4632 matches found
GO-2022-1184 OS command injection vulnerability in code.sajari.com/docconv
The manipulation of the argument path to docconv.ConvertPDF,PDFHasImage leads to os command injection...
GO-2022-1045 Improper validation of signature hash algorithms in github.com/sylabs/sif/v2
The Singularity Image Format SIF reference implementation does not verify that the hash algorithms used are cryptographically secure when verifying digital signatures...
GO-2022-0956 Excessive resource consumption in gopkg.in/yaml.v2
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory...
GO-2022-0244 Insufficient randomness in UUIDs in github.com/satori/go.uuid
Random data used to create UUIDs can contain zeros, resulting in predictable UUIDs and possible collisions...
GO-2022-0191 Denial of service in chain verification in crypto/x509
The crypto/x509 package does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients verifying certificates are affected...
GO-2020-0050 XML digital signature validation bypass in github.com/russellhaering/goxmldsig
Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...
GO-2020-0042 Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/sassoftware/go-rpmutils
Due to improper path sanitization, RPMs containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2020-0015 Infinite loop when decoding some inputs in golang.org/x/text
An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to transform.String. If used to parse user supplied input, this may be used as a denial of service...
GO-2021-0066 Sensitive information leak via log file in k8s.io/kubernetes
Attempting to read a malformed .dockercfg may cause secrets to be inappropriately logged...
GO-2020-0023 Timing side-channel in github.com/robbert229/jwt
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC...
GO-2025-4251 Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama
Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama...
GO-2022-0814 Go Ethereum Denial of Service in github.com/ethereum/go-ethereum
Go Ethereum Denial of Service in github.com/ethereum/go-ethereum...
GO-2022-0357 Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server in github.com/argoproj/argo-cd...
GO-2023-2020 Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager...
GO-2023-1919 Containous Traefik Exposes Password Hashes in github.com/traefik/traefik
Containous Traefik Exposes Password Hashes in github.com/traefik/traefik...
GO-2023-1630 Full authentication bypass if SASL authorization username is specified in github.com/foxcpp/maddy
Full authentication bypass if SASL authorization username is specified in github.com/foxcpp/maddy...
GO-2024-3020 Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server
Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server...
GO-2024-3056 Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea
Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea...
GO-2024-2794 Mattermost fails to fully validate role changes in github.com/mattermost/mattermost-server
Mattermost fails to fully validate role changes in github.com/mattermost/mattermost-server...
GO-2024-2857 Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana
Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
GO-2024-2765 Permissions bypass in KubeVirt in kubevirt.io/kubevirt
Permissions bypass in KubeVirt in kubevirt.io/kubevirt...
GO-2024-2580 Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer
Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer...
GO-2024-2833 Denial of service in github.com/octo-sts/app
Excessively large requests can be processed, consuming a large amount of resources. This could potentially lead to a denial of service...
GO-2024-2800 Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter
When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository's HEAD reference of its default branch by passing arguments to the Git binary on the host...
GO-2024-2463 SQL injection in github.com/0xJacky/Nginx-UI
SQL injection in github.com/0xJacky/Nginx-UI...
GO-2023-2383 Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...
GO-2023-1989 Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image both in terms of pixel width/height, and encoded size to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU...
GO-2023-1882 Deadlock in github.com/cometbft/cometbft/consensus
An internal modification to the way PeerState is serialized to JSON introduced a deadlock when the new function MarshalJSON is called. This function can be called in two ways. The first is via logs, by setting the consensus logging module to "debug" level which should not happen in production, an...
GO-2023-1841 Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...
GO-2022-0569 Path traversal in github.com/beego/beego and beego/v2
The leafInfo.match function uses path.join to deal with wildcard values which can lead to cross directory risk...
GO-2022-0945 Signature validation bypass in gopkg.in/square/go-jose.v1
The go-jose library suffers from multiple signatures exploitation. When validating a signed message, the API did not indicate which signature was valid, which creates the potential for confusion...
GO-2022-0520 Exposure of client IP addresses in net/http
Client IP adresses may be unintentionally exposed via X-Forwarded-For headers. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy sets the client IP as the value of the X-Forwarded-For header, contrary to it...
GO-2022-0355 Path traversal in github.com/valyala/fasthttp
The fasthttp.FS request handler is vulnerable to directory traversal attacks on Windows systems, and can serve files from outside the provided root directory. URL path normalization does not handle Windows path separators backslashes, permitting an attacker to construct requests with relative pat...
GO-2020-0036 Excessive resource consumption in YAML parsing in gopkg.in/yaml.v2
Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector...
GO-2026-5327 Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver
Mongo-go-driver: Heap Out-of-Bounds Read in GSSAPI Error Handling in go.mongodb.org/mongo-driver...
GO-2025-3500 In-memory stored Cross-site scripting (XSS) vulnerability in pineconesim in github.com/matrix-org/pinecone
In-memory stored Cross-site scripting XSS vulnerability in pineconesim in github.com/matrix-org/pinecone...
GO-2025-3445 Ability to view Agent list with no privilege access in wazuh-dashboard in github.com/wazuh/wazuh
Ability to view Agent list with no privilege access in wazuh-dashboard in github.com/wazuh/wazuh...
GO-2024-3307 CVE-2024-50948 in github.com/mochi-mqtt/server
CVE-2024-50948 in github.com/mochi-mqtt/server...
GO-2024-3108 Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly
Hoverfly allows an arbitrary file read in the /api/v2/simulation endpoint GHSL-2023-274 in github.com/SpectoLabs/hoverfly...
GO-2022-0920 Incorrect Authorization in ORY Oathkeeper in github.com/ory/oathkeeper
Incorrect Authorization in ORY Oathkeeper in github.com/ory/oathkeeper...
GO-2022-0785 "catalog's registry v2 api exposed on unauthenticated path in Harbor" in github.com/goharbor/harbor
"catalog's registry v2 api exposed on unauthenticated path in Harbor" in github.com/goharbor/harbor...
GO-2022-0780 Improper Authentication in InfluxDB in github.com/influxdata/influxdb
Improper Authentication in InfluxDB in github.com/influxdata/influxdb...
GO-2022-0769 Incorrect Default Permissions in Binance tss-lib in github.com/binance-chain/tss-lib
Incorrect Default Permissions in Binance tss-lib in github.com/binance-chain/tss-lib...
GO-2022-0608 Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o
Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o...
GO-2022-0502 Weave GitOps leaked cluster credentials into logs on connection errors in github.com/weaveworks/weave-gitops
Weave GitOps leaked cluster credentials into logs on connection errors in github.com/weaveworks/weave-gitops...
GO-2022-0295 Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb
Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb...
GO-2023-2014 Woodpecker does not validate webhook before changing any data in github.com/woodpecker-ci/woodpecker
Woodpecker does not validate webhook before changing any data in github.com/woodpecker-ci/woodpecker...
GO-2023-1863 rudder-server is vulnerable to SQL injection in github.com/rudderlabs/rudder-server
rudder-server is vulnerable to SQL injection in github.com/rudderlabs/rudder-server...