4692 matches found
GO-2025-3424 Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x
Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0 in github.com/Xe/x. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-3343 Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm
Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm...
GO-2024-3339 Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk
Transaction decoding may result in a stack overflow or resource exhaustion in github.com/cosmos/cosmos-sdk...
GO-2024-3335 Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary
Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary...
GO-2024-3306 Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess...
GO-2024-3218 Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht
Content Censorship in the InterPlanetary File System IPFS via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht...
GO-2024-3304 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2024-3250 Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt
Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt...
GO-2024-3251 Safearchive Path Traversal vulnerability in github.com/google/safearchive
Safearchive Path Traversal vulnerability in github.com/google/safearchive...
GO-2024-3227 Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server
Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server...
GO-2024-3153 Navidrome has Multiple SQL Injections and ORM Leak in github.com/navidrome/navidrome
Navidrome has Multiple SQL Injections and ORM Leak in github.com/navidrome/navidrome...
GO-2024-3134 CoreDNS Cache Poisoning via a birthday attack in github.com/coredns/coredns
CoreDNS enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...
GO-2022-1225 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2022-1006 Casdoor arbitrary file write vulnerability in github.com/casdoor/casdoor
Casdoor arbitrary file write vulnerability in github.com/casdoor/casdoor...
GO-2022-0983 ANSI escape characters not filtered in kubectl in k8s.io/kubernetes
ANSI escape characters not filtered in kubectl in k8s.io/kubernetes...
GO-2022-0970 elrond-go MultiESDTNFTTransfer call on a SC address with missing function name in github.com/ElrondNetwork/elrond-go
elrond-go MultiESDTNFTTransfer call on a SC address with missing function name in github.com/ElrondNetwork/elrond-go...
GO-2022-0910 Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes
Files or Directories Accessible to External Parties in kubernetes in k8s.io/kubernetes...
GO-2022-0815 Improper input validation in umoci in github.com/opencontainers/umoci
Improper input validation in umoci in github.com/opencontainers/umoci...
GO-2022-0803 containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd
containerd v1.2.x can be coerced into leaking credentials during image pull in github.com/containerd/containerd...
GO-2022-0708 Arbitrary File Override in Docker Engine in github.com/docker/docker
Arbitrary File Override in Docker Engine in github.com/docker/docker...
GO-2022-0623 Invalid session token expiration in github.com/hashicorp/vault
Invalid session token expiration in github.com/hashicorp/vault...
GO-2022-0620 HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault
HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0 in github.com/hashicorp/vault...
GO-2022-0602 Email relay in Apache Traffic Control in github.com/apache/trafficcontrol
Email relay in Apache Traffic Control in github.com/apache/trafficcontrol...
GO-2022-0600 HashiCorp Nomad Artifact Download Race Condition in github.com/hashicorp/nomad
HashiCorp Nomad Artifact Download Race Condition in github.com/hashicorp/nomad...
GO-2022-0309 Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea
Cross Site Request Forgery in Gitea in github.com/go-gitea/gitea...
GO-2023-2066 NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server
NATS nats-server allows directory traversal via unintended path to a management action in github.com/nats-io/nats-server...
GO-2023-1977 Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes
Kubernetes can trigger deletion of arbitrary files from the nodes where containers are running in k8s.io/kubernetes...
GO-2023-1985 Kubernetes in OpenShift3 Access Control Misconfiguration in k8s.io/kubernetes
Kubernetes in OpenShift3 Access Control Misconfiguration in k8s.io/kubernetes...
GO-2023-1995 Answer has Race Condition within a Thread in github.com/answerdev/answer
Answer has Race Condition within a Thread in github.com/answerdev/answer...
GO-2023-1865 Vega's validators able to submit duplicate transactions in code.vegaprotocol.io/vega
Vega's validators able to submit duplicate transactions in code.vegaprotocol.io/vega...
GO-2023-1864 Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes
Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes...
GO-2023-1901 Pipelines do not validate child UIDs in github.com/tektoncd/pipeline
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline...
GO-2023-1851 HashiCorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul
HashiCorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul...
GO-2023-1809 go package pydio cells vulnerable to cross-site scripting in github.com/pydio/cells
go package pydio cells vulnerable to cross-site scripting in github.com/pydio/cells...
GO-2023-1707 HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation in github.com/hashicorp/nomad
HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation in github.com/hashicorp/nomad...
GO-2023-1682 Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc
Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc...
GO-2023-1629 Kubernetes vulnerable to validation bypass in k8s.io/kubernetes
Kubernetes vulnerable to validation bypass in k8s.io/kubernetes...
GO-2023-1469 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2024-3059 CosmWasm wasmd has large address count in ValidateBasic in github.com/CosmWasm/wasmd
CosmWasm wasmd has large address count in ValidateBasic in github.com/CosmWasm/wasmd...
GO-2024-2972 Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs
Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs...
GO-2024-2550 MongoDB Tools Improper Certificate Validation vulnerability in github.com/mongodb/mongo-tools
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates. NOTE: this module uses its own versioning scheme that is not fully...
GO-2024-2449 Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport
Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2024-2929 Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher
Rancher's External RoleTemplates can lead to privilege escalation in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2024-2697 Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana
Grafana: Users outside an organization can delete a snapshot with its key in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2880 Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik...
GO-2024-2575 Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3
Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3...
GO-2024-2675 Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server
Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server...
GO-2024-2656 Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted, and traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent...
GO-2024-2453 Timing side channel in github.com/cloudflare/circl
Timing side channel in github.com/cloudflare/circl...
GO-2023-1990 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size width height appearing to be zero...