GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server

Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...

GO-2024-2432 CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs

CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2024-2491 Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc...

GO-2024-2444 Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server

Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-2927 Evmos is missing create validator check in github.com/evmos/evmos

Evmos is missing create validator check in github.com/evmos/evmos...

GO-2024-2928 SQL injection vulnerability in Gin-vue-admin in github.com/flipped-aurora/gin-vue-admin

SQL injection vulnerability in Gin-vue-admin in github.com/flipped-aurora/gin-vue-admin...

GO-2024-2941 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik

ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik...

GO-2024-2905 Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter

Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter...

GO-2024-2939 SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb

SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb...

GO-2024-2938 LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI

LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...

GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd

Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd...

GO-2024-2940 SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo

SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo...

GO-2024-2933 Improper trust check in Bazel Build intellij plugin in github.com/bazelbuild/intellij

Improper trust check in Bazel Build intellij plugin in github.com/bazelbuild/intellij...

GO-2024-2934 Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder

Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder...

GO-2024-2931 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher

Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2024-2929 Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher

Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2023-2331 Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc

The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service...

GO-2024-2937 Panic when parsing invalid palette-color images in golang.org/x/image

Parsing a corrupt or malicious image with invalid color indices can cause a panic...

GO-2024-2947 Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp

URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file...

GO-2024-2923 Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt

Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt...

GO-2024-2922 Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium

Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium...

GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd

Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd...

GO-2024-2891 evmos allows transferring unvested tokens after delegations in github.com/evmos/evmos

evmos allows transferring unvested tokens after delegations in github.com/evmos/evmos...

GO-2024-2911 go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression

go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression...

GO-2024-2903 Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos

Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos...

GO-2024-2915 Open Redirect URL in Harbor in github.com/goharbor/harbor

Open Redirect URL in Harbor in github.com/goharbor/harbor...

GO-2024-2904 Evmos allows unvested token delegations in github.com/evmos/evmos

Evmos allows unvested token delegations in github.com/evmos/evmos...

GO-2024-2917 Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik

Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik...

GO-2024-2916 SQL Injection in Harbor scan log API in github.com/goharbor/harbor

SQL Injection in Harbor scan log API in github.com/goharbor/harbor...

GO-2024-2913 Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker

Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker...

GO-2024-2899 apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko

apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko...

GO-2024-2907 Files or Directories Accessible to External Parties in ProjectDiscovery in github.com/projectdiscovery/interactsh

Files or Directories Accessible to External Parties in ProjectDiscovery in github.com/projectdiscovery/interactsh...

GO-2024-2906 CVE-2024-5138 in github.com/snapcore/snapd

CVE-2024-5138 in github.com/snapcore/snapd...

GO-2024-2901 Ollama does not validate the format of the digest (sha256 with 64 hex digits) in github.com/ollama/ollama

Ollama does not validate the format of the digest sha256 with 64 hex digits in github.com/ollama/ollama...

GO-2024-2914 Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker

Moby Docker Engine is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker...

GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc

An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...

GO-2024-2815 Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings...

GO-2024-2801 Calico privilege escalation vulnerability in github.com/projectcalico/calico

Calico privilege escalation vulnerability in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2024-2858 Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins in github.com/grafana/grafana

Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2024-2753 Denial of service in Kubernetes in k8s.io/kubernetes

Denial of service in Kubernetes in k8s.io/kubernetes...

GO-2024-2768 Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher

Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2024-2780 Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes

Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes...

GO-2024-2778 Rancher Privilege escalation vulnerability via malicious "Connection" header in github.com/rancher/rancher

Rancher Privilege escalation vulnerability via malicious "Connection" header in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-2769 Gitea allowed assignment of private issues in code.gitea.io/gitea

Gitea allowed assignment of private issues in code.gitea.io/gitea...

GO-2024-2612 Artica Proxy Loopback Services Remotely Accessible Unauthenticated in github.com/gvalkov/tailon

Artica Proxy Loopback Services Remotely Accessible Unauthenticated in github.com/gvalkov/tailon...

GO-2024-2684 CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs

CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs...

GO-2024-2759 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax

IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...

GO-2024-2775 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax

IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...

GO-2024-2783 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax

IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...

GO-2024-2796 Mattermost fails to limit the size of a request path in github.com/mattermost/mattermost-server

Mattermost fails to limit the size of a request path in github.com/mattermost/mattermost-server...