4632 matches found
GO-2023-1566 Cross site scripting in github.com/usememos/memos
A malicious actor can introduce links starting with a "javascript:" scheme due to insufficient checks on external resources. This can be used as a part of Cross-site Scripting XSS attack...
GO-2023-1548 Repository access credential leak in github.com/argoproj/argo-cd/v2
Argo CD has an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API and therefor the UI or CL...
GO-2023-1559 Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfsnode
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by a bogus fanout parameter in the HAMT directory nodes. There are no known workarounds users are advised to...
GO-2023-1558 Denial of service via malformed size parameters in github.com/ipfs/go-bitfield
When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happens when the size is a not a multiple of 8 or is negative. A workaround is to ensure size%8 == 0 && size = 0 yourself before calling NewBitfield or FromBytes...
GO-2023-1557 Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfs
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus "fanout" parameter in the HAMT directory nodes. A workaround is to not feed untrusted user data to th...
GO-2023-1519 Command injection in github.com/rancher/wrangler
A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host. A workaround is to sanitize input passed...
GO-2023-1515 Denial of service when processing Git credentials in github.com/rancher/wrangler
A denial of service DoS vulnerability exists in the Wrangler Git package. Specially crafted Git credentials can result in a denial of service DoS attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validati...
GO-2023-1526 Server-side request forgery in github.com/hakobe/paranoidhttp
Paranoidhttp before is vulnerable to SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...
GO-2023-1547 Information disclosure in helm.sh/helm/v3
An information disclosure vulnerability exists in the getHostByName template function. The function getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a...
GO-2023-1535 Panic during unmarshal of Server Hello in github.com/pion/dtls/v2
Unmarshalling a Server Hello can panic, which could allow a denial of service...
GO-2023-1534 Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
Unmarshalling a Hello Verify request can panic, which could allow a denial of service...
GO-2023-1497 Leaked user credentials in github.com/sylabs/scs-library-client
When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider...
GO-2023-1494 SQL injection in github.com/elgs/gosqljson
There is a potential for SQL injection through manipulation of the sqlStatement argument...
GO-2023-1295 SQL injection in github.com/square/squalor
There is a potential for SQL injection in the table name parameter...
GO-2023-1269 Panic in encoding in github.com/ipld/go-ipld-prime
Encoding data using the 'json' codec which contains a 'Bytes' type Node will cause the encoder to panic. The decoder is not impacted. If the codec is used to encode user supplied data, this may be used as a vector for a denial of service attack...
GO-2023-1268 Authentication failure in mellium.im/sasl
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated instead, the nonce is empty. This causes authentication to fail in the best case, but if paired...
GO-2023-1495 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be...
GO-2022-1188 Uncontrolled memory allocation in code.sajari.com/docconv
An attacker can remotely supply a specially crafted input that causes uncontrolled memory allocation...
GO-2022-1213 Insecure generation of cookies in github.com/go-macaron/csrf
The Options.Secure value is ignored, and cookies created by Generate never have the secure attribute...
GO-2022-1201 Timing attack in github.com/openshift/osin
Client secret checks are vulnerable to timing attacks, which could permit an attacker to determine client secrets...
GO-2022-1187 Open redirect vulnerability in github.com/go-macaron/i18n
A user controlled string could lead to open redirect...
GO-2022-1180 Verification rule bypass in github.com/kyverno/kyverno
A malicious proxy/registry can bypass verifyImages rules...
GO-2022-1184 OS command injection vulnerability in code.sajari.com/docconv
The manipulation of the argument path to docconv.ConvertPDF,PDFHasImage leads to os command injection...
GO-2022-1165 Denial of service via repository index file in helm.sh/helm/v3
Applications that use the repo package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The repo package contains a handler that processes the index file of a repository. For example, the Helm client adds reference...
GO-2022-1166 Denial of service via schema file in helm.sh/helm/v3
Certain JSON schema validation files can cause a Helm Client to panic, leading to a possible denial of service. The chartutil package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The...
GO-2022-1117 Insufficient verification of proofs in github.com/codenotary/immudb
In certain scenarios, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of...
GO-2022-1178 JWT leak in github.com/bradleyfalzon/ghinstallation
Errors returned by ghinstallation.Transport can include the JWT used for the failed operation. If the error is exposed to an untrusted party, this JWT could be extracted and used to authenticate further requests...
