4632 matches found
GO-2024-2538 Symlink attack in github.com/hashicorp/nomad
Symlink attack in github.com/hashicorp/nomad...
GO-2024-2583 Encryption bypass in github.com/edgelesssys/marblerun
Encryption bypass in github.com/edgelesssys/marblerun...
GO-2024-2587 SQL injection in github.com/apache/age/drivers/golang
SQL injection in github.com/apache/age/drivers/golang...
GO-2024-2554 Path traversal in helm.sh/helm/v3
Path traversal in helm.sh/helm/v3...
GO-2022-0427 Unprotected file upload in github.com/swaggo/http-swagger
The httpSwagger package's HTTP handler provides WebDAV read/write access to an in-memory filesystem. An attacker can exploit this to cause memory exhaustion by uploading many files, XSS attacks by uploading malicious files, or other unexpected behaviors...
GO-2024-2536 Cross-site scripting in public API in github.com/rancher/norman
Cross-site scripting in public API in github.com/rancher/norman...
GO-2024-2534 Unauthenticated cross-site scripting in github.com/rancher/apiserver
Unauthenticated cross-site scripting in github.com/rancher/apiserver...
GO-2024-2490 Path traversal in github.com/anchore/stereoscope
It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory...
GO-2024-2493 Host system file access in github.com/moby/buildkit
Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container...
GO-2024-2482 Information leak in github.com/goreleaser/goreleaser
Secret values can be printed to the --debug log when using a a custom publisher...
GO-2024-2492 Panic in github.com/moby/buildkit
A malicious BuildKit client or frontend could craft a request that could lead to a BuildKit daemon crashing with a panic...
GO-2024-2494 Host system modification in github.com/moby/buildkit
A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system...
GO-2024-2497 Privilege escalation in github.com/moby/buildkit
BuildKit provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd...
GO-2024-2462 Arbitrary command execution in github.com/0xJacky/Nginx-UI
Arbitrary command execution in github.com/0xJacky/Nginx-UI...
GO-2024-2451 IV collision in github.com/bincyber/go-sqlcrypter
There is a risk of an IV collision using the awskms or aesgcm provider. NIST SP 800-38D section 8.3 states that it is unsafe to encrypt more than 2^32 plaintexts under the same key when using a random IV. The limit could easily be reached given the use case of database column encryption...
GO-2024-2471 Chain halt panic in github.com/cometbft/cometbft
A vulnerability in CometBFT’s validation logic for VoteExtensionsEnableHeight can result in a chain halt when triggered through a governance parameter change proposal on an ABCI2 Application Chain. If a parameter change proposal including a VoteExtensionsEnableHeight modification is passed, nodes...
GO-2024-2454 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2...
GO-2024-2466 Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4
Denial of service in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4...
GO-2024-2459 Denial of service via path validation in github.com/quic-go/quic-go
Denial of service via path validation in github.com/quic-go/quic-go...
GO-2024-2456 Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4
Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4...
GO-2024-2453 Timing side channel in github.com/cloudflare/circl
Timing side channel in github.com/cloudflare/circl...
GO-2024-2469 Kyberslash timing attack possible in github.com/kudelskisecurity/crystals-go
Kyberslash timing attack possible in github.com/kudelskisecurity/crystals-go...
GO-2024-2461 Cross-site scripting in github.com/gofiber/template/django/v3
Cross-site scripting in github.com/gofiber/template/django/v3...
GO-2024-2463 SQL injection in github.com/0xJacky/Nginx-UI
SQL injection in github.com/0xJacky/Nginx-UI...
GO-2024-2464 Remote command execution in github.com/0xJacky/Nginx-UI
Remote command execution in github.com/0xJacky/Nginx-UI...
GO-2023-2399 Denial of service via memory exhaustion in github.com/hashicorp/vault
Unauthenticated and authenticated HTTP requests from a client will be attempted to be mapped to memory. Large requests may result in the exhaustion of available memory on the host, which may cause crashes and denial of service...
GO-2023-2413 Sensitive information logged in github.com/elastic/beats/v7
Sensitive information logged in github.com/elastic/beats/v7...
GO-2023-2412 RAPL accessibility in github.com/containerd/containerd
RAPL accessibility in github.com/containerd/containerd...
GO-2023-2394 Spoofed source IP address in github.com/shift72/caddy-geo-ip
The caddy-geo-ip aka GeoIP middleware for Caddy 2 allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictions...
GO-2023-2385 Insufficient entropy in AES-256-CBC in github.com/pubnub/go
There is insufficient entropy in the implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt functions are less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file. Users are encouraged to...
GO-2023-2409 Denial of service when decrypting attacker controlled input in github.com/dvsekhvalnov/jose2go
An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service...
GO-2023-2402 Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto
A protocol weakness allows a MITM attacker to compromise the integrity of the secure channel before it is established, allowing the attacker to prevent transmission of a number of messages immediately after the secure channel is established without either side being aware. The impact of this atta...
GO-2023-2400 Escalation of privileges in github.com/sap/cloud-security-client-go
An unauthenticated attacker can obtain arbitrary permissions within the application under certain conditions...
GO-2023-2380 Private key recovery via invalid curve point in github.com/ecies/go/v2
An attacker may be able to recover private keys due to a bug in the ECDH function. The library does not check whether the provided public key is on the curve, which means that an attacker can create a public key that is not on the curve and use it to recover the private key. A workaround is to...
GO-2023-2379 Denial of service due to malicious parameters in github.com/lestrrat-go/jwx
The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force...
GO-2023-2386 Captcha verification bypass in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...
GO-2023-2383 Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...
GO-2023-2382 Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data up to about...
GO-2023-2375 Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
GO-2023-2328 HTTP request body disclosure in github.com/go-resty/resty/v2
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buff...
GO-2023-2334 Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service...
GO-2023-2333 Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark
Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark...
GO-2022-0998 Improper blob verification in github.com/sigstore/cosign
Improper blob verification in github.com/sigstore/cosign...
GO-2023-2181 Denial of service attack from remote registry in github.com/sigstore/cosign
An attacker who controls a remote registry can return a high number of attestations and/or signatures to cosign. This can cause cosign to enter a long loop resulting in a denial of service, i.e., endless data attack...
GO-2022-0326 Improper certificate validation in github.com/sigstore/cosign
Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and...
GO-2022-0758 Improper verification of signature attestations in github.com/sigstore/cosign
Improper verification of signature attestations in github.com/sigstore/cosign...
GO-2023-2186 Incorrect detection of reserved device names on Windows in path/filepath
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports the...
GO-2023-2185 Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...
GO-2023-2162 SQL Injection in List Endpoints in github.com/flyteorg/flyteadmin
A malicious user can send a REST request to a List endpoint with filters that contain custom SQL statements. This can result in SQL injection...
GO-2023-2158 Google Sheet API key disclosure in github.com/grafana/google-sheets-datasource
Error messages for the Google Sheets data source plugin were improperly sanitized. The Google Sheet API-key could potentially be exposed...