4632 matches found
GO-2024-3235 Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server
Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server...
GO-2024-3204 VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder
VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder...
GO-2024-3191 Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault
Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault...
GO-2024-3167 Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
GO-2024-3172 Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer
Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-3133 Chaosblade vulnerable to OS command execution in github.com/chaosblade-io/chaosblade
Chaosblade vulnerable to OS command execution in github.com/chaosblade-io/chaosblade...
GO-2024-3114 Nuclei Template Signature Verification Bypass in github.com/projectdiscovery/nuclei
Nuclei Template Signature Verification Bypass in github.com/projectdiscovery/nuclei...
GO-2022-1256 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1191 usememos/memos vulnerable to account takeover due to improper access control in github.com/usememos/memos
usememos/memos vulnerable to account takeover due to improper access control in github.com/usememos/memos...
GO-2022-1138 owncast is vulnerable to SQL Injection in github.com/owncast/owncast
owncast is vulnerable to SQL Injection in github.com/owncast/owncast...
GO-2022-0892 Improper Restriction of Excessive Authentication Attempts in Argo API in github.com/argoproj/argo-cd
Improper Restriction of Excessive Authentication Attempts in Argo API in github.com/argoproj/argo-cd...
GO-2022-0874 Incorrect Authorization in HashiCorp Consul in github.com/hashicorp/consul
Incorrect Authorization in HashiCorp Consul in github.com/hashicorp/consul...
GO-2022-0882 Observable Discrepancy in Argo in github.com/argoproj/argo-cd
Observable Discrepancy in Argo in github.com/argoproj/argo-cd...
GO-2022-0840 Allocation of Resources Without Limits or Throttling in HashiCorp Nomad in github.com/hashicorp/nomad
Allocation of Resources Without Limits or Throttling in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0818 Missing Authorization in Harbor in github.com/goharbor/harbor
Missing Authorization in Harbor in github.com/goharbor/harbor...
GO-2022-0749 OS Command Injection in gogs in gogs.io/gogs
OS Command Injection in gogs in gogs.io/gogs...
GO-2022-0454 Login screen allows message spoofing if SSO is enabled in github.com/argoproj/argo-cd
Login screen allows message spoofing if SSO is enabled in github.com/argoproj/argo-cd...
GO-2022-0452 Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc
Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc...
GO-2022-0372 Subdomain Takeover in Interactsh server in github.com/projectdiscovery/interactsh
Subdomain Takeover in Interactsh server in github.com/projectdiscovery/interactsh...
GO-2022-0344 containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd
containerd CRI plugin: Insecure handling of image volumes in github.com/containerd/containerd...
GO-2022-0302 SQL injection in github.com/navidrome/navidrome
SQL injection in github.com/navidrome/navidrome...
GO-2022-0291 Unsafe inline XSS in pasting DOM element into chat in github.com/owncast/owncast
Unsafe inline XSS in pasting DOM element into chat in github.com/owncast/owncast...
GO-2023-2004 1Panel O&M management panel has a background arbitrary file reading vulnerability in github.com/1Panel-dev/1Panel
1Panel O&M management panel has a background arbitrary file reading vulnerability in github.com/1Panel-dev/1Panel...
GO-2023-1945 HashiCorp Consul Access Restriction Bypass in github.com/hashicorp/consul
HashiCorp Consul Access Restriction Bypass in github.com/hashicorp/consul...
GO-2023-1683 AppArmor bypass with symlinked /proc in github.com/opencontainers/runc
AppArmor bypass with symlinked /proc in github.com/opencontainers/runc...
GO-2023-1463 KubePi may allow unauthorized access to system API in github.com/KubeOperator/kubepi
KubePi may allow unauthorized access to system API in github.com/KubeOperator/kubepi...
GO-2024-3072 Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium...
GO-2024-3061 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2024-3035 Filestash skips TLS certificate verification process when sending out email verification codes in github.com/mickael-kerjean/filestash
Filestash skips TLS certificate verification process when sending out email verification codes in github.com/mickael-kerjean/filestash...
GO-2024-2962 Output of "go env" does not sanitize values in cmd/go
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...
GO-2024-2567 Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx
Pipeline can panic when PgConn is busy or closed...
GO-2024-2517 Grafana XSS in header column rename in github.com/grafana/grafana
Grafana XSS in header column rename in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2928 SQL injection vulnerability in Gin-vue-admin in github.com/flipped-aurora/gin-vue-admin
SQL injection vulnerability in Gin-vue-admin in github.com/flipped-aurora/gin-vue-admin...
GO-2024-2801 Calico privilege escalation vulnerability in github.com/projectcalico/calico
Calico privilege escalation vulnerability in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2718 Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign
Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign...
GO-2024-2877 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd...
GO-2024-2867 Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana
Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2757 Buffer Overflow in gitea in code.gitea.io/gitea
Buffer Overflow in gitea in code.gitea.io/gitea...
GO-2024-2568 Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium
Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium...
GO-2024-2813 Some CORS middleware allow untrusted origins in github.com/jub0bs/cors
Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...
GO-2024-2826 Denial of service attack by triggering unbounded memory usage in vitess.io/vitess
When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service...
GO-2024-2682 Denial of service via connection starvation in github.com/quic-go/quic-go
An attacker can cause its peer to run out of memory by sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRECONNECTIONID frame. The attacker can prevent the receiver from sending out the vast...
GO-2024-2654 Denial of service in github.com/argoproj/argo-cd/v2
Application may crash due to concurrent writes, leading to a denial of service. An attacker can crash the application continuously, making it impossible for legitimate users to access the service. Authentication is not required in the attack...
GO-2024-2538 Symlink attack in github.com/hashicorp/nomad
Symlink attack in github.com/hashicorp/nomad...
GO-2023-2328 HTTP request body disclosure in github.com/go-resty/resty/v2
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buff...
GO-2022-0998 Improper blob verification in github.com/sigstore/cosign
Improper blob verification in github.com/sigstore/cosign...
GO-2023-2101 Incorrect exponentiation results in github.com/consensys/gnark-crypto
Incorrect exponentiation results in github.com/consensys/gnark-crypto...
GO-2023-1988 Improper rendering of text nodes in golang.org/x/net/html
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...
GO-2023-1859 Padding oracle vulnerability in github.com/lestrrat-go/jwx
AES-CBC decryption is vulnerable to a timing attack which may permit an attacker to recover the plaintext of JWE data...
GO-2023-1826 Signature validation bypass in github.com/moov-io/signedxml
Signature validation canonicalizes the input XML document before validating the signature. Parsing the uncanonicalized and canonicalized forms can produce different results. An attacker can exploit this variation to bypass signature validation. Users of signature validation must only parse the...