4046 matches found
GO-2025-3384 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2025-3382 notation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go
notation-go has an OS error when setting CRL cache leads to denial of signature verification in github.com/notaryproject/notation-go...
GO-2025-3381 notation-go's timestamp signature generation lacks certificate revocation check in github.com/notaryproject/notation-go
notation-go's timestamp signature generation lacks certificate revocation check in github.com/notaryproject/notation-go...
GO-2025-3379 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server
Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2025-3376 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset
JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset...
GO-2025-3377 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server
Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2025-3374 Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve
Soft Serve vulnerable to path traversal attacks in github.com/charmbracelet/soft-serve...
GO-2025-3371 WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal
WireGuard Portal v2 Vulnerable to OAuth Insecure Redirect URI / Account Takeover in github.com/h44z/wg-portal. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...
GO-2025-3368 Argument Injection via the URL field in github.com/go-git/go-git
Argument Injection via the URL field in github.com/go-git/go-git...
GO-2025-3367 Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git
Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git...
GO-2025-3361 GoPhish sends cleartext passwords in github.com/gophish/gophish
GoPhish sends cleartext passwords in github.com/gophish/gophish...
GO-2024-3356 Path Traversal in file update API in gogs in gogs.io/gogs
Path Traversal in file update API in gogs in gogs.io/gogs...
GO-2025-3363 Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada
Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada...
GO-2024-3359 GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast
GoCast OS Command Injection vulnerability in github.com/mayuresh82/gocast...
GO-2024-3355 Remote Command Execution in file editing in gogs in gogs.io/gogs
Remote Command Execution in file editing in gogs in gogs.io/gogs...
GO-2025-3364 Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada
Karmada PULL Mode Cluster Privilege Escalation in github.com/karmada-io/karmada...
GO-2024-3360 OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive
OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive...
GO-2024-3101 Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts...
GO-2024-3344 Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age
Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age...
GO-2024-3342 Traefik affected by CVE-2024-53259 in github.com/traefik/traefik
Traefik affected by CVE-2024-53259 in github.com/traefik/traefik...
GO-2024-3350 WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core
WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service in github.com/clidey/whodb/core...
GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather
OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3343 Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm
Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm...
GO-2024-3333 Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...
GO-2024-3339 Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk
Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk...
GO-2024-3334 Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server
Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server...
GO-2024-3336 MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio
MinIO vulnerable to privilege escalation in IAM import API in github.com/minio/minio...
GO-2024-3340 Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server
Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3338 Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server
Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3335 Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary
Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary...
GO-2024-3331 Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego
Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego...
GO-2024-3293 Full access to the host's OS file system using osfs.FS with Router.Static in goyave.dev/goyave/v5
Static file serving using router.Static and osfs.FS allows clients to access any file on the host file system using relative paths because the requested path is not sanitized and . and .. segments are accepted. The files will be returned as a response, provided the system user running the Go...
GO-2022-0635 In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...
GO-2024-3306 Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess...
GO-2024-3295 Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh
Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh...
GO-2024-3268 Harbor fails to validate the user permissions when updating p2p preheat policies in github.com/goharbor/harbor
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in oth...
GO-2024-3325 kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp...
GO-2024-3327 SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel...
GO-2024-3326 SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel...
GO-2024-3323 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel...
GO-2024-3324 SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel
SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel...
GO-2024-3248 KubeSphere IDOR vulnerability in github.com/kubesphere/kubesphere
An Insecure Direct Object Reference IDOR vulnerability in KubeSphere allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. NOTE: A fix is expected in v4.1.3 in January 2025...
GO-2024-3218 Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht
Content Censorship in the InterPlanetary File System IPFS via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht...
GO-2024-3205 Infinite loop in github.com/gomarkdown/markdown
Infinite loop in github.com/gomarkdown/markdown...
GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
GO-2024-3314 Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo...
GO-2024-3319 Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd
Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd...
GO-2024-3315 CVE-2024-46455 in github.com/Unstructured-IO/unstructured
CVE-2024-46455 in github.com/Unstructured-IO/unstructured...