4632 matches found
GO-2024-2721 Cross site scripting in github.com/tiagorlampert/CHAOS
A malicious actor may be able to extract a JWT token via malicious "/command" request. This is a form of cross site scripting XSS...
GO-2024-2822 Arbitrary code execution in github.com/tiagorlampert/CHAOS
A remote attacker can execute arbitrary commands via crafted HTTP requests...
GO-2024-2819 Denial of Service in github.com/ethereum/go-ethereum
A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. This can result in a denial of service as the node runs out of memory...
GO-2024-2818 Consensus failures in github.com/btcsuite/btcd
Incorrect implementation of the consensus rules outlined in BIP 68 and BIP 112 making btcd susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds...
GO-2024-2825 Arbitrary code execution during build on Darwin in cmd/go
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -ltolibrary flag in a "cgo LDFLAGS" directive...
GO-2024-2824 Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop...
GO-2024-2744 Access control change may take longer than expected in github.com/authelia/authelia/v4
If the file authentication backend is being used, the ewatch option is set to true, the refresh interval is configured to a non-disabled value, and an administrator changes a user's groups, then that user may be able to access resources that their previous groups had access to...
GO-2024-2743 XSS vulnerability via personal website in github.com/apache/incubator-answer
XSS vulnerability via personal website in github.com/apache/incubator-answer...
GO-2024-2730 WITHDRAWN: Directory traversal in FilesystemStore in github.com/gorilla/sessions
This report has been withdrawn on the grounds that it generates too many false positives. Session IDs are documented as not being suitable to hold user-provided data. FilesystemStore does not sanitize the Session.ID value, making it vulnerable to directory traversal attacks. If an attacker has...
GO-2024-2667 Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2
Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2...
GO-2024-2666 Insecure IPsec transparent encryption in github.com/cilium/cilium
Insecure IPsec transparent encryption in github.com/cilium/cilium...
GO-2024-2683 Improper handling of node names in JWT claims assertions in github.com/hashicorp/consul
HashiCorp Consul does not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC...
GO-2024-2682 Denial of service via connection starvation in github.com/quic-go/quic-go
An attacker can cause its peer to run out of memory by sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRECONNECTIONID frame. The attacker can prevent the receiver from sending out the vast...
GO-2024-2670 ACL security vulnerability in github.com/hashicorp/nomad
An ACL policy using a block without label can be applied to unexpected resources in Nomad, a distributed, highly available scheduler designed for effortless operations and management of applications...
GO-2024-2669 API token secret ID leak to Sentinel in github.com/hashicorp/nomad
A vulnerability exists in Nomad where the API caller's ACL token secret ID is exposed to Sentinel policies...
GO-2024-2671 CSI plugin names disclosure in github.com/hashicorp/nomad
A vulnerability was identified in Nomad such that the search HTTP API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. This vulnerability affects Nomad since 0.11.0 and was fixed in 1.4.11 and 1.5.7...
GO-2024-2687 HTTP/2 CONTINUATION flood in net/http
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...
GO-2024-2668 Login username enumeration in github.com/IceWhaleTech/CasaOS-UserService
The Casa OS Login page has a username enumeration vulnerability in the login page that was patched in Casa OS v0.4.7. The issue exists because the application response differs depending on whether the username or password is incorrect, allowing an attacker to enumerate usernames by observing the...
GO-2024-2661 Arbitrary file read in github.com/grafana/grafana
An authenticated attacker that has privileges to modify the data source configurations can read arbitrary files...
GO-2024-2655 XSS in github.com/zitadel/zitadel
The Login UI did not sanitize input parameters. An attacker could create a malicious link, where injected code would be rendered as part of the login screen...
GO-2024-2660 Memory leak in github.com/golang-fips/openssl/v2 and github.com/microsoft/go-crypto-openssl
Using crafted public RSA keys can cause a small memory leak when encrypting and verifying payloads. This can be gradually leveraged into a denial of service attack...
GO-2024-2659 Data exfiltration from internal networks in github.com/docker/docker
dockerd forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics, networks marked as 'internal' can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative...
GO-2024-2646 Cross-site scripting on application summary component in github.com/argoproj/argo-cd/v2
Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. A malicious user to inject a javascript: link in the UI. When clicked by a victim...
GO-2024-2654 Denial of service in github.com/argoproj/argo-cd/v2
Application may crash due to concurrent writes, leading to a denial of service. An attacker can crash the application continuously, making it impossible for legitimate users to access the service. Authentication is not required in the attack...
