3742 matches found
GO-2024-3233 Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server
Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server...
GO-2024-3239 NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability in github.com/NVIDIA/nvidia-container-toolkit
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use TOCTOU vulnerability in github.com/NVIDIA/nvidia-container-toolkit...
GO-2024-3234 Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server...
GO-2024-3235 Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server
Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server...
GO-2024-3246 Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault
Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault...
GO-2024-3245 Ollama Out-of-bounds Read in github.com/ollama/ollama
Ollama Out-of-bounds Read in github.com/ollama/ollama...
GO-2024-3244 Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark
Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark...
GO-2024-3232 Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server
Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server...
GO-2024-3230 Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno
Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno...
GO-2024-3228 Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
Coder vulnerable to post-auth URL redirection to untrusted site 'Open Redirect' in github.com/coder/coder...
GO-2024-3227 Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server
Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server...
GO-2024-3226 Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows
Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows...
GO-2024-3224 Missing key verification in gost in github.com/ginuerzh/gost
Missing key verification in gost in github.com/ginuerzh/gost...
GO-2024-3212 AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller
AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2024-3222 RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rke2
RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rke2. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2024-3216 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3207 Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito
Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito...
GO-2024-3211 Graphql: information disclosure via graphql introspection in openshift in github.com/openshift/console
Graphql: information disclosure via graphql introspection in openshift in github.com/openshift/console...
GO-2024-3217 User Registration Bypass in Zitadel in github.com/zitadel/zitadel
User Registration Bypass in Zitadel in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3213 Plenti arbitrary file write vulnerability in github.com/plentico/plenti
Plenti arbitrary file write vulnerability in github.com/plentico/plenti...
GO-2024-3223 Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher
Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3208 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium...
GO-2024-3215 Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana
Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3220 Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher
Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-3219 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses...
GO-2024-3204 VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder
VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder...
GO-2024-3203 VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder
VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder...
GO-2024-3189 Consensus failure in github.com/btcsuite/btcd
The btcd Bitcoin client versions 0.10 to 0.24 did not correctly re-implement Bitcoin Core's 'FindAndDelete' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split accepting an invalid block or Denial of Service DoS attacks rejecting a valid block...
GO-2024-3196 Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. in github.com/codeclysm/extract
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. in github.com/codeclysm/extract...
GO-2024-3200 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb...
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-3201 JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector
JWT token compromise can allow malicious actions including Remote Code Execution RCE in github.com/neuvector/neuvector...
GO-2024-3171 Link Following in github.com/containers/common
Link Following in github.com/containers/common...
GO-2024-3190 Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist
Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist...
GO-2024-3188 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd...
GO-2024-3185 XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready
XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready...
GO-2024-3184 Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome
Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome...
GO-2024-3186 Buildah allows arbitrary directory mount in github.com/containers/buildah
Buildah allows arbitrary directory mount in github.com/containers/buildah...
GO-2024-3164 Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server
Mattermost fails to strip embeds from metadata when broadcasting posted events in github.com/mattermost/mattermost-server...
GO-2024-3175 Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju
Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2024-3181 PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd
PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd...
GO-2024-3174 Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju
Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju...
GO-2024-3170 Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/agent
Grafana Agent Flow mode on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/agent...
GO-2024-3179 Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium...
GO-2024-3163 Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle
Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3172 Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer
Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-3168 Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy
Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy...
GO-2024-3161 Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher
Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3167 Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...