4632 matches found
GO-2024-3327 SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel...
GO-2022-1219 usememos/memos Denial of Service vulnerability in github.com/usememos/memos
usememos/memos Denial of Service vulnerability in github.com/usememos/memos...
GO-2023-2085 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server in github.com/argoproj/argo-cd
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server in github.com/argoproj/argo-cd...
GO-2023-1656 Answer vulnerable to Stored Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Stored Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1602 Denial of service via deflate decompression bomb in github.com/russellhaering/gosaml2
A bug in SAML authentication library can result in Denial of Service attacks. Attackers can craft a "deflate"-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process bein...
GO-2022-1155 Panic in github.com/ipfs/go-merkledag
A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. Additionally, use of the ProtoNode.SetCidBuilder method to set non-functioning CidBuilder such as one that refers to a multihash where ...
GO-2022-0646 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...
GO-2024-3305 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2022-1266 usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos...
GO-2023-1542 Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
Pterodactyl Wings contains UNIX Symbolic Link Symlink Following in github.com/pterodactyl/wings...
GO-2023-1294 easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt
easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt...
GO-2024-2729 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2023-1713 Path traversal in github.com/sjqzhang/go-fastdfs
An attacker can craft a remote request to upload a file to "/group1/upload" that uses path traversal to instead write the file contents to an attacker controlled path on the server...
GO-2021-0069 Panic during division of very large numbers in math/big
A number of math/big.Int methods can panic when provided large inputs due to a flawed division method...
GO-2026-5935 netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil...
GO-2026-5355 Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName in github.com/grafana/grafana-operator...
GO-2022-1032 Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package in github.com/cloudflare/goflow...
GO-2022-0517 Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd
Argo CD SSO users vulnerable to Cross-site Scripting in github.com/argoproj/argo-cd...
GO-2022-0459 Smokescreen SSRF via deny list bypass (square brackets) in github.com/stripe/smokescreen
Smokescreen SSRF via deny list bypass square brackets in github.com/stripe/smokescreen...
GO-2023-1660 Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
Answer vulnerable to Business Logic Errors in github.com/answerdev/answer...
GO-2023-1617 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2024-3054 Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast
Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast...
GO-2024-2981 SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend
SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend...
GO-2023-1923 Panic when handling invalid HAProxy PROXY v2 request in github.com/mastercactapus/proxyprotocol
Panic when handling invalid HAProxy PROXY v2 request in github.com/mastercactapus/proxyprotocol...
GO-2022-0564 Signature forgery in github.com/biscuit-auth/biscuit-go
An attacker can forge Biscuit v1 tokens with any access level. There is no known workaround for Biscuit v1. The Biscuit v2 specification avoids this vulnerability...
GO-2023-1993 Helm Improper Certificate Validation in helm.sh/helm
Helm Improper Certificate Validation in helm.sh/helm...
GO-2023-1553 Answer vulnerable to Race Condition in github.com/answerdev/answer
Answer vulnerable to Race Condition in github.com/answerdev/answer...
GO-2024-2905 Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter
Openshift/telemeter: iss check during jwt authentication can be bypassed in github.com/openshift/telemeter...
GO-2024-2723 Apache Solr Operator liveness and readiness probes may leak basic auth credentials in github.com/apache/solr-operator
Apache Solr Operator liveness and readiness probes may leak basic auth credentials in github.com/apache/solr-operator...
GO-2022-1178 JWT leak in github.com/bradleyfalzon/ghinstallation
Errors returned by ghinstallation.Transport can include the JWT used for the failed operation. If the error is exposed to an untrusted party, this JWT could be extracted and used to authenticate further requests...
GO-2022-1114 ZipSlip when unzipping files in github.com/duke-git/lancet
A ZipSlip vulnerability exists when using the fileutil package to unzip files...
GO-2022-0603 Panic in gopkg.in/yaml.v3
An issue in the Unmarshal function can cause a program to panic when attempting to deserialize invalid input...
GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintaine...
GO-2025-3542 LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI
LocalAI Cross-Site Scripting XSS vulnerability in its search functionality in github.com/mudler/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3036 cortex establishes TLS connections with `InsecureSkipVerify` set to `true` in github.com/cortexproject/cortex
cortex establishes TLS connections with InsecureSkipVerify set to true in github.com/cortexproject/cortex...
GO-2024-2831 ATX protocol validation problem in github.com/spacemeshos/go-spacemesh
Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier but not the latest ATX as previous breaks this...
GO-2023-1611 Path traversal in github.com/gookit/goutil
fsutil.Unzip is vulnerable to path traversal attacks due to improper validation of paths...
GO-2023-1559 Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfsnode
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by a bogus fanout parameter in the HAMT directory nodes. There are no known workarounds users are advised to...
GO-2021-0100 Denial of service via deadlock in github.com/containers/storage
Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an...
GO-2021-0070 Privilege escalation in github.com/opencontainers/runc
GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will improperly interpret numeric UIDs as usernames. If the method is used without verifying that usernames are formatted as expected, it may allow a user to gain unexpected privileges...
GO-2021-0095 Sensitive information exposure in github.com/google/go-tpm
Due to repeated usage of a XOR key an attacker that can eavesdrop on the TPM 1.2 transport is able to calculate usageAuth for keys created using CreateWrapKey, despite it being encrypted, allowing them to use the created key...
GO-2022-1171 Alist vulnerable to Path Traversal in github.com/alist-org/alist
Alist vulnerable to Path Traversal in github.com/alist-org/alist...
GO-2022-0350 Code injection in Stripe CLI on windows in github.com/stripe/stripe-cli
Code injection in Stripe CLI on windows in github.com/stripe/stripe-cli...
GO-2024-3057 NetBird uses a static initialization vector (IV) in github.com/netbirdio/netbird
NetBird uses a static initialization vector IV in github.com/netbirdio/netbird...
GO-2024-2777 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax
IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...
GO-2024-2882 github.com/huandu/facebook may expose access_token in error message.
github.com/huandu/facebook may expose accesstoken in error message...
GO-2024-2641 Insecure Variable Substitution in Vela in github.com/go-vela/worker
Insecure Variable Substitution in Vela in github.com/go-vela/worker...
GO-2023-2115 CSRF token reuse vulnerability in github.com/gofiber/fiber/v2
A cross-site request forgery vulnerability in this package can allow an attacker to inject arbitrary values and forge malicious requests on behalf of a user. The attacker may inject arbitrary values without any authentication, or perform various malicious actions on behalf of an authenticated use...
GO-2022-1201 Timing attack in github.com/openshift/osin
Client secret checks are vulnerable to timing attacks, which could permit an attacker to determine client secrets...
GO-2022-1113 Server-side request forgery in github.com/oam-dev/kubevela
When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability...