race Condition within a Thread in github.com/answerdev/answer
Answer has Race Condition within a Thread in github.com/answerdev/answer...
GO-2023-1888 1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel
1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel...
GO-2023-1865 Vega's validators able to submit duplicate transactions in code.vegaprotocol.io/vega
Vega's validators able to submit duplicate transactions in code.vegaprotocol.io/vega...
GO-2023-1899 Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad
Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables in github.com/hashicorp/nomad...
GO-2023-1785 Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium
Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium...
GO-2023-1809 go package pydio cells vulnerable to cross-site scripting in github.com/pydio/cells
go package pydio cells vulnerable to cross-site scripting in github.com/pydio/cells...
GO-2023-1671 Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process in tailscale.com
Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process in tailscale.com...
GO-2023-1644 Cilium eBPF filters may be temporarily removed during agent restart in github.com/cilium/cilium
Cilium eBPF filters may be temporarily removed during agent restart in github.com/cilium/cilium...
GO-2024-3033 Filestash configured to skip TLS certificate verification when using the FTPS protocol in github.com/mickael-kerjean/filestash
Filestash configured to skip TLS certificate verification when using the FTPS protocol in github.com/mickael-kerjean/filestash...
GO-2024-3019 soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve
soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve...
GO-2024-2994 Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes
Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes...
GO-2024-2592 Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server
Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2450 Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server
Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2550 MongoDB Tools Improper Certificate Validation vulnerability in github.com/mongodb/mongo-tools
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates. NOTE: this module uses its own versioning scheme that is not fully...
GO-2024-2445 Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport
Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2746 Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes...
GO-2024-2666 Insecure IPsec transparent encryption in github.com/cilium/cilium
Insecure IPsec transparent encryption in github.com/cilium/cilium...
GO-2024-2653 HTTP policy bypass in github.com/cilium/cilium
Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped...
GO-2023-2412 RAPL accessibility in github.com/containerd/containerd
RAPL accessibility in github.com/containerd/containerd...
GO-2023-2400 Escalation of privileges in github.com/sap/cloud-security-client-go
An unauthenticated attacker can obtain arbitrary permissions within the application under certain conditions...
GO-2023-1990 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size width height appearing to be zero...
GO-2023-1857 Panic when parsing ranges with invalid masks in github.com/malfunkt/iprange
Parsing a range with a mask larger than 32 bits causes a panic...
GO-2022-1053 Incorrect signatures in github.com/supranational/blst
Potential creation of an invalid signature from correct inputs. Some inputs to the blstfpeuclinverse function can produce incorrect outputs. This could theoretically permit the creation of an invalid signature from correct inputs...
GO-2021-0054 Panic due to improper input validation in ForEach in github.com/tidwall/gjson
Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector...
GO-2020-0046 Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig
Due to a nil pointer dereference, a malformed XML Digital Signature can cause a panic during validation. If user supplied signatures are being validated, this may be used as a denial of service vector...