4632 matches found
GO-2024-2905 Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter
Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter...
GO-2024-2931 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2024-2940 SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo
SFTPGo has insufficient access control for password reset in github.com/drakkan/sftpgo...
GO-2024-2939 SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb
SpiceDB exclusions can result in no permission returned when permission expected in github.com/authzed/spicedb...
GO-2024-2898 Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd
Argo-cd authenticated users can enumerate clusters by name in github.com/argoproj/argo-cd...
GO-2024-2934 Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder
Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder...
GO-2024-2941 ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik
ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/traefik/traefik...
GO-2024-2933 Improper trust check in Bazel Build intellij plugin in github.com/bazelbuild/intellij
Improper trust check in Bazel Build intellij plugin in github.com/bazelbuild/intellij...
GO-2024-2932 Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec in github.com/rancher/rancher
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2024-2924 AdGuardHome privilege escalation vulnerability in github.com/AdguardTeam/AdGuardHome
AdGuardHome privilege escalation vulnerability in github.com/AdguardTeam/AdGuardHome. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2024-2927 Evmos is missing create validator check in github.com/evmos/evmos
Evmos is missing create validator check in github.com/evmos/evmos...
GO-2024-2938 LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI
LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2024-2928 SQL injection vulnerability in Gin-vue-admin in github.com/flipped-aurora/gin-vue-admin
SQL injection vulnerability in Gin-vue-admin in github.com/flipped-aurora/gin-vue-admin...
GO-2024-2929 Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher
Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2024-2926 Evmos is missing precompile checks in github.com/evmos/evmos
Evmos is missing precompile checks in github.com/evmos/evmos...
GO-2023-2331 Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service...
GO-2024-2937 Panic when parsing invalid palette-color images in golang.org/x/image
Parsing a corrupt or malicious image with invalid color indices can cause a panic...
GO-2024-2947 Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp
URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file...
GO-2024-2923 Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt
Vulnerabilities with the k8sGPT in github.com/k8sgpt-ai/k8sgpt...
GO-2024-2922 Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium
Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium...
GO-2024-2907 Files or Directories Accessible to External Parties in ProjectDiscovery in github.com/projectdiscovery/interactsh
Files or Directories Accessible to External Parties in ProjectDiscovery in github.com/projectdiscovery/interactsh...
GO-2024-2899 apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
apko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko...
GO-2024-2901 Ollama does not validate the format of the digest (sha256 with 64 hex digits) in github.com/ollama/ollama
Ollama does not validate the format of the digest sha256 with 64 hex digits in github.com/ollama/ollama...
GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd
Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd...
GO-2024-2903 Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos
Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos...
GO-2024-2915 Open Redirect URL in Harbor in github.com/goharbor/harbor
Open Redirect URL in Harbor in github.com/goharbor/harbor...
GO-2024-2913 Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker
Unexpected chmod of host files via 'docker cp' in Moby Docker Engine in github.com/docker/docker...
GO-2024-2917 Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik...
GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc
An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...
GO-2024-2891 evmos allows transferring unvested tokens after delegations in github.com/evmos/evmos
evmos allows transferring unvested tokens after delegations in github.com/evmos/evmos...
GO-2024-2906 CVE-2024-5138 in github.com/snapcore/snapd
CVE-2024-5138 in github.com/snapcore/snapd...
GO-2024-2911 go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression
go-grpc-compression has a zstd decompression bombing vulnerability in github.com/mostynb/go-grpc-compression...
GO-2024-2904 Evmos allows unvested token delegations in github.com/evmos/evmos
Evmos allows unvested token delegations in github.com/evmos/evmos...
GO-2024-2916 SQL Injection in Harbor scan log API in github.com/goharbor/harbor
SQL Injection in Harbor scan log API in github.com/goharbor/harbor...
GO-2024-2919 malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o
malicious container creates symlink "mtab" on the host External in github.com/cri-o/cri-o...
GO-2024-2914 Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker
Moby Docker Engine is vulnerable to Ambiguous OCI manifest parsing in github.com/docker/docker...
GO-2024-2801 Calico privilege escalation vulnerability in github.com/projectcalico/calico
Calico privilege escalation vulnerability in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2784 Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher
Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher...
GO-2024-2858 Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins in github.com/grafana/grafana
Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2024-2815 Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings...
GO-2024-2753 Denial of service in Kubernetes in k8s.io/kubernetes
Denial of service in Kubernetes in k8s.io/kubernetes...
GO-2024-2768 Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher
Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2731 Evmos vulnerable to unauthorized account creation with vesting module in github.com/evmos/evmos
Evmos vulnerable to unauthorized account creation with vesting module in github.com/evmos/evmos...
GO-2024-2780 Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes
Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes...
GO-2024-2778 Rancher Privilege escalation vulnerability via malicious "Connection" header in github.com/rancher/rancher
Rancher Privilege escalation vulnerability via malicious "Connection" header in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2612 Artica Proxy Loopback Services Remotely Accessible Unauthenticated in github.com/gvalkov/tailon
Artica Proxy Loopback Services Remotely Accessible Unauthenticated in github.com/gvalkov/tailon...
GO-2024-2769 Gitea allowed assignment of private issues in code.gitea.io/gitea
Gitea allowed assignment of private issues in code.gitea.io/gitea...
GO-2024-2684 CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs
CA17 TeamsACS Cross Site Scripting vulnerability in github.com/ca17/teamsacs...
GO-2024-2776 Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection in github.com/apache/trafficcontrol
Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection in github.com/apache/trafficcontrol...