4570 matches found
GO-2024-2779 Access Restriction Bypass in go-ipfs in github.com/ipfs/go-ipfs
Access Restriction Bypass in go-ipfs in github.com/ipfs/go-ipfs...
GO-2024-2581 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs...
GO-2024-2803 Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome
Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome...
GO-2024-2636 1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel
1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel...
GO-2024-2579 Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer
Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer...
GO-2024-2836 sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy
sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy...
GO-2024-2727 Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation
Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation...
GO-2024-2766 Information disclosure in podman in github.com/containers/libpod
Information disclosure in podman in github.com/containers/libpod...
GO-2024-2723 Apache Solr Operator liveness and readiness probes may leak basic auth credentials in github.com/apache/solr-operator
Apache Solr Operator liveness and readiness probes may leak basic auth credentials in github.com/apache/solr-operator...
GO-2024-2754 Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes
Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes...
GO-2024-2729 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2024-2763 Heketi Arbitrary Code Execution in github.com/heketi/heketi
Heketi Arbitrary Code Execution in github.com/heketi/heketi...
GO-2024-2675 Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server
Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server...
GO-2024-2752 Gitea Open Redirect in code.gitea.io/gitea
Gitea Open Redirect in code.gitea.io/gitea...
GO-2024-2692 Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble
Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble...
GO-2024-2569 Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium
Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium...
GO-2024-2690 HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault
HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault...
GO-2024-2575 Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3
Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3...
GO-2024-2746 Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes...
GO-2024-2863 wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl
wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl...
GO-2024-2704 Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul
Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul...
GO-2024-2741 Owncast Path Traversal vulnerability in github.com/owncast/owncast
Owncast Path Traversal vulnerability in github.com/owncast/owncast...
GO-2024-2568 Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium
Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium...
GO-2024-2701 Minder GetRepositoryByName data leak in github.com/stacklok/minder
Minder GetRepositoryByName data leak in github.com/stacklok/minder...
GO-2024-2791 CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o
CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o...
GO-2024-2716 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb...
GO-2024-2756 Privilege Escalation in kubevirt in kubevirt.io/kubevirt
Privilege Escalation in kubevirt in kubevirt.io/kubevirt...
GO-2024-2572 Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk
Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk...
GO-2024-2879 Dapr API Token Exposure in github.com/dapr/dapr
Dapr API Token Exposure in github.com/dapr/dapr...
GO-2024-2874 Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go
The ibc-go module is affected by the Inter-Blockchain Communication IBC protocol "Huckleberry" vulnerability. The vulnerability allowed an attacker to send arbitrary transactions onto target chains and trigger arbitrary state transitions, including but not limited to, theft of funds. It was...
GO-2024-2571 Invalid block proposal in github.com/cosmos/cosmos-sdk
Invalid block proposal in github.com/cosmos/cosmos-sdk...
GO-2024-2870 Credential leakage in github.com/aquasecurity/trivy
A malicious registry can cause Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry ACR if the registry is scanned from directly using Trivy. These tokens can then be used to push/pull...
GO-2024-2812 Some CORS middleware allow untrusted origins in github.com/jub0bs/fcors
Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...
GO-2024-2813 Some CORS middleware allow untrusted origins in github.com/jub0bs/cors
Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...
GO-2024-2748 Privilege Escalation in Kubernetes in k8s.io/apimachinery
The Kubernetes kube-apiserver is vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise...
GO-2024-2632 JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx
An attacker with a trusted public key may cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time duri...
GO-2024-2574 Insecure CORS Configuration allowing wildcard origin with credentials in github.com/gofiber/fiber/v2
The CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard "" while also having the Access-Control-Allow-Credentials set to true...
GO-2024-2694 Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go
Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go...
GO-2024-2702 Code injection vulnerability in github.com/flipped-aurora/gin-vue-admin/server
Gin-vue-admin has a code injection vulnerability in the backend. In the Plugin System - Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service',...
GO-2024-2842 Unexpected authenticated registry accesses in github.com/containers/image/v5
An attacker may trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...
GO-2024-2864 Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder
Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder...
GO-2024-2831 ATX protocol validation problem in github.com/spacemeshos/go-spacemesh
Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier but not the latest ATX as previous breaks this...
GO-2024-2830 Arbitrary file write in github.com/1Panel-dev/1Panel
A maliciously crafted packet can write to an arbitrary file...
GO-2024-2833 Denial of service in github.com/octo-sts/app
Excessively large requests can be processed, consuming a large amount of resources. This could potentially lead to a denial of service...
GO-2024-2638 ValidateVoteExtensions function in Cosmos SDK may allow incorrect voting power assumptions in github.com/cosmos/cosmos-sdk
The default ValidateVoteExtensions helper function infers total voting power based on the injected VoteExtension, which are injected by the proposer. If your chain utilizes the ValidateVoteExtensions helper in ProcessProposal, a dishonest proposer can potentially mutate voting power of each...
GO-2024-2800 Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter
When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository's HEAD reference of its default branch by passing arguments to the Git binary on the host...
GO-2024-2821 Denial of Service from untrusted requests in github.com/stacklok/minder
HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. An untrusted request can cause the server to allocate large amounts of memory resulting in a denial of service...
GO-2024-2826 Denial of service attack by triggering unbounded memory usage in vitess.io/vitess
When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service...