4044 matches found
GO-2024-2478 chasquid HTTP Request/Response Smuggling vulnerability in github.com/albertito/chasquid in blitiri.com.ar/go/chasquid
chasquid HTTP Request/Response Smuggling vulnerability in github.com/albertito/chasquid in blitiri.com.ar/go/chasquid...
GO-2024-2499 Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio
Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation in github.com/minio/minio...
GO-2024-2557 Insufficient Session Expiration in github.com/greenpau/caddy-security
Insufficient Session Expiration in github.com/greenpau/caddy-security...
GO-2024-2564 Improper Validation of Array Index in github.com/greenpau/caddy-security
Improper Validation of Array Index in github.com/greenpau/caddy-security...
GO-2024-2481 Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2024-2442 Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport
Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2024-2582 Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder
Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2558 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security
Authentication Bypass by Spoofing in github.com/greenpau/caddy-security...
GO-2024-2477 OpenFGA denial of service in github.com/openfga/openfga
OpenFGA denial of service in github.com/openfga/openfga...
GO-2024-2560 Open Redirect in github.com/greenpau/caddy-security
Open Redirect in github.com/greenpau/caddy-security...
GO-2024-2540 Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira
Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2529 Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd
Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd...
GO-2024-2532 Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary
Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary...
GO-2024-2441 The DES/3DES cipher was used as part of the TLS protocol by installation tools in github.com/karmada-io/karmada
The DES/3DES cipher was used as part of the TLS protocol by installation tools in github.com/karmada-io/karmada...
GO-2024-2562 Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security...
GO-2024-2431 Insecure random string generator used for sensitive data in github.com/cubefs/cubefs
Insecure random string generator used for sensitive data in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2024-2440 Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws
Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws...
GO-2024-2509 Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault
Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault...
GO-2024-2516 Grafana XSS via a column style in github.com/grafana/grafana
Grafana XSS via a column style in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...
GO-2024-2592 Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server
Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2565 Use of Insufficiently Random Values in github.com/greenpau/caddy-security
Use of Insufficiently Random Values in github.com/greenpau/caddy-security...
GO-2024-2510 Grafana Cross-site Scripting (XSS) in github.com/grafana/grafana
Grafana Cross-site Scripting XSS in github.com/grafana/grafana...
GO-2024-2549 caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting in github.com/greenpau/caddy-security
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting in github.com/greenpau/caddy-security...
GO-2024-2445 Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport
Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2479 Authentik vulnerable to PKCE downgrade attack in goauthentik.io
Authentik vulnerable to PKCE downgrade attack in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2591 Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server
Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2517 Grafana XSS in header column rename in github.com/grafana/grafana
Grafana XSS in header column rename in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2556 APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server
APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2590 Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server
Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2501 Denial of service in HashiCorp Consul in github.com/hashicorp/consul
Denial of service in HashiCorp Consul in github.com/hashicorp/consul...
GO-2024-2500 Moby (Docker Engine) Insufficiently restricted permissions on data directory in github.com/docker/docker
Moby Docker Engine Insufficiently restricted permissions on data directory in github.com/docker/docker...
GO-2024-2486 HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault...
GO-2024-2483 Grafana XSS via adding a link in General feature in github.com/grafana/grafana
Grafana XSS via adding a link in General feature in github.com/grafana/grafana...
GO-2024-2508 Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault
Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault...
GO-2024-2589 Mattermost denial of service through long emoji value in github.com/mattermost/mattermost-server
Mattermost denial of service through long emoji value in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2511 Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault
Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault...
GO-2024-2535 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' in github.com/rancher/rancher
Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2527 Insecure ciphers are allowed by default in go.etcd.io/etcd
The TLS ciphers list supported by etcd contains insecure cipher suites. Users may specify that an insecure cipher is used via “--cipher-suites” flag. A list of secure suites is used by default...
GO-2024-2594 Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server
Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2515 Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana
Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugges...
GO-2024-2447 Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users in github.com/gravitational/teleport
Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...
GO-2024-2559 Cross-site Scripting in github.com/greenpau/caddy-security
Cross-site Scripting in github.com/greenpau/caddy-security...
GO-2024-2595 Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2513 Grafana information disclosure in github.com/grafana/grafana
Grafana information disclosure in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...
GO-2024-2593 Mattermost fails to check the "invite_guest" permission in github.com/mattermost/mattermost-server
Mattermost fails to check the "inviteguest" permission in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2523 Grafana stored XSS in github.com/grafana/grafana
Grafana stored XSS in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2024-2520 Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana
Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2446 Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server
Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2512 Classic builder cache poisoning in github.com/docker/docker
Classic builder cache poisoning in github.com/docker/docker...
GO-2024-2537 Rancher 'Audit Log' leaks sensitive information in github.com/rancher/rancher
Rancher 'Audit Log' leaks sensitive information in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...