GO-2022-1159 Path traversal in github.com/containers/podman/v4
The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality...
GO-2022-1118 Improper validation of UUIDs in github.com/codenotary/immudb
A malicious server can trick a client into treating it as a different server by changing the reported UUID. immudb client SDKs use the server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple server...
GO-2022-1175 Exposure of local files in github.com/cortexproject/cortex
A malicious actor could remotely read local files by submitting to the Alertmanager Set Configuration API maliciously crafted inputs. Only users of the Alertmanager service where "-experimental.alertmanager.enable-api" or "enableapi: true" is configured are affected...
GO-2022-1155 Panic in github.com/ipfs/go-merkledag
A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. Additionally, use of the ProtoNode.SetCidBuilder method to set non-functioning CidBuilder such as one that refers to a multihash where ...
GO-2022-1167 Denial of service in string value parsing in helm.sh/helm/v3
Applications that use the strvals package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes an error that cannot be recovered from. The strvals package contains a parser that turns strings into Go structures. For example, the Helm client has comman...
GO-2022-1148 Resource exhaustion in github.com/libp2p/go-libp2p
go-libp2p is vulnerable to targeted resource exhaustion attacks. These attacks target libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory ultimately leading to the process getting killed by the host's operating system. While a...
GO-2022-1144 Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate...
GO-2022-1113 Server-side request forgery in github.com/oam-dev/kubevela
When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability...
GO-2022-1114 ZipSlip when unzipping files in github.com/duke-git/lancet
A ZipSlip vulnerability exists when using the fileutil package to unzip files...
GO-2022-1143 Restricted file access on Windows in os and net/http
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS"C:/tmp".Open"COM1" opens the...
GO-2022-1129 Authentication bypass in github.com/crewjam/saml
Authentication bypass is possible when processing SAML responses containing multiple Assertion elements...
GO-2022-1130 Authentication bypass in github.com/prometheus/exporter-toolkit
If an attacker has access to a Prometheus web.yml file and users' bcrypted passwords, it would be possible to bypass security via the built-in authentication cache...
GO-2022-0972 Panic in github.com/shamaton/msgpack/v2
Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...
GO-2022-1098 Denial of service in message decoding in github.com/btcsuite/btcd
Erroneous message decoding can cause denial of service. Improper checking of maximum witness size during node message decoding prevented nodes in Lightning Labs lnd before 0.15.2-beta to sync...
GO-2022-1086 Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper
An attacker can access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Proxy to the http request...
GO-2022-1083 Panic on malformed messages in github.com/free5gc/aper
A malformed message can crash the free5gc/amf and free5gc/ngap decoders via an index-out-of-range panic in aper.GetBitString...
GO-2022-1095 Unsanitized NUL in environment variables on Windows in syscall and os/exec
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavi...
GO-2022-1043 Hardcoded hashed password in github.com/flyteorg/flyteadmin
Default authorization server's configuration settings contain a known hardcoded hashed password. Users who enable auth but do not override this setting may unknowingly allow public traffic in by way of this default password with attackers effectively impersonating propeller...
GO-2022-1071 Denial of service in flux controllers in github.com/fluxcd modules
Flux controllers are vulnerable to a denial of service attack. Users that have permissions to change Flux's objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured variations of these fields, causing the...
GO-2022-1045 Improper validation of signature hash algorithms in github.com/sylabs/sif/v2
The Singularity Image Format SIF reference implementation does not verify that the hash algorithms used are cryptographically secure when verifying digital signatures...
GO-2022-1040 Insufficient sanitization of data files in helm.sh/helm/v3
Helm does not sanitize all fields read from repository data files. A maliciously crafted data file may contain strings containing arbitrary data. If printed to a terminal, a malicious string could obscure or alter data on the screen...
GO-2022-1053 Incorrect signatures in github.com/supranational/blst
Potential creation of an invalid signature from correct inputs. Some inputs to the blstfpeuclinverse function can produce incorrect outputs. This could theoretically permit the creation of an invalid signature from correct inputs...
GO-2022-1052 Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint
Mishandling of timestamps during consensus process can cause a denial of service. While reaching consensus, different tendermint nodes can observe a different timestamp for a consensus evidence. This mismatch can cause the evidence to be invalid, upon which the node producing the evidence will be...