GO-2024-2856 Grafana Race condition allowing privilege escalation in github.com/grafana/grafana

Grafana Race condition allowing privilege escalation in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2024-2852 Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana

Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...

GO-2024-2867 Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana

Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2024-2851 Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana

Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2024-2847 Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana

Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-2855 Grafana Plugin signature bypass in github.com/grafana/grafana

Grafana Plugin signature bypass in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edi...

GO-2024-2887 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

GO-2024-2888 Mishandling of corrupt central directory record in archive/zip

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...

GO-2024-2578 Apache Answer Cross-site Scripting vulnerability in github.com/apache/incubator-answer

Apache Answer Cross-site Scripting vulnerability in github.com/apache/incubator-answer...

GO-2024-2752 Gitea Open Redirect in code.gitea.io/gitea

Gitea Open Redirect in code.gitea.io/gitea...

GO-2024-2580 Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer

Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer...

GO-2024-2853 sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address in github.com/tg123/sshpiper

sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address in github.com/tg123/sshpiper...

GO-2024-2648 Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server

Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server...

GO-2024-2728 Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd

Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd...

GO-2024-2757 Buffer Overflow in gitea in code.gitea.io/gitea

Buffer Overflow in gitea in code.gitea.io/gitea...

GO-2024-2597 Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb

Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb...

GO-2024-2690 HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault

HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault...

GO-2024-2645 Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei

Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei...

GO-2024-2860 goreleaser shows environment by default in github.com/goreleaser/goreleaser

goreleaser shows environment by default in github.com/goreleaser/goreleaser...

GO-2024-2649 Types for Vela Insecure Variable Substitution in github.com/go-vela/types

Types for Vela Insecure Variable Substitution in github.com/go-vela/types...

GO-2024-2861 azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver

azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver...

GO-2024-2703 Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia

Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia...

GO-2024-2644 Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid

Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid...

GO-2024-2647 CLI for Vela Insecure Variable Substitution in github.com/go-vela/cli

CLI for Vela Insecure Variable Substitution in github.com/go-vela/cli...

GO-2024-2689 Temporal Server Denial of Service in go.temporal.io/server

Temporal Server Denial of Service in go.temporal.io/server...

GO-2024-2701 Minder GetRepositoryByName data leak in github.com/stacklok/minder

Minder GetRepositoryByName data leak in github.com/stacklok/minder...

GO-2024-2846 Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd

Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd...

GO-2024-2692 Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble

Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble...

GO-2024-2642 Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings...

GO-2024-2756 Privilege Escalation in kubevirt in kubevirt.io/kubevirt

Privilege Escalation in kubevirt in kubevirt.io/kubevirt...

GO-2024-2675 Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server

Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server...

GO-2024-2814 Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings...

GO-2024-2779 Access Restriction Bypass in go-ipfs in github.com/ipfs/go-ipfs

Access Restriction Bypass in go-ipfs in github.com/ipfs/go-ipfs...

GO-2024-2581 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs...

GO-2024-2765 Permissions bypass in KubeVirt in kubevirt.io/kubevirt

Permissions bypass in KubeVirt in kubevirt.io/kubevirt...

GO-2024-2803 Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome

Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome...

GO-2024-2636 1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel

1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel...

GO-2024-2579 Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer

Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer...

GO-2024-2766 Information disclosure in podman in github.com/containers/libpod

Information disclosure in podman in github.com/containers/libpod...

GO-2024-2747 Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo

Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo...

GO-2024-2704 Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul

Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul...

GO-2024-2763 Heketi Arbitrary Code Execution in github.com/heketi/heketi

Heketi Arbitrary Code Execution in github.com/heketi/heketi...

GO-2024-2727 Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation

Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation...

GO-2024-2641 Insecure Variable Substitution in Vela in github.com/go-vela/worker

Insecure Variable Substitution in Vela in github.com/go-vela/worker...

GO-2024-2792 Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd

Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd...

GO-2024-2863 wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl

wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl...

GO-2024-2791 CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o

CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o...

GO-2024-2836 sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy

sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy...

GO-2024-2569 Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium

Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium...

GO-2024-2859 source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller

source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller...