4692 matches found
GO-2024-3357 Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome
Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome...
GO-2025-3362 SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel...
GO-2024-3354 Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad
Hashicorp Nomad Incorrect Privilege Assignment vulnerability in github.com/hashicorp/nomad...
GO-2024-3331 Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego
Beego has Collision Hazards of MD5 in Cache Key Filenames in github.com/beego/beego...
GO-2024-3312 CA certificate sign check bypass in github.com/canonical/lxd
CA certificate sign check bypass in github.com/canonical/lxd...
GO-2024-3284 PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb
PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3290 Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium...
GO-2024-3271 Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone
Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata in github.com/rclone/rclone...
GO-2024-3260 Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron
Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron...
GO-2024-3242 Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul
Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul...
GO-2024-3161 Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher
Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3139 ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel
ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3110 Can be confused to create empty files/directories on the host in github.com/opencontainers/runc
Can be confused to create empty files/directories on the host in github.com/opencontainers/runc...
GO-2024-3089 Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server
Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server...
GO-2022-1251 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1067 Bifrost vulnerable to authentication check flaw that leads to authentication bypass in github.com/brokercap/Bifrost
Bifrost vulnerable to authentication check flaw that leads to authentication bypass in github.com/brokercap/Bifrost...
GO-2022-0830 Denial of Service in Gitea in code.gitea.io/gitea
Denial of Service in Gitea in code.gitea.io/gitea...
GO-2022-0832 Cross-site Scripting in Gitea in code.gitea.io/gitea
Cross-site Scripting in Gitea in code.gitea.io/gitea...
GO-2022-0808 Improper Certificate Handling in github.com/containous/traefik
Improper Certificate Handling in github.com/containous/traefik...
GO-2022-0560 Nomad Spread Job Stanza May Trigger Panic in Servers in github.com/hashicorp/nomad
Nomad Spread Job Stanza May Trigger Panic in Servers in github.com/hashicorp/nomad...
GO-2022-0413 Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium
Exposure of Sensitive Information in Pomerium in github.com/pomerium/pomerium...
GO-2022-0416 Podman's default inheritable capabilities for linux container not empty in github.com/containers/podman
Podman's default inheritable capabilities for linux container not empty in github.com/containers/podman...
GO-2022-0270 Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server...
GO-2022-0250 Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki
Infinite open connection causes OctoRPKI to hang forever in github.com/cloudflare/cfrpki...
GO-2023-2068 Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device in github.com/schollz/croc
Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device in github.com/schollz/croc...
GO-2023-1800 Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium
Pomerium vulnerable to Incorrect Authorization with specially crafted requests in github.com/pomerium/pomerium...
GO-2023-1718 Answer vulnerable to Exposure of Sensitive Information Through Metadata in github.com/answerdev/answer
Answer vulnerable to Exposure of Sensitive Information Through Metadata in github.com/answerdev/answer...
GO-2023-1654 Answer has Observable Response Discrepancy in github.com/answerdev/answer
Answer has Observable Response Discrepancy in github.com/answerdev/answer...
GO-2023-1614 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1619 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1628 Kubernetes vulnerable to path traversal in k8s.io/kubernetes
Kubernetes vulnerable to path traversal in k8s.io/kubernetes...
GO-2024-3011 pREST vulnerable to jwt bypass + sql injection in github.com/prest/prest
pREST vulnerable to jwt bypass + sql injection in github.com/prest/prest...
GO-2024-2984 Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2
Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2...
GO-2024-2512 Classic builder cache poisoning in github.com/docker/docker
Classic builder cache poisoning in github.com/docker/docker...
GO-2024-2509 Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault
Improper Authentication in HashiCorp Vault in github.com/hashicorp/vault...
GO-2024-2931 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2024-2734 1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel
1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2024-2843 Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana
Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2581 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs...
GO-2024-2571 Invalid block proposal in github.com/cosmos/cosmos-sdk
Invalid block proposal in github.com/cosmos/cosmos-sdk...
GO-2024-2638 ValidateVoteExtensions function in Cosmos SDK may allow incorrect voting power assumptions in github.com/cosmos/cosmos-sdk
The default ValidateVoteExtensions helper function infers total voting power based on the injected VoteExtension, which are injected by the proposer. If your chain utilizes the ValidateVoteExtensions helper in ProcessProposal, a dishonest proposer can potentially mutate voting power of each...
GO-2024-2454 Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2
Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2...
GO-2023-1717 Improper handling of keyspaces in vitess.io/vitess
Users can create a keyspace containing '/'. Future attempts to view keyspaces from some tools including VTAdmin and "vtctldclient GetKeyspaces" receive an error...
GO-2022-0233 Resource exhaustion in github.com/pires/go-proxyproto
The PROXY protocol server does not impose a timeout on reading the header from new connections, allowing a malicious client to cause resource exhaustion and a denial of service by opening many connections and sending no data on them. v0.6.0 of the proxyproto package adds support for a user-define...
GO-2020-0006 Denial of service via open idle connection in github.com/miekg/dns
An attacker may prevent TCP connections to a Server by opening a connection and leaving it idle, until the connection is closed by the server no other connections will be accepted...
GO-2020-0013 Man-in-the-middle attack in golang.org/x/crypto/ssh
By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set...
GO-2020-0014 Infinite loop due to improper handling of "select" tags in golang.org/x/net/html
html.Parse does not properly handle "select" tags, which can lead to an infinite loop. If parsing user supplied input, this may be used as a denial of service vector...
GO-2026-6615 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log...
GO-2026-6560 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenantid filter in github.com/hatchet-dev/hatchet...
GO-2026-6324 Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances in github.com/portainer/portainer
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...