4632 matches found
GO-2024-2635 Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost-server
Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost-server...
GO-2024-2695 Mattermost Server doesn't limit the number of user preferences in github.com/mattermost/mattermost-server
Mattermost Server doesn't limit the number of user preferences in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2696 Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server
Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2886 MinIO information disclosure vulnerability in github.com/minio/minio
MinIO information disclosure vulnerability in github.com/minio/minio...
GO-2024-2766 Information disclosure in podman in github.com/containers/libpod
Information disclosure in podman in github.com/containers/libpod...
GO-2024-2701 Minder GetRepositoryByName data leak in github.com/stacklok/minder
Minder GetRepositoryByName data leak in github.com/stacklok/minder...
GO-2024-2728 Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd
Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd...
GO-2024-2842 Unexpected authenticated registry accesses in github.com/containers/image/v5
An attacker may trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...
GO-2024-2818 Consensus failures in github.com/btcsuite/btcd
Incorrect implementation of the consensus rules outlined in BIP 68 and BIP 112 making btcd susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds...
GO-2024-2554 Path traversal in helm.sh/helm/v3
Path traversal in helm.sh/helm/v3...
GO-2024-2482 Information leak in github.com/goreleaser/goreleaser
Secret values can be printed to the --debug log when using a a custom publisher...
GO-2023-2409 Denial of service when decrypting attacker controlled input in github.com/dvsekhvalnov/jose2go
An attacker controlled input of a PBES2 encrypted JWE blob can have a very large p2c value that, when decrypted, produces a denial-of-service...
GO-2023-2017 Denial of service vulnerability in github.com/weaviate/weaviate
A type conversion issue in Weaviate may allow a remote attack that would cause a denial of service...
GO-2023-1664 Denial of service via deflate compression bomb in github.com/crewjam/saml
Denial of service via deflate compression bomb in github.com/crewjam/saml...
GO-2023-1941 Panic when handling invalid request in MITM mode in github.com/elazarl/goproxy
An invalid request can cause a panic when running in MITM mode...
GO-2023-1572 Denial of service via crafted TIFF image in golang.org/x/image/tiff
An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service...
GO-2023-1526 Server-side request forgery in github.com/hakobe/paranoidhttp
Paranoidhttp before is vulnerable to SSRF because :: is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses...
GO-2023-1494 SQL injection in github.com/elgs/gosqljson
There is a potential for SQL injection through manipulation of the sqlStatement argument...
GO-2022-0528 Panic on crafted messages in github.com/containrrr/shoutrrr
Sending a message exactly 2000, 4000, or 6000 characters in length to Discord causes a panic...
GO-2022-0248 Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki
Manifest path extraction is vulnerable to directory traversal attacks. The ExtractPathManifest function permits file paths containing relative directory components "..", permitting files to reference arbitrary locations on the filesystem...
GO-2021-0086 Cross-site scripting in github.com/documize/community
HTML content in markdown is not sanitized during rendering, possibly allowing XSS if used to render untrusted user input...
GO-2020-0047 Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...
GO-2021-0098 Arbitrary code execution on Windows in github.com/git-lfs/git-lfs
Due to the standard library behavior of exec.LookPath on Windows a number of methods may result in arbitrary code execution when cloning or operating on untrusted Git repositories...
GO-2026-5048 Denial of service via unbounded map allocations in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2
The Avro map decoder accepts attacker-controlled block-element counts from the wire format and grows the destination map without enforcing an upper bound. A producer can declare an arbitrarily large map in one block, or chunked across many sub-limit blocks and exhaust process memory until the OOM...
GO-2026-5923 Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder
Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder...
GO-2026-5724 Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs
Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
GO-2026-5409 Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana
Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2026-5344 Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go...
GO-2026-4749 Mattermost fails to validate team-specific upload_file permissions in github.com/mattermost/mattermost-server
Mattermost fails to validate team-specific uploadfile permissions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fro...
GO-2026-4422 EVE Freely Allocates Buffer on The Stack With Data From Socket in github.com/lf-edge/eve
EVE Freely Allocates Buffer on The Stack With Data From Socket in github.com/lf-edge/eve...
GO-2026-4414 Alist has Insecure TLS Config in github.com/alist-org/alist
Alist has Insecure TLS Config in github.com/alist-org/alist...
GO-2025-3963 Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly
Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly...
GO-2025-3479 lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs
lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs...
GO-2025-3488 Unexpected memory consumption during token parsing in golang.org/x/oauth2
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...
GO-2025-3431 kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest
kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest...
GO-2025-3435 Kubewarden-Controller information leak via AdmissionPolicyGroup Resource in github.com/kubewarden/kubewarden-controller
Kubewarden-Controller information leak via AdmissionPolicyGroup Resource in github.com/kubewarden/kubewarden-controller...
GO-2025-3421 ParsePKCS1PrivateKey panic with partial keys in crypto/x509
Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed...
GO-2025-3381 notation-go's timestamp signature generation lacks certificate revocation check in github.com/notaryproject/notation-go
notation-go's timestamp signature generation lacks certificate revocation check in github.com/notaryproject/notation-go...
GO-2025-3368 Argument Injection via the URL field in github.com/go-git/go-git
Argument Injection via the URL field in github.com/go-git/go-git...
GO-2025-3363 Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada
Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada...
GO-2024-3272 CVE-2024-24425 in github.com/magma/magma
CVE-2024-24425 in github.com/magma/magma...
GO-2024-3240 Grafana org admin can delete pending invites in different org in github.com/grafana/grafana
Grafana org admin can delete pending invites in different org in github.com/grafana/grafana...
GO-2024-3224 Missing key verification in gost in github.com/ginuerzh/gost
Missing key verification in gost in github.com/ginuerzh/gost...
GO-2024-3095 Mattermost Plugin Channel Export excessive resource consumption in github.com/mattermost/mattermost-plugin-channel-export
Mattermost Plugin Channel Export excessive resource consumption in github.com/mattermost/mattermost-plugin-channel-export...
GO-2022-0923 Header dropping in traefik in github.com/traefik/traefik
Header dropping in traefik in github.com/traefik/traefik...
GO-2022-0779 Path traversal in github.com/ipfs/go-ipfs
Path traversal in github.com/ipfs/go-ipfs...
GO-2022-0794 Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements in github.com/weaveworks/weave
Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements in github.com/weaveworks/weave...
GO-2022-0647 Arbitrary File Write in Libcontainer in github.com/docker/docker
Arbitrary File Write in Libcontainer in github.com/docker/docker...
GO-2022-0638 Information Exposure in Docker Engine in github.com/docker/docker
Information Exposure in Docker Engine in github.com/docker/docker...
GO-2022-0518 Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd
Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd...