4632 matches found
GO-2022-1014 CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure in github.com/cri-o/cri-o
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure in github.com/cri-o/cri-o...
GO-2022-1015 SFTPGo WebClient vulnerable to Cross-site Scripting in github.com/drakkan/sftpgo
SFTPGo WebClient vulnerable to Cross-site Scripting in github.com/drakkan/sftpgo...
GO-2022-0985 Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker
Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/docker...
GO-2022-1065 Gitea vulnerable to Argument Injection in code.gitea.io/gitea
Gitea vulnerable to Argument Injection in code.gitea.io/gitea...
GO-2022-0919 Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings
Asymmetric Resource Consumption Amplification in Docker containers created by Wings in github.com/pterodactyl/wings...
GO-2022-0905 BLS Signature "Malleability" in github.com/filecoin-project/lotus
BLS Signature "Malleability" in github.com/filecoin-project/lotus...
GO-2022-0889 Authentication bypass by capture-replay in github.com/cosmos/ethermint
Authentication bypass by capture-replay in github.com/cosmos/ethermint...
GO-2022-0636 Man-in-the-Middle (MitM) in github.com/docker/docker
Man-in-the-Middle MitM in github.com/docker/docker...
GO-2022-0593 HashiCorp Consul Privilege Escalation Vulnerability in github.com/hashicorp/consul
HashiCorp Consul Privilege Escalation Vulnerability in github.com/hashicorp/consul...
GO-2022-0570 Path Traversal in file editor on Windows in Gogs in gogs.io/gogs
Path Traversal in file editor on Windows in Gogs in gogs.io/gogs...
GO-2022-0307 Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server
Incorrect Authorization in NATS nats-server in github.com/nats-io/nats-server...
GO-2023-2381 Traefik vulnerable to potential DDoS via ACME HTTPChallenge in github.com/traefik/traefik
Traefik vulnerable to potential DDoS via ACME HTTPChallenge in github.com/traefik/traefik...
GO-2023-1996 Answer Insufficient Session Expiration vulnerability in github.com/answerdev/answer
Answer Insufficient Session Expiration vulnerability in github.com/answerdev/answer...
GO-2023-1946 Kubernetes DoS Vulnerability in k8s.io/kubernetes
Kubernetes DoS Vulnerability in k8s.io/kubernetes...
GO-2023-1829 Notation vulnerable to denial of service from high number of artifact signatures in github.com/notaryproject/notation
Notation vulnerable to denial of service from high number of artifact signatures in github.com/notaryproject/notation...
GO-2023-1764 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints in github.com/mutagen-io/mutagen...
GO-2023-1723 SpiceDB binding metrics port to untrusted networks and can leak command-line flags in github.com/authzed/spicedb
SpiceDB binding metrics port to untrusted networks and can leak command-line flags in github.com/authzed/spicedb...
GO-2023-1700 Docker Swarm encrypted overlay network traffic may be unencrypted in github.com/docker/docker
Docker Swarm encrypted overlay network traffic may be unencrypted in github.com/docker/docker...
GO-2023-1761 imgproxy is vulnerable to Server-Side Request Forgery in github.com/imgproxy/imgproxy
imgproxy is vulnerable to Server-Side Request Forgery in github.com/imgproxy/imgproxy...
GO-2023-1661 Answer has Observable Timing Discrepancy in github.com/answerdev/answer
Answer has Observable Timing Discrepancy in github.com/answerdev/answer...
GO-2024-3074 Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium...
GO-2024-2977 IP addresses were encoded in the wrong byte order in github.com/google/nftables
IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which did not work as intended might block or not block the desired addresses...
GO-2024-2505 Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul
Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul...
GO-2024-2444 Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server
Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2927 Evmos is missing create validator check in github.com/evmos/evmos
Evmos is missing create validator check in github.com/evmos/evmos...
GO-2024-2769 Gitea allowed assignment of private issues in code.gitea.io/gitea
Gitea allowed assignment of private issues in code.gitea.io/gitea...
GO-2024-2648 Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server
Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server...
GO-2024-2451 IV collision in github.com/bincyber/go-sqlcrypter
There is a risk of an IV collision using the awskms or aesgcm provider. NIST SP 800-38D section 8.3 states that it is unsafe to encrypt more than 2^32 plaintexts under the same key when using a random IV. The limit could easily be reached given the use case of database column encryption...
GO-2024-2471 Chain halt panic in github.com/cometbft/cometbft
A vulnerability in CometBFT’s validation logic for VoteExtensionsEnableHeight can result in a chain halt when triggered through a governance parameter change proposal on an ABCI2 Application Chain. If a parameter change proposal including a VoteExtensionsEnableHeight modification is passed, nodes...
GO-2023-2379 Denial of service due to malicious parameters in github.com/lestrrat-go/jwx
The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its purpose is to intentionally slow down the key derivation function, making password brute-force...
GO-2023-2074 Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown
Parser out-of-bounds read caused by a malformed markdown input in github.com/gomarkdown/markdown...
GO-2022-1187 Open redirect vulnerability in github.com/go-macaron/i18n
A user controlled string could lead to open redirect...
GO-2022-0619 Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3
CORS filters that use an AllowedDomains configuration parameter can match domains outside the specified set, permitting an attacker to avoid the CORS policy. The AllowedDomains configuration parameter is documented as a list of allowed origin domains, but values in this list are applied as regula...
GO-2022-0252 Panic on misconfigured IP address in github.com/cloudflare/cfrpki
OctoRPKI crashes when a repository returns an ROA with a IP address that contains too many bits...
GO-2026-6441 Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc
In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules such as DENY referencing headers with uppercase or mixed-case characters, the rule fails to match, causing...
GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution
In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...
GO-2026-6138 Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td
Unbounded memory allocation in proto.UnencryptedMessage.Decode in github.com/gotd/td...
GO-2026-6183 Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone
During WebDAV Infinite Scale TUS upload creation, a transport failure can return a nil HTTP response along with an error. When handling the failure, rclone dereferences the nil response before checking the error, causing a panic that can crash the process in unrecovered contexts such as VFS mount...
GO-2026-6181 Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone
Verbose stack trace disclosure in RC API error responses in github.com/rclone/rclone...
GO-2026-6249 Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer
Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabilit...
GO-2026-6127 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission
Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission...
GO-2026-6231 Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution in github.com/kubev2v/assisted-migration-agent
Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution in github.com/kubev2v/assisted-migration-agent...
GO-2026-6140 Weaviate has an Improper Authorization issue in github.com/weaviate/weaviate
Weaviate has an Improper Authorization issue in github.com/weaviate/weaviate...
GO-2026-6062 Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev
Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev...
GO-2026-6069 Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private in gitea.dev
Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private in gitea.dev...
GO-2026-5116 Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah
Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation...
GO-2026-5736 Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server
Etcd RBAC bypass via PrevKv/lease in nested transactions in go.etcd.io/etcd/v3 in go.etcd.io/etcd/server...
GO-2026-5886 GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber
GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer in github.com/gofiber/fiber...
GO-2026-5336 Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git
Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git...