4632 matches found
GO-2022-0978 Protection bypass in github.com/open-policy-agent/opa
Open Policy Agent OPA is an open source, general-purpose policy engine. The Rego compiler provides a deprecated WithUnsafeBuiltins function, which allows users to provide a set of built-in functions that should be deemed unsafe and rejected by the compiler if encountered in the policy compilation...
GO-2022-0298 Command injection in gh-ost in github.com/github/gh-ost
Command injection in gh-ost in github.com/github/gh-ost...
GO-2023-2137 Credentials leak in github.com/ydb-platform/ydb-go-sdk/v3
A custom credentials object that does not implement the fmt.Stringer interface may leak sensitive information e.g., credentials via logs...
GO-2023-2102 HTTP/2 rapid reset can cause excessive work in net/http
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...
GO-2023-1878 Insufficient sanitization of Host header in net/http
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...
GO-2022-0476 Arbitrary code execution via the go command with cgo in cmd/go
The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious gcc flags specified via a cgo directive...
GO-2023-2351 Capsule Proxy Authentication bypass using an empty token in github.com/projectcapsule/capsule-proxy
Capsule Proxy Authentication bypass using an empty token in github.com/projectcapsule/capsule-proxy...
GO-2024-2537 Rancher 'Audit Log' leaks sensitive information in github.com/rancher/rancher
Rancher 'Audit Log' leaks sensitive information in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
GO-2024-2875 Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki
Wiki.js Stored XSS through Client Side Template Injection in github.com/requarks/wiki...
GO-2025-3595 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
GO-2022-1208 gotify/server vulnerable to Cross-site Scripting in the application image file upload in github.com/gotify/server
gotify/server vulnerable to Cross-site Scripting in the application image file upload in github.com/gotify/server...
GO-2023-2394 Spoofed source IP address in github.com/shift72/caddy-geo-ip
The caddy-geo-ip aka GeoIP middleware for Caddy 2 allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictions...
GO-2023-2077 Authentication bypass in github.com/sagernet/sing
Authentication bypass in github.com/sagernet/sing...
GO-2023-2022 Netmaker has Hardcoded DNS Secret Key in github.com/gravitl/netmaker
Netmaker has Hardcoded DNS Secret Key in github.com/gravitl/netmaker...
GO-2024-2431 Insecure random string generator used for sensitive data in github.com/cubefs/cubefs
Insecure random string generator used for sensitive data in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2025-3977 Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server
Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3098 The req library may send an unintended request when a malformed URL is provided in github.com/imroc/req
The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in...
GO-2023-1912 mx-chain-go's relayed transactions always increment nonce in github.com/multiversx/mx-chain-go
mx-chain-go's relayed transactions always increment nonce in github.com/multiversx/mx-chain-go...
GO-2023-1940 1Panel command injection vulnerability in Firewall ip functionality in github.com/1Panel-dev/1Panel
1Panel command injection vulnerability in Firewall ip functionality in github.com/1Panel-dev/1Panel...
GO-2023-2046 Unbounded memory consumption in github.com/ethereum/go-ethereum
Unbounded memory consumption in github.com/ethereum/go-ethereum...
GO-2023-1733 Timing attack from non-constant time scalar arithmetic in github.com/bnb-chain/tss-lib
Timing attack from non-constant time scalar arithmetic in github.com/bnb-chain/tss-lib...
GO-2022-0203 Remote command execution via "go get" command with "-insecure" option in cmd/go
The "go get" command is vulnerable to remote code execution. When the -insecure command-line option is used, "go get" does not validate the import path get/vcs.go only checks for "://" anywhere in the string, which allows remote attackers to execute arbitrary OS commands via a crafted web site...
GO-2025-3997 github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks in github.com/MANTRA-Chain/mantrachain
github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks in github.com/MANTRA-Chain/mantrachain...
GO-2025-3936 Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos
Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos...
GO-2025-3361 GoPhish sends cleartext passwords in github.com/gophish/gophish
GoPhish sends cleartext passwords in github.com/gophish/gophish...
GO-2022-1236 usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos
usememos/memos makes Incorrect Use of Privileged APIs in github.com/usememos/memos...
GO-2023-1292 usememos/memos Incorrect Use of Privileged APIs vulnerability in github.com/usememos/memos
usememos/memos Incorrect Use of Privileged APIs vulnerability in github.com/usememos/memos...
GO-2023-2402 Man-in-the-middle attacker can compromise integrity of secure channel in golang.org/x/crypto
A protocol weakness allows a MITM attacker to compromise the integrity of the secure channel before it is established, allowing the attacker to prevent transmission of a number of messages immediately after the secure channel is established without either side being aware. The impact of this atta...
GO-2023-2052 IsFromLocal local address check can be circumvented in github.com/gofiber/fiber/v2
The Ctx.IsFromLocal function can incorrectly report a request as being sent from localhost when the request contains an X-Forwarded-For header containing a localhost IP address...
GO-2023-1505 Arbitrary file read vulnerability in github.com/uber/kraken
kraken contains an arbitrary file read vulnerability via component testfs...
GO-2023-1577 Users with any cluster secret update access may update out-of-bounds cluster secrets in github.com/argoproj/argo-cd
Users with any cluster secret update access may update out-of-bounds cluster secrets in github.com/argoproj/argo-cd...
GO-2024-3051 Meshery SQL Injection vulnerability in github.com/layer5io/meshery
Meshery SQL Injection vulnerability in github.com/layer5io/meshery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2024-2963 Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail...
GO-2024-2902 Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd
Unauthenticated Access to sensitive settings in Argo CD in github.com/argoproj/argo-cd...
GO-2024-2645 Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei
Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei...
GO-2024-3088 memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos
memos CORS Misconfiguration in server.go GHSL-2024-034 in github.com/usememos/memos...
GO-2023-2024 Out-of-memory vulnerability in github.com/libp2p/go-libp2p
A malicious actor can store an arbitrary amount of data in the memory of a remote node by sending the node a message with a signed peer record. Signed peer records from randomly generated peers can be sent by a malicious actor. This memory does not get garbage collected and so the remote node can...
GO-2022-1118 Improper validation of UUIDs in github.com/codenotary/immudb
A malicious server can trick a client into treating it as a different server by changing the reported UUID. immudb client SDKs use the server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple server...
GO-2022-0475 Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol name in a linked object file...
GO-2020-0018
UUIDs generated using NewV1 and NewV4 may not read the expected number of random bytes. These UUIDs may contain a significantly smaller amount of entropy than expected, possibly leading to collisions...
GO-2024-3055 gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc
gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc...
GO-2024-2824 Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop...
GO-2021-0090 Denial of service in github.com/tendermint/tendermint
Proposed commits may contain signatures for blocks not contained within the commit. Instead of skipping these signatures, they cause failure during verification. A malicious proposer can use this to force consensus failures...
GO-2020-0026 Arbitrary file write via archive extraction in github.com/openshift/source-to-image
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2023-1615 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2024-2989 projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei
projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei...
GO-2023-2095 Arbitrary code execution during build via line directives in cmd/go
Line directives "//line" can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of...
GO-2025-3930 Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve
Soft Serve vulnerable to arbitrary file writing through SSH API in github.com/charmbracelet/soft-serve...
GO-2023-2338 Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno
Denial of service from malicious signature in kyverno in github.com/kyverno/kyverno...
GO-2022-1130 Authentication bypass in github.com/prometheus/exporter-toolkit
If an attacker has access to a Prometheus web.yml file and users' bcrypted passwords, it would be possible to bypass security via the built-in authentication cache...