4632 matches found
GO-2020-0005 Panic due to malformed WALs in go.etcd.io/etcd
Malformed WALs can be constructed such that WAL.ReadAll can cause attempted out of bounds reads, or creation of arbitrarily sized slices, which may be used as a DoS vector...
GO-2026-4892 A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet
A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet...
GO-2024-3337 Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server
Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3296 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli...
GO-2022-1120 Tailscale Windows daemon is vulnerable to RCE via CSRF in tailscale.com
Tailscale Windows daemon is vulnerable to RCE via CSRF in tailscale.com...
GO-2022-0929 Tarslip in go-unarr in github.com/gen2brain/go-unarr
Tarslip in go-unarr in github.com/gen2brain/go-unarr...
GO-2022-0862 Gitea Improper Input Validation in github.com/go-gitea/gitea
Gitea Improper Input Validation in github.com/go-gitea/gitea...
GO-2022-0835 Information Exposure in RunC in github.com/opencontainers/runc
Information Exposure in RunC in github.com/opencontainers/runc...
GO-2023-2332 Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign
Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. in github.com/sigstore/gitsign...
GO-2024-3014 ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel
ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2023-2331 Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service...
GO-2024-2904 Evmos allows unvested token delegations in github.com/evmos/evmos
Evmos allows unvested token delegations in github.com/evmos/evmos...
GO-2024-2815 Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings...
GO-2024-2865 Stakater Forecastle has a directory traversal vulnerability in github.com/stakater/Forecastle
Stakater Forecastle has a directory traversal vulnerability in github.com/stakater/Forecastle...
GO-2024-2879 Dapr API Token Exposure in github.com/dapr/dapr
Dapr API Token Exposure in github.com/dapr/dapr...
GO-2023-2133 Authorization bypass in github.com/nats-io/nats-server/v2
Without any authorization rules in the nats-server, users can connect without authentication. Before nats-server 2.2.0, all authentication and authorization rules for a nats-server lived in an "authorization" block, defining users. With nats-server 2.2.0 all users live inside accounts. When using...
GO-2023-1904 Collision of hash values in github.com/bnb-chain/tss-lib
Collision of hash values in github.com/bnb-chain/tss-lib...
GO-2023-1751 Improper sanitization of CSS values in html/template
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
GO-2023-1702 Infinite loop in parsing in go/scanner
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow...
GO-2022-1071 Denial of service in flux controllers in github.com/fluxcd modules
Flux controllers are vulnerable to a denial of service attack. Users that have permissions to change Flux's objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured variations of these fields, causing the...
GO-2022-1059 Denial of service via crafted Accept-Language header in golang.org/x/text/language
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...
GO-2022-1037 Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...
GO-2022-0370 Man-in-the-middle attack due to improper validation of certificate in mellium.im/xmpp
Websocket client connections are vulnerable to man-in-the-middle attacks via DNS spoofing. When looking up a WSS endpoint using a DNS TXT record, the server TLS certificate is incorrectly validated using the name of the server returned by the TXT record request, not the name of the the server bei...
GO-2022-0254 Consensus flaw during block processing in github.com/ethereum/go-ethereum
A vulnerability in the Geth EVM can cause a node to reject the canonical chain. A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different stateRoot when processing a maliciously crafted transaction. This, in turn, would lead to the chain being...
GO-2022-0197 Panic when parsing certain inputs in golang.org/x/net/html
The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...
GO-2022-0192 Incorrect parsing of nested templates in golang.org/x/net/html
The Parse function can panic on some invalid inputs. For example, the Parse function panics on the input ""...
GO-2021-0356 Denial of service via crafted Signer in golang.org/x/crypto/ssh
Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that 1 the Signer passed to AddHostKey does not implement AlgorithmSigner, and 2 the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey...
GO-2021-0172 Denial of service when parsing large forms in mime/multipart
When parsing large multipart/form-data, an attacker can cause a HTTP server to open a large number of file descriptors. This may be used as a denial-of-service vector...
GO-2021-0159 Request smuggling due to improper header parsing in net/http
HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields...
GO-2026-5108 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall...
GO-2026-4992 SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE in github.com/siyuan-note/siyuan/kernel
SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE in github.com/siyuan-note/siyuan/kernel...
GO-2024-3280 Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher
Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3136 Dragonfly2 has hard coded cyptographic key in d7y.io/dragonfly
Dragonfly2 has hard coded cyptographic key in d7y.io/dragonfly...
GO-2024-3104 Ollama can extract members of a ZIP archive outside of the parent directory in github.com/ollama/ollama
Ollama can extract members of a ZIP archive outside of the parent directory in github.com/ollama/ollama...
GO-2022-0925 Path Traversal in Dutchcoders transfer.sh in github.com/dutchcoders/transfer.sh
Path Traversal in Dutchcoders transfer.sh in github.com/dutchcoders/transfer.sh...
GO-2022-0812 Reject unauthorized access with GitHub PATs in github.com/go-vela/server
Reject unauthorized access with GitHub PATs in github.com/go-vela/server...
GO-2022-0390 Moby (Docker Engine) started with non-empty inheritable Linux process capabilities in github.com/docker/docker
Moby Docker Engine started with non-empty inheritable Linux process capabilities in github.com/docker/docker...
GO-2022-0261 Authentication bypass issue in the Operator Console in github.com/minio/console
Authentication bypass issue in the Operator Console in github.com/minio/console...
GO-2023-2109 Harbor timing attack risk in github.com/goharbor/harbor
Harbor timing attack risk in github.com/goharbor/harbor...
GO-2023-1639 Consul Server Panic when Ingress and API Gateways Configured with Peering Connections in github.com/hashicorp/consul
Consul Server Panic when Ingress and API Gateways Configured with Peering Connections in github.com/hashicorp/consul...
GO-2024-2430 Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs
Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2559 Cross-site Scripting in github.com/greenpau/caddy-security
Cross-site Scripting in github.com/greenpau/caddy-security...
GO-2024-2495 Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability in github.com/apache/servicecomb-service-center
Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability in github.com/apache/servicecomb-service-center. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2891 evmos allows transferring unvested tokens after delegations in github.com/evmos/evmos
evmos allows transferring unvested tokens after delegations in github.com/evmos/evmos...
GO-2024-2743 XSS vulnerability via personal website in github.com/apache/incubator-answer
XSS vulnerability via personal website in github.com/apache/incubator-answer...
GO-2023-2375 Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...
GO-2023-2185 Insecure parsing of Windows paths with a \??\ prefix in path/filepath
The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...
GO-2023-2116 CSRF token validation vulnerability in github.com/gofiber/fiber/v2
A cross-site request forgery vulnerability can allow an attacker to obtain tokens and forge malicious requests on behalf of a user. This can lead to unauthorized actions being taken on the user's behalf, potentially compromising the security and integrity of the application. The vulnerability is...
GO-2023-1860 IBC protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go
The ibc-go module is affected by the Inter-Blockchain Communication IBC protocol "Huckleberry" vulnerability...
GO-2023-1765 Leaked shared secret and weak blinding in github.com/cloudflare/circl
When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...