4632 matches found
GO-2022-0608 Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o
Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o...
GO-2022-0502 Weave GitOps leaked cluster credentials into logs on connection errors in github.com/weaveworks/weave-gitops
Weave GitOps leaked cluster credentials into logs on connection errors in github.com/weaveworks/weave-gitops...
GO-2022-0328 Use of Hard-coded Cryptographic Key in Netmaker in github.com/gravitl/netmaker
Use of Hard-coded Cryptographic Key in Netmaker in github.com/gravitl/netmaker...
GO-2022-0295 Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb
Lookup operations do not take into account wildcards in SpiceDB in github.com/authzed/spicedb...
GO-2023-1863 rudder-server is vulnerable to SQL injection in github.com/rudderlabs/rudder-server
rudder-server is vulnerable to SQL injection in github.com/rudderlabs/rudder-server...
GO-2023-1655 Answer vulnerable to Insufficient Session Expiration in github.com/answerdev/answer
Answer vulnerable to Insufficient Session Expiration in github.com/answerdev/answer...
GO-2024-3053 gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc
gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc...
GO-2024-3028 Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel in github.com/mattermost/mattermost-server
Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel in github.com/mattermost/mattermost-server...
GO-2024-2958 Potential memory exhaustion attack due to sparse slice deserialization in github.com/gorilla/schema
Potential memory exhaustion attack due to sparse slice deserialization in github.com/gorilla/schema...
GO-2024-2582 Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder
Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2479 Authentik vulnerable to PKCE downgrade attack in goauthentik.io
Authentik vulnerable to PKCE downgrade attack in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2900 Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC in go.opentelemetry.io/collector/config/configgrpc
An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption...
GO-2024-2788 ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2793 Mattermost allows team admins to promote guests to team admins in github.com/mattermost/mattermost-server
Mattermost allows team admins to promote guests to team admins in github.com/mattermost/mattermost-server...
GO-2024-2797 Mattermost's detailed error messages reveal the full file path in github.com/mattermost/mattermost-server
Mattermost's detailed error messages reveal the full file path in github.com/mattermost/mattermost-server...
GO-2024-2539 Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira
Cross-site request forgery via logout button in github.com/mattermost/mattermost-plugin-jira...
GO-2024-2617 Authentication bypass in github.com/hashicorp/vault
The TLS certificate authentication method incorrectly validates client certificates when configured with a non-CA certificate as a trusted certificate. When configured this way, attackers may be able to craft a certificate that can be used to bypass authentication...
GO-2024-2610 Errors returned from JSON marshaling may break template escaping in html/template
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates...
GO-2023-2386 Captcha verification bypass in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...
GO-2022-0326 Improper certificate validation in github.com/sigstore/cosign
Cosign can be manipulated to claim that an entry for a signature in the OCI registry exists in the Rekor transparency log even if it does not. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and...
GO-2023-2041 Improper handling of HTML-like comments in script contexts in html/template
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS atta...
GO-2023-1515 Denial of service when processing Git credentials in github.com/rancher/wrangler
A denial of service DoS vulnerability exists in the Wrangler Git package. Specially crafted Git credentials can result in a denial of service DoS attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validati...
GO-2022-1159 Path traversal in github.com/containers/podman/v4
The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality...
GO-2022-1083 Panic on malformed messages in github.com/free5gc/aper
A malformed message can crash the free5gc/amf and free5gc/ngap decoders via an index-out-of-range panic in aper.GetBitString...
GO-2022-0236 Panic due to large headers in net/http and golang.org/x/net/http/httpguts
A malicious HTTP server or client can cause the net/http client or server to panic. ReadRequest and ReadResponse can hit an unrecoverable panic when reading a very large header over 7MB on 64-bit architectures, or over 4MB on 32-bit ones. Transport and Client are vulnerable and the program can be...
GO-2021-0142 Unbounded read from invalid inputs in encoding/binary
ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs. Certain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input...
GO-2022-0414 Command injection in github.com/Masterminds/vcs
Passing untrusted inputs to VCS functions can permit an attacker to execute arbitrary commands. The vcs package executes version control commands with user-provided arguments. These arguments can be interpreted as command-line flags, which can be used to perform command injection...
GO-2022-0587 Out of bounds memory access in github.com/open-policy-agent/opa
An issue in ast.Parser in Open Policy Agent causes the application to incorrectly interpret expressions, allowing a Denial of Service DoS via triggering out-of-range memory access...
GO-2021-0321
An attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification...
GO-2021-0235 Incorrect operations on the P-224 curve in crypto/elliptic
The P224 Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult...
GO-2022-0629 Directory traversal in sigs.k8s.io/secrets-store-csi-driver
Modifying pod status allows host directory traversal. Kubernetes Secrets Store CSI Driver allows an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under...
GO-2021-0178 Cleartext transmission of credentials in net/smtp
SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers...
GO-2021-0140
X509 Certificate verification does not validate KeyUsages EKU requirements on Windows if VerifyOptions.Roots is nil...
GO-2021-0108 CRLF vulnerability in Fiber in github.com/gofiber/fiber
Due to improper input sanitization, a maliciously constructed filename could cause a file download to use an attacker controlled filename, as well as injecting additional headers into an HTTP response...
GO-2021-0051 Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2020-0004 Authentication bypass in github.com/nanobox-io/golang-nanoauth
If any of the ListenAndServe functions are called with an empty token, token authentication is disabled globally for all listeners. Also, a minor timing side channel was present allowing attackers with very low latency and able to make many requests to potentially recover the token...
GO-2020-0025 Path traversal in code.cloudfoundry.org/archiver
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2021-0099 Zip slip directory exploit in github.com/deislabs/oras
Due to improper path validation, using the github.com/deislabs/oras/pkg/content.FileStore content store may result in directory traversal during archive extraction, allowing a malicious archive to write paths to arbitrary paths that the process can write to...
GO-2026-5690 opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver
opentelemetry-collector-contrib: githubreceiver silently ignores configured requiredheaders authentication in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver...
GO-2026-5330 gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362) in github.com/pilinux/gorest
gorest InMemorySecret2FA race condition allows process crash via concurrent map access CWE-362 in github.com/pilinux/gorest...
GO-2026-4337 Unexpected session resumption in crypto/tls
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the...
GO-2024-3201 JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector
JWT token compromise can allow malicious actions including Remote Code Execution RCE in github.com/neuvector/neuvector...
GO-2022-1062 Nomad Panics On Job Submission With Bad Artifact Stanza Source URL in github.com/hashicorp/nomad
Nomad Panics On Job Submission With Bad Artifact Stanza Source URL in github.com/hashicorp/nomad...
GO-2022-0838 Exposure of server configuration in github.com/go-vela/server in github.com/go-vela/compiler
Exposure of server configuration in github.com/go-vela/server in github.com/go-vela/compiler...
GO-2022-0798 Privilege escalation in rbac in github.com/google/exposure-notifications-verification-server
Privilege escalation in rbac in github.com/google/exposure-notifications-verification-server...
GO-2022-0456 DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum
DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum...
GO-2023-2336 Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno
Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno...
GO-2023-2121 OpenFGA DoS vulnerability in github.com/openfga/openfga
OpenFGA DoS vulnerability in github.com/openfga/openfga...
GO-2024-2978 Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc
If applications print or log a context containing gRPC metadata, the output will contain all the metadata, which may include private information. This represents a potential PII concern...