4632 matches found
GO-2021-0110 Token reuse in github.com/ory/fosite
Uniqueness of JWT IDs jti are not checked, allowing the JWT to be replayed...
GO-2021-0103 Denial of service in github.com/holiman/uint256
Due to improper bounds checking, certain mathematical operations can cause a panic via an out of bounds read. If this package is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...
GO-2020-0033 Path Traversal in aahframe.work
Due to improper sanitization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2020-0024 Infinite loop in github.com/btcsuite/go-socks
The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow...
GO-2020-0048 Denial of service in github.com/antchfx/xmlquery
LoadURL does not check the Content-Type of loaded resources, which can cause a panic due to nil pointer deference if the loaded resource is not XML. If user supplied URLs are loaded, this may be used as a denial of service vector...
GO-2026-6180 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
GO-2024-3076 Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog
Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog...
GO-2022-1261 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1179 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2022-1100 Vela Insecure Defaults in github.com/go-vela/server
Vela Insecure Defaults in github.com/go-vela/server...
GO-2022-0964 SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo
SFTPGo vulnerable to recovery codes abuse in github.com/drakkan/sftpgo...
GO-2022-0500 CloudCore UDS Server: Malicious Message can crash CloudCore in github.com/kubeedge/kubeedge
CloudCore UDS Server: Malicious Message can crash CloudCore in github.com/kubeedge/kubeedge...
GO-2023-2084 OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga
OpenFGA Vulnerable to DoS from circular relationship definitions in github.com/openfga/openfga...
GO-2024-3050 Meshery SQL Injection vulnerability in github.com/layer5io/meshery
Meshery SQL Injection vulnerability in github.com/layer5io/meshery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...
GO-2024-2784 Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher
Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher...
GO-2024-2798 Mattermost fails to limit the number of active sessions in github.com/mattermost/mattermost-server
Mattermost fails to limit the number of active sessions in github.com/mattermost/mattermost-server...
GO-2024-2669 API token secret ID leak to Sentinel in github.com/hashicorp/nomad
A vulnerability exists in Nomad where the API caller's ACL token secret ID is exposed to Sentinel policies...
GO-2023-1546 Denial of service in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
The otelhttp package of opentelemetry-go-contrib is vulnerable to a denial-of-service attack. The otelhttp package uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.requestcontentlength, http.server.responsecontentlength, and http.server.duration...
GO-2023-1621 Incorrect calculation on P256 curves in crypto/internal/nistec
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...
GO-2023-1600 Arbitrary code execution in github.com/kitabisa/teler-waf
Improper handling of payload with special characters, such as CR/LF and horizontal tab, can lead to execution of arbitrary JavaScript code...
GO-2022-1117 Insufficient verification of proofs in github.com/codenotary/immudb
In certain scenarios, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of...
GO-2022-1135 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule
Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace in github.com/clastix/capsule...
GO-2022-1099 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2023-2023 Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker
Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker...
GO-2023-2036 usememos/memos vulnerable to privilege escalation in github.com/usememos/memos
usememos/memos vulnerable to privilege escalation in github.com/usememos/memos...
GO-2023-1657 Answer has Guessable CAPTCHA in github.com/answerdev/answer
Answer has Guessable CAPTCHA in github.com/answerdev/answer...
GO-2024-2432 CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs
CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2022-0533 Path traversal via Clean on Windows in path/filepath
On Windows, the filepath.Clean function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack. For example, Clean".\c:" returns "c:"...
GO-2022-0220 DLL injection on Windows in runtime and syscall
Go on Windows misused certain LoadLibrary functionality, leading to DLL injection...
GO-2021-0319 Incorrect computation for some invalid field elements in crypto/elliptic
Some big.Int values that are not valid field elements negative or overflowing might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values...
GO-2025-3964 Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly
Dragonfly's directories created via os.MkdirAll are not checked for permissions in d7y.io/dragonfly...
GO-2024-3103 Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor
Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor...
GO-2022-1189 usememos/memos vulnerable to stored cross-site scripting (XSS) in github.com/usememos/memos
usememos/memos vulnerable to stored cross-site scripting XSS in github.com/usememos/memos...
GO-2022-1200 Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go
Elrond-GO processing: fallback search of SCRs when not found in the main cache in github.com/ElrondNetwork/elrond-go...
GO-2022-1132 Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information in github.com/grafana/synthetic-monitoring-agent
Grafana's default installation of synthetic-monitoring-agent exposes sensitive information in github.com/grafana/synthetic-monitoring-agent...
GO-2023-2038 Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos...
GO-2023-1871 SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb
SpiceDB's LookupResources may return partial results in github.com/authzed/spicedb...
GO-2023-1670 Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd
Argo CD authenticated but unauthorized users may enumerate Application names via the API in github.com/argoproj/argo-cd...
GO-2023-1512 Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd
Controller reconciles apps outside configured namespaces when sharding is enabled in github.com/argoproj/argo-cd...
GO-2024-3045 Meshery SQL Injection vulnerability in github.com/layer5io/meshery
Meshery SQL Injection vulnerability in github.com/layer5io/meshery...
GO-2024-2483 Grafana XSS via adding a link in General feature in github.com/grafana/grafana
Grafana XSS via adding a link in General feature in github.com/grafana/grafana...
GO-2024-2885 Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder
Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder...
GO-2024-2670 ACL security vulnerability in github.com/hashicorp/nomad
An ACL policy using a block without label can be applied to unexpected resources in Nomad, a distributed, highly available scheduler designed for effortless operations and management of applications...
GO-2022-0965 Unbounded recursion in JSON parsing in k8s.io/apimachinery
Unbounded recursion in JSON parsing allows malicious JSON input to cause excessive memory consumption or panics...
GO-2022-0217 Denial of service affecting P-521 and P-384 curves in crypto/elliptic
A DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU. These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some...
GO-2021-0264 Panic when opening certain archives in archive/zip
Previously, opening a zip with Reader.Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or ".." path elements. Open could also panic if passed the empty string directly as an argument. Now, any files in the zip whose name could not be...
GO-2026-4918 Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...
GO-2025-3491 Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher
Rancher allows an unauthenticated stack overflow in /v3-public/authproviders API in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2022-0783 JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium
JWT leak via Open Redirect in Programmatic access in github.com/pomerium/pomerium...
GO-2022-0491 Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go
Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go...