4632 matches found
GO-2023-1620 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2024-3025 Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server
Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server...
GO-2024-2485 HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault...
GO-2024-2565 Use of Insufficiently Random Values in github.com/greenpau/caddy-security
Use of Insufficiently Random Values in github.com/greenpau/caddy-security...
GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd
Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd...
GO-2024-2901 Ollama does not validate the format of the digest (sha256 with 64 hex digits) in github.com/ollama/ollama
Ollama does not validate the format of the digest sha256 with 64 hex digits in github.com/ollama/ollama...
GO-2024-2795 Mattermost crashes web clients via a malformed custom status in github.com/mattermost/mattermost-server
Mattermost crashes web clients via a malformed custom status in github.com/mattermost/mattermost-server...
GO-2023-1595 Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistec
Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this...
GO-2021-0242 Panic on inputs with large exponents in math/big
Rat.SetString and Rat.UnmarshalText may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents...
GO-2020-0007 Improper input validation in github.com/seccomp/libseccomp-golang
Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments AND is used rather than OR. These filters can be bypassed by only specifying a subset of the arguments due to this behavior...
GO-2020-0022 Out-of-bounds write in github.com/cloudflare/golz4
LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input...
GO-2020-0031
Due to improper setting of finalizers, memory passed to C may be freed before it is used, leading to crashes due to memory corruption or possible code execution...
GO-2026-4801 Ory Kratos has a SQL injection via forged pagination tokens in github.com/ory/kratos
Ory Kratos has a SQL injection via forged pagination tokens in github.com/ory/kratos...
GO-2024-3203 VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder
VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder...
GO-2022-0857 Information Exposure in Kubernetes in github.com/kubernetes/kubernetes
Information Exposure in Kubernetes in github.com/kubernetes/kubernetes...
GO-2022-0813 Authentication bypass by capture-replay in github.com/cosmos/ethermint
Authentication bypass by capture-replay in github.com/cosmos/ethermint...
GO-2024-3070 SQL injection in github.com/stashapp/stash
SQL injection in github.com/stashapp/stash...
GO-2024-2968 ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel
ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2024-2961 Limited directory traversal vulnerability on Windows in golang.org/x/crypto
httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator \ vs. /, allowing a user to provide a relative path, i.e...
GO-2024-2914 Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker
Moby Docker Engine is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker...
GO-2024-2664 ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel
ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2747 Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo...
GO-2024-2600 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...
GO-2023-1569 Excessive resource consumption in mime/multipart
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request...
GO-2022-1008 Unauthorized file access in github.com/containers/buildah
SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other...
GO-2021-0317 Uncontrolled memory consumption in math/big
Rat.SetString had an overflow issue that can lead to uncontrolled memory consumption...
GO-2021-0228 Path traversal in github.com/unknwon/cae
The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...
GO-2020-0020 Improper access control in github.com/gorilla/handlers
Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy...
GO-2021-0064 Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go
Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level. This is due to an incomplete fix for CVE-2019-11250...
GO-2024-3087 Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor
Casdoor CORS misconfiguration GHSL-2024-035 in github.com/casdoor/casdoor...
GO-2022-1264 usememos/memos has Incorrectly Specified Destination in a Communication Channel in github.com/usememos/memos
usememos/memos has Incorrectly Specified Destination in a Communication Channel in github.com/usememos/memos...
GO-2022-1212 pastebinit Path Traversal vulnerability in github.com/jessfraz/pastebinit
pastebinit Path Traversal vulnerability in github.com/jessfraz/pastebinit...
GO-2022-1153 Casdoor arbitrary file deletion vulnerability via uploadFile function in github.com/casdoor/casdoor
Casdoor arbitrary file deletion vulnerability via uploadFile function in github.com/casdoor/casdoor...
GO-2023-2135 Artifact Hub has Incorrect Docker Hub registry check in github.com/artifacthub/hub
Artifact Hub has Incorrect Docker Hub registry check in github.com/artifacthub/hub...
GO-2023-1938 Helm Unsafe Link Following in helm.sh/helm
Helm Unsafe Link Following in helm.sh/helm...
GO-2023-1896 Zinc Cross-site Scripting vulnerability in github.com/zinclabs/zinc
Zinc Cross-site Scripting vulnerability in github.com/zinclabs/zinc...
GO-2024-3063 RBAC Roles for `etcd` created by Kamaji are not disjunct in github.com/clastix/kamaji
RBAC Roles for etcd created by Kamaji are not disjunct in github.com/clastix/kamaji...
GO-2024-3013 Harbor fails to validate the user permissions when updating project configurations in github.com/goharbor/harbor
Harbor fails to validate the user permissions when updating project configurations in github.com/goharbor/harbor...
GO-2024-2564 Improper Validation of Array Index in github.com/greenpau/caddy-security
Improper Validation of Array Index in github.com/greenpau/caddy-security...
GO-2024-2655 XSS in github.com/zitadel/zitadel
The Login UI did not sanitize input parameters. An attacker could create a malicious link, where injected code would be rendered as part of the login screen...
GO-2023-2334 Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service...
GO-2022-1095 Unsanitized NUL in environment variables on Windows in syscall and os/exec
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavi...
GO-2022-1002 Panic in github.com/pandatix/go-cvss
ParseVector can panic when provided with invalid input...
GO-2022-0422 Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb
The dag-pb codec can panic when decoding invalid blocks...
GO-2022-0444 Version rollback attack in github.com/theupdateframework/go-tuf
The TUF client is vulnerable to rollback attacks, in which an attacker causes a client to install software older than the software the client previously knew to be available...
GO-2022-0247 Buffer overflow in WASM modules in misc/wasm and cmd/link
When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments due to a buffer overflow error. If using wasmexec.js to execute WASM modules, users will need to replace their...
GO-2021-0347 Stack exhaustion when compiling deeply nested expressions in regexp
On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB...
GO-2021-0143
When a Handler does not explicitly set the Content-Type header, the net/http/cgi and net/http/fcgi packages default to "text/html", which can cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response...
GO-2020-0037 Uncontrolled resource consumption in github.com/tendermint/tendermint
Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector...
GO-2026-6605 HTTP/1 client connection desynchronization after CONNECT rejection in net/http
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...