4112 matches found
GO-2025-3472 SSRF in sliver teamserver in github.com/bishopfox/sliver
SSRF in sliver teamserver in github.com/bishopfox/sliver...
GO-2025-3491 Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher
Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2022-1216 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2022-0971 Elrond-go has improper initialization in github.com/ElrondNetwork/elrond-go
Elrond-go has improper initialization in github.com/ElrondNetwork/elrond-go...
GO-2023-2067 Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input in github.com/contribsys/faktory
Faktory Web Dashboard can lead to denial of serviceDOS via malicious user input in github.com/contribsys/faktory...
GO-2023-1971 Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea
Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea...
GO-2023-1961 Minikube RCE via DNS Rebinding in k8s.io/minikube
Minikube RCE via DNS Rebinding in k8s.io/minikube...
GO-2023-1973 Rancher Access Control Vulnerability in github.com/rancher/rancher
Rancher Access Control Vulnerability in github.com/rancher/rancher...
GO-2023-1560 Path Traversal in gin-vue-admin in github.com/flipped-aurora/gin-vue-admin
Path Traversal in gin-vue-admin in github.com/flipped-aurora/gin-vue-admin...
GO-2024-2938 LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI
LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2024-2866 Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator
Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator...
GO-2024-2830 Arbitrary file write in github.com/1Panel-dev/1Panel
A maliciously crafted packet can write to an arbitrary file...
GO-2024-2602 Incorrect email domain verification in github.com/coder/coder
A vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider such as public...
GO-2022-1188 Uncontrolled memory allocation in code.sajari.com/docconv
An attacker can remotely supply a specially crafted input that causes uncontrolled memory allocation...
GO-2022-0761 Improper input validation in net/http and net/http/cgi
An input validation flaw in the CGI components allows the HTTPPROXY environment variable to be set by the incoming Proxy header, which changes where Go by default proxies all outbound HTTP requests. This environment variable is also used to set the outgoing proxy, enabling an attacker to insert a...
GO-2020-0002
The Data, Context, or Key finalizers might run during or before GPGME operations. This will release the C structures that are still in use, leading to crashes and potentially code execution through a use-after-free...
GO-2020-0041 Path Traversal in github.com/unknwon/cae
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2020-0032 Path traversal in github.com/goadesign/goa
Due to improper sanitization of user input, Controller.FileHandler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2024-3131 SpiceDB having multiple caveats on resources of the same type may improperly result in no permission in github.com/authzed/spicedb
SpiceDB having multiple caveats on resources of the same type may improperly result in no permission in github.com/authzed/spicedb...
GO-2022-0626 Insufficient Session Expiration in Kiali in github.com/kiali/kiali
Insufficient Session Expiration in Kiali in github.com/kiali/kiali...
GO-2024-2943 Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service in github.com/lightningnetwork/lnd
Lightning Network Daemon LND's onion processing logic leads to a denial of service in github.com/lightningnetwork/lnd...
GO-2024-2934 Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder
Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder...
GO-2024-2861 azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver
azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver...
GO-2024-2702 Code injection vulnerability in github.com/flipped-aurora/gin-vue-admin/server
Gin-vue-admin has a code injection vulnerability in the backend. In the Plugin System - Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service',...
GO-2023-1987 Large RSA keys can cause high CPU usage in crypto/tls
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...
GO-2023-1874 Denial of service in github.com/corazawaf/coraza/v2 and v3
Due to the misuse of log.Fatalf, Coraza may crash after receiving crafted requests from attackers...
GO-2023-1840 Unsafe behavior in setuid/setgid binaries in runtime
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I...
GO-2023-1558 Denial of service via malformed size parameters in github.com/ipfs/go-bitfield
When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happens when the size is a not a multiple of 8 or is negative. A workaround is to ensure size%8 == 0 && size = 0 yourself before calling NewBitfield or FromBytes...
GO-2023-1519 Command injection in github.com/rancher/wrangler
A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host. A workaround is to sanitize input passed...
GO-2022-0979 Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolver
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for...
GO-2022-0201 Remote command execution via "go get" command with cgo in cmd/go
The "go get" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature. When cgo is enabled, the build step during "go get" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support ...
GO-2022-0519 Improper validation of access tokens in github.com/flyteorg/flyteadmin
Improper validation of access tokens can permit use of expired tokens...
GO-2022-0187 Incorrect computation for P-256 curves in crypto/elliptic
The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads ...
GO-2022-0586 Resource exhaustion in github.com/hashicorp/go-getter and related modules
Malicious HTTP responses can cause a number of misbehaviors, including overwriting local files, resource exhaustion, and panics. Protocol switching, endless redirect, and configuration bypass are possible through abuse of custom HTTP response header processing. Arbitrary host access is possible...
GO-2022-0289 Misdirected I/O in syscall
When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec including indirectly by using the os/exec package, syscall.ForkExec can close file descriptor 0 as it fails. If this happens or can be provoked repeatedly, it can result in misdirected I/O such as...
GO-2021-0240 Panic when reading certain archives in archive/zip
NewReader and OpenReader can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size...
GO-2020-0017 Authorization bypass in github.com/dgrijalva/jwt-go
If a JWT contains an audience claim with an array of strings, rather than a single string, and MapClaims.VerifyAudience is called with req set to false, then audience verification will be bypassed, allowing an invalid set of audiences to be provided...
GO-2020-0009 Integer overflow in github.com/square/go-jose
On 32-bit platforms an attacker can manipulate a ciphertext encrypted with AES-CBC with HMAC such that they can control how large the input buffer is when computing the HMAC authentication tag. This can can allow a manipulated ciphertext to be verified as authentic, opening the door for padding...
GO-2025-3959 Mattermost makes Use of Weak Hash in github.com/mattermost/mattermost-server
Mattermost makes Use of Weak Hash in github.com/mattermost/mattermost-server...
GO-2024-3092 Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server
Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server...
GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server
Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server...
GO-2022-0783 JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium
JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium...
GO-2022-0480 Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o
Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o...
GO-2023-2097 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve...
GO-2023-1806 mx-chain-go does not treat invalid transaction with wrong username correctly in github.com/multiversx/mx-chain-go
mx-chain-go does not treat invalid transaction with wrong username correctly in github.com/multiversx/mx-chain-go...
GO-2024-3047 memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos
memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos...
GO-2024-3025 Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server
Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server...
GO-2024-2433 CubeFS leaks magic secret key when starting Blobstore access service in github.com/cubefs/cubefs
CubeFS leaks magic secret key when starting Blobstore access service in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...