3742 matches found
GO-2024-3268 Harbor fails to validate the user permissions when updating p2p preheat policies in github.com/goharbor/harbor
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in oth...
GO-2024-3325 kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp...
GO-2024-3323 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel...
GO-2024-3324 SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel
SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel...
GO-2024-3327 SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel...
GO-2024-3326 SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel...
GO-2024-3248 KubeSphere IDOR vulnerability in github.com/kubesphere/kubesphere
An Insecure Direct Object Reference IDOR vulnerability in KubeSphere allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. NOTE: A fix is expected in v4.1.3 in January 2025...
GO-2024-3218 Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht
Content Censorship in the InterPlanetary File System IPFS via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht...
GO-2024-3205 Infinite loop in github.com/gomarkdown/markdown
Infinite loop in github.com/gomarkdown/markdown...
GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
GO-2024-3314 Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo...
GO-2024-3315 CVE-2024-46455 in github.com/Unstructured-IO/unstructured
CVE-2024-46455 in github.com/Unstructured-IO/unstructured...
GO-2024-3311 NULL Pointer Dereference on moby image history in github.com/moby/moby
NULL Pointer Dereference on moby image history in github.com/moby/moby...
GO-2024-3312 CA certificate sign check bypass in github.com/canonical/lxd
CA certificate sign check bypass in github.com/canonical/lxd...
GO-2024-3308 Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) in github.com/kolide/launcher
Kolide Agent Privilege Escalation Windows, Versions = 1.5.3, 1.12.3 in github.com/kolide/launcher...
GO-2024-3307 CVE-2024-50948 in github.com/mochi-mqtt/server
CVE-2024-50948 in github.com/mochi-mqtt/server...
GO-2024-3292 CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o
CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o...
GO-2024-3304 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2024-3305 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2024-3299 Traefik's X-Forwarded-Prefix Header still allows for Open Redirect in github.com/traefik/traefik
Traefik's X-Forwarded-Prefix Header still allows for Open Redirect in github.com/traefik/traefik...
GO-2024-3294 Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb
Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb...
GO-2024-3296 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli...
GO-2024-3303 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows
Argo Workflows Allows Access to Archived Workflows with Fake Token in client mode in github.com/argoproj/argo-workflows...
GO-2024-3300 sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo
sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo...
GO-2024-3287 Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer
Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer...
GO-2024-3289 OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console
OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console...
GO-2024-3284 PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb
PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3286 Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes
Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes...
GO-2024-3290 Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium...
GO-2024-3282 Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager
Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager...
GO-2024-3279 Mismatched bit-length validation in can lead to panic in cosmossdk.io/math
Mismatched bit-length validation in can lead to panic in cosmossdk.io/math...
GO-2024-3280 Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher
Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3122 Groth16 commitment extension unsound for more than one commitment in github.com/consensys/gnark
Groth16 commitment extension unsound for more than one commitment in github.com/consensys/gnark...
GO-2024-3265 Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis
Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis...
GO-2024-3259 CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft...
GO-2024-3140 Grafana plugin SDK Information Leakage in github.com/grafana/grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running "git remote get-url origin". If credentials are included in the repository URI for instance, to allow for fetching of private...
GO-2024-3278 Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines
Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines...
GO-2024-3274 Stored XSS using two files in usememos/memos in github.com/usememos/memos
Stored XSS using two files in usememos/memos in github.com/usememos/memos...
GO-2024-3277 Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes...
GO-2024-3272 CVE-2024-24425 in github.com/magma/magma
CVE-2024-24425 in github.com/magma/magma...
GO-2024-3269 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli...
GO-2024-3267 Zoraxy has an authenticated command injection in the Web SSH feature in github.com/tobychui/zoraxy
Zoraxy has an authenticated command injection in the Web SSH feature in github.com/tobychui/zoraxy. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3250 Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt
Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt...
GO-2024-3262 Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad
Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad...
GO-2024-3260 Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron
Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron...
GO-2024-3252 gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign...
GO-2024-3251 Safearchive Path Traversal vulnerability in github.com/google/safearchive
Safearchive Path Traversal vulnerability in github.com/google/safearchive...
GO-2024-3253 LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI
LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI...
GO-2024-3242 Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul
Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul...
GO-2024-3237 NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit
NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit...