4692 matches found
GO-2025-3376 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset
JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh in github.com/MicahParks/jwkset...
GO-2024-3314 Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo...
GO-2024-3302 ICMP Packet Too Large Injection Attack on Linux in github.com/quic-go/quic-go
ICMP Packet Too Large Injection Attack on Linux in github.com/quic-go/quic-go...
GO-2024-3300 sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo
sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo...
GO-2024-3254 Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus
Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus...
GO-2024-3234 Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server...
GO-2024-3226 Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows
Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows...
GO-2024-3179 Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium...
GO-2024-3135 HTTP client can manipulate custom HTTP headers that are added by Traefik in github.com/traefik/traefik
HTTP client can manipulate custom HTTP headers that are added by Traefik in github.com/traefik/traefik...
GO-2024-3157 Mellium allows Authentication Bypass by Spoofing in mellium.im/xmpp
Mellium allows Authentication Bypass by Spoofing in mellium.im/xmpp...
GO-2022-1253 usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos
usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos...
GO-2022-1023 Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication in github.com/brokercap/Bifrost
Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication in github.com/brokercap/Bifrost...
GO-2022-0831 SQL Injection in Gogs in gogs.io/gogs
SQL Injection in Gogs in gogs.io/gogs...
GO-2022-0822 Open Redirect in gogs.io/gogs
Open Redirect in gogs.io/gogs...
GO-2022-0784 containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd
containerd-shim API Exposed to Host Network Containers in github.com/containerd/containerd...
GO-2022-0547 aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator
aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9 in sigs.k8s.io/aws-iam-authenticator...
GO-2022-0495 DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd
DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd...
GO-2022-0498 Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd
Argo CD's external URLs for Deployments can include JavaScript in github.com/argoproj/argo-cd...
GO-2022-0448 Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2
Improper path handling in Kustomization files allows for denial of service in github.com/fluxcd/flux2...
GO-2022-0440 Woodpecker allows cross-site scripting (XSS) via build logs in github.com/woodpecker-ci/woodpecker
Woodpecker allows cross-site scripting XSS via build logs in github.com/woodpecker-ci/woodpecker...
GO-2022-0304 Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd
Path traversal and dereference of symlinks in Argo CD in github.com/argoproj/argo-cd...
GO-2022-0260 Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller
Privilege escalation to cluster admin on multi-tenant environments in github.com/fluxcd/kustomize-controller...
GO-2023-2055 Terraform allows arbitrary file write during the `init` operation in github.com/hashicorp/terraform
Terraform allows arbitrary file write during the init operation in github.com/hashicorp/terraform...
GO-2023-1959 Kubernetes arbitrary file overwrite in k8s.io/kubernetes
Kubernetes arbitrary file overwrite in k8s.io/kubernetes...
GO-2023-1922 Gitea XSS Vulnerability in code.gitea.io/gitea
Gitea XSS Vulnerability in code.gitea.io/gitea...
GO-2023-1898 HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured in github.com/hashicorp/boundary
HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured in github.com/hashicorp/boundary...
GO-2023-1795 malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor
malformed proposed intoto entries can cause a panic in github.com/sigstore/rekor...
GO-2023-1774 Answer Missing Authorization vulnerability in github.com/answerdev/answer
Answer Missing Authorization vulnerability in github.com/answerdev/answer...
GO-2023-1735 A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation in github.com/clusternet/clusternet
A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation in github.com/clusternet/clusternet...
GO-2023-1658 Answer vulnerable to Business Logic Errors in github.com/answerdev/answer
Answer vulnerable to Business Logic Errors in github.com/answerdev/answer...
GO-2024-3009 snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd
snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2442 Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport
Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2024-2556 APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server
APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2476 Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2595 Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2848 Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana
Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2727 Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation
Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation...
GO-2024-2744 Access control change may take longer than expected in github.com/authelia/authelia/v4
If the file authentication backend is being used, the ewatch option is set to true, the refresh interval is configured to a non-disabled value, and an administrator changes a user's groups, then that user may be able to access resources that their previous groups had access to...
GO-2024-2490 Path traversal in github.com/anchore/stereoscope
It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory...
GO-2023-2333 Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark
Range checker gadget allows wider inputs than allowed in github.com/consensys/gnark...
GO-2022-0461 Unbounded memory consumption in github.com/pion/dtls/v2
Attacker can cause unbounded memory consumption. The Pion DTLS client and server buffer handshake data with no upper limit, permitting an attacker to cause unbounded memory consumption by sending an unterminated handshake...
GO-2021-0097 Panic due to out-of-bounds read in github.com/dhowden/tag
Due to improper bounds checking, a number of methods can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack...
GO-2026-6639 Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis
Anubis: Policy bypass via client controlled X-Original-URI header in github.com/TecharoHQ/anubis...
GO-2026-6629 Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...
GO-2026-6592 Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle
Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle...
GO-2026-6591 ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel
ZITADEL: Actions V1 sandbox escape: host file read via require in github.com/zitadel/zitadel...
GO-2026-6576 Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve
Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve...
GO-2026-6529 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...
GO-2026-6462 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone...
GO-2026-6469 ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel
ZITADEL: Missing Token Expiration exp Validation in JWT IdP Provider in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...