4632 matches found
GO-2023-1772 Memory exhaustion in github.com/distribution/distribution
Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/catalog API endpoint request...
GO-2023-1753 Improper handling of empty HTML attributes in html/template
Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...
GO-2022-1180 Verification rule bypass in github.com/kyverno/kyverno
A malicious proxy/registry can bypass verifyImages rules...
GO-2022-0346 Path traversal in github.com/quay/claircore
A maliciously crafted RPM file can cause the Scanner.Scan function to write files with arbitrary contents to arbitrary locations on the local filestem...
GO-2022-0435 Panic due to large inputs affecting P-256 curves in crypto/elliptic
A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or P256.ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected...
GO-2021-0223 Certificate verification error on Windows in crypto/x509
On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in VerifyOptions.KeyUsages. This may allow a certificate to be used for an unintended purpose...
GO-2022-0425 Weak encryption and denial of service in github.com/flynn/noise
The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 18.4 quintillion messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to b...
GO-2021-0112 Improper input validation in go.mongodb.org/mongo-driver
Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input...
GO-2021-0083 Improper certificate validation in github.com/hybridgroup/gobot
TLS certificate verification is skipped when connecting to a MQTT server. This allows an attacker who can MITM the connection to read, or forge, messages passed between the client and server...
GO-2020-0001 Arbitrary log line injection in github.com/gin-gonic/gin
The default Formatter for the Logger middleware LoggerConfig.Formatter, which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path...
GO-2025-3499 IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2025-3428 Arbitrary code execution during build on darwin in cmd/go
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...
GO-2022-0635 In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...
GO-2024-3283 SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo
SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo...
GO-2024-3274 Stored XSS using two files in usememos/memos in github.com/usememos/memos
Stored XSS using two files in usememos/memos in github.com/usememos/memos...
GO-2024-3085 GoAuthentik vulnerable to Insufficient Authorization for several API endpoints in goauthentik.io
GoAuthentik vulnerable to Insufficient Authorization for several API endpoints in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2022-1263 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1220 usememos/memos may leak user information to an authenticated user in github.com/usememos/memos
usememos/memos may leak user information to an authenticated user in github.com/usememos/memos...
GO-2022-1257 usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos
usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos...
GO-2022-1243 usememos/memos Improper Authorization vulnerability in github.com/usememos/memos
usememos/memos Improper Authorization vulnerability in github.com/usememos/memos...
GO-2022-1079 OpenFGA subject to Information Disclosure via streamed-list-objects endpoint in github.com/openfga/openfga
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint in github.com/openfga/openfga...
GO-2022-0876 Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor
Cross-site Request Forgery CSRF in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor...
GO-2022-0863 Privilege Escalation in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor
Privilege Escalation in Cloud Native Computing Foundation Harbor in github.com/goharbor/harbor...
GO-2022-0871 Go Ethereum Improper Input Validation in github.com/ethereum/go-ethereum
Go Ethereum Improper Input Validation in github.com/ethereum/go-ethereum...
GO-2022-0782 Symlink Attack in kubectl cp in k8s.io/kubernetes
Symlink Attack in kubectl cp in k8s.io/kubernetes...
GO-2022-0704 Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030) in github.com/goharbor/harbor
Unauthenticated users can exploit an enumeration vulnerability in Harbor CVE-2019-19030 in github.com/goharbor/harbor...
GO-2022-0494 Query predicate bypass in Zalando Skipper in github.com/zalando/skipper
Query predicate bypass in Zalando Skipper in github.com/zalando/skipper...
GO-2022-0490 Uses of deprecated API can be used to cause DoS in user-facing endpoints in github.com/argoproj/argo-events
Uses of deprecated API can be used to cause DoS in user-facing endpoints in github.com/argoproj/argo-events...
GO-2023-2337 Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno
Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno...
GO-2023-1936 Gophish XSS Vulnerability in github.com/gophish/gophish
Gophish XSS Vulnerability in github.com/gophish/gophish...
GO-2023-1925 Weave GitOps Terraform Controller Information Disclosure Vulnerability in github.com/weaveworks/tf-controller
Weave GitOps Terraform Controller Information Disclosure Vulnerability in github.com/weaveworks/tf-controller...
GO-2023-1270 usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges in github.com/usememos/memos
usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges in github.com/usememos/memos...
GO-2023-1449 usememos/memos Improper Privilege Management vulnerability in github.com/usememos/memos
usememos/memos Improper Privilege Management vulnerability in github.com/usememos/memos...
GO-2024-3022 Mattermost allows remote actor to set arbitrary RemoteId values for synced users in github.com/mattermost/mattermost-server
Mattermost allows remote actor to set arbitrary RemoteId values for synced users in github.com/mattermost/mattermost-server...
GO-2024-2997 CVE-2024-21583 in github.com/gitpod-io/gitpod
CVE-2024-21583 in github.com/gitpod-io/gitpod. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report...
GO-2024-2930 RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke
When RKE provisions a cluster, it stores the cluster state in a configmap called "full-cluster-state" inside the "kube-system" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data...
GO-2024-2936 PocketBase performs password auth and OAuth2 unverified email linking in github.com/pocketbase/pocketbase
PocketBase performs password auth and OAuth2 unverified email linking in github.com/pocketbase/pocketbase...
GO-2024-2557 Insufficient Session Expiration in github.com/greenpau/caddy-security
Insufficient Session Expiration in github.com/greenpau/caddy-security...
GO-2024-2933 Improper trust check in Bazel Build intellij plugin in github.com/bazelbuild/intellij
Improper trust check in Bazel Build intellij plugin in github.com/bazelbuild/intellij...
GO-2024-2907 Files or Directories Accessible to External Parties in ProjectDiscovery in github.com/projectdiscovery/interactsh
Files or Directories Accessible to External Parties in ProjectDiscovery in github.com/projectdiscovery/interactsh...
GO-2024-2791 CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o
CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o...
GO-2024-2853 sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address in github.com/tg123/sshpiper
sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address in github.com/tg123/sshpiper...
GO-2024-2659 Data exfiltration from internal networks in github.com/docker/docker
dockerd forwards DNS requests to the host loopback device, bypassing the container network namespace's normal routing semantics, networks marked as 'internal' can unexpectedly forward DNS requests to an external nameserver. By registering a domain for which they control the authoritative...
GO-2023-2186 Incorrect detection of reserved device names on Windows in path/filepath
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports the...
GO-2023-2163 Curve KeyPairs fail to encrypt in github.com/nats-io/nkeys
Curve KeyPairs always use the same all-zeros key to encrypt data, and provide no security...
GO-2023-2043 Improper handling of special tags within script contexts in html/template
The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack...
GO-2023-1998 Improper path sanitization in sandbox mode in github.com/projectdiscovery/nuclei/v2
Improper path sanitization in sandbox mode in github.com/projectdiscovery/nuclei/v2...
GO-2023-1705 Excessive resource consumption in net/http, net/textproto and mime/multipart
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount ...
GO-2023-1547 Information disclosure in helm.sh/helm/v3
An information disclosure vulnerability exists in the getHostByName template function. The function getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a...