GO-2024-2653 HTTP policy bypass in github.com/cilium/cilium
Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped...
GO-2024-2656 Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted, and traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent...
GO-2024-2657 Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium
In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies: traffic that should be WireGuard-encrypted is sent unencrypted between a node's Envoy proxy and pods on other nodes, and traffic that should be WireGuard-encrypted is sent unencrypted between a node's DNS proxy and...
GO-2024-2643 Bypass manifest during application creation in github.com/argoproj/argo-cd/v2
An improper validation bug allows users who have create privileges to sync a local manifest during application creation. This allows for bypassing the restriction that the manifests come from some approved git/Helm/OCI source...
GO-2024-2652 Brute force protection bypass in github.com/argoproj/argo-cd/v2
An attacker can effectively bypass the rate limit and brute force protections in Argo CD by exploiting the application's weak cache-based mechanism. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. An attacker can overflow this cache b...
GO-2024-2658 Container escape at build time in github.com/containers/buildah
A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem...
GO-2024-2614 Password brute force attack in github.com/IceWhaleTech/CasaOS-UserService
The CasaOS web application does not have protection against password brute force attacks. An attacker can use a password brute force attack to find and gain full access to the server. This vulnerability allows attackers to get super user-level access over the server...
GO-2024-2539 Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira
Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira...
GO-2024-2631 Decompression bomb vulnerability in github.com/go-jose/go-jose
An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti...
GO-2024-2617 Authentication bypass in github.com/hashicorp/vault
The TLS certificate authentication method incorrectly validates client certificates when configured with a non-CA certificate as a trusted certificate. When configured this way, attackers may be able to craft a certificate that can be used to bypass authentication...
GO-2024-2615 Username enumeration in github.com/IceWhaleTech/CasaOS-UserService
CasaOS-UserService is vulnerable to a username enumeration issue, when an attacker can enumerate the CasaOS username using the application response. If the username is incorrect, the application gives the error 'User does not exist'. If the password is incorrect, the application gives the error...
GO-2024-2613 Unauthorized Console access in github.com/1Panel-dev/1Panel
If the user attempts to access a secure entry point and intercepts with Burp, they can get access to the console page. This access does not return data nor allow modification operations...
GO-2024-2606 SQL injection in github.com/jackc/pgproto3 and github.com/jackc/pgx
An integer overflow in the calculated message size of a query or bind message could allow a single large message to be sent as multiple messages under the attacker's control. This could lead to SQL injection if an attacker can cause a single query or bind message to exceed 4 GB in size...
GO-2024-2618 Authentication token leak in github.com/cloudevents/sdk-go/v2
Using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, http.DefaultClient is modified with the authenticated transport...
GO-2024-2616 Path traversal and user privilege escalation in github.com/IceWhaleTech/CasaOS-UserService
The UserService API contains a path traversal vulnerability that allows an attacker to obtain any file on the system, including the user database and system configuration. This can lead to privilege escalation and compromise of the system...
GO-2024-2605 SQL injection in github.com/jackc/pgx/v4
SQL injection is possible when the database uses the non-default simple protocol, a minus sign directly precedes a numeric placeholder followed by a string placeholder on the same line, and both parameter values are user-controlled...
GO-2024-2608 Minder access control bypass in github.com/stacklok/minder
A Minder user can use the endpoints to access any repository in the DB, irrespective of who owns the repo and any permissions that user may have. The DB query used checks by repo owner, repo name and provider name which is always "github". These query values are not distinct for the particular...
GO-2024-2602 Incorrect email domain verification in github.com/coder/coder
A vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider such as public...
GO-2024-2604 CORS Filter bypass in github.com/zeromicro/go-zero
The CORS Filter feature in go-zero allows users to specify an array of domains allowed in the CORS policy. However, the isOriginAllowed function uses strings.HasSuffix to check the origin, which can lead to a bypass via a domain like "evil-victim.com". This vulnerability is capable of breaking CO...
GO-2024-2610 Errors returned from JSON marshaling may break template escaping in html/template
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates...
GO-2024-2609 Comments in display names are incorrectly handled in net/mail
The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers...
GO-2024-2600 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...
GO-2024-2599 Memory exhaustion in multipart form parsing in net/textproto and net/http
When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a...
GO-2024-2598 Verify panics on certificates with an unknown public key algorithm in crypto/x509
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...
GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...