4632 matches found
GO-2022-0491 Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go
Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users in github.com/edgexfoundry/app-functions-sdk-go...
GO-2022-0392 Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum
Denial of service in go-ethereum due to CVE-2020-28362 in github.com/ethereum/go-ethereum...
GO-2024-3075 CVE-2024-7646 in github.com/kubernetes/ingress-nginx
CVE-2024-7646 in github.com/kubernetes/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2024-3046 memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos
memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos...
GO-2024-3049 memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos
memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos...
GO-2024-3025 Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server
Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server...
GO-2024-2974 Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos
Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos...
GO-2024-2434 CubeFS leaks users key in logs in github.com/cubefs/cubefs
CubeFS leaks users key in logs in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit t...
GO-2024-2488 HashiCorp Vault Authentication bypass in github.com/hashicorp/vault
HashiCorp Vault Authentication bypass in github.com/hashicorp/vault...
GO-2022-1144 Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate...
GO-2022-1052 Uncontrolled resource consumption during consensus in github.com/tendermint/tendermint
Mishandling of timestamps during consensus process can cause a denial of service. While reaching consensus, different tendermint nodes can observe a different timestamp for a consensus evidence. This mismatch can cause the evidence to be invalid, upon which the node producing the evidence will be...
GO-2022-0586 Resource exhaustion in github.com/hashicorp/go-getter and related modules
Malicious HTTP responses can cause a number of misbehaviors, including overwriting local files, resource exhaustion, and panics. Protocol switching, endless redirect, and configuration bypass are possible through abuse of custom HTTP response header processing. Arbitrary host access is possible...
GO-2021-0226 Cross-site scripting in net/http/cgi and net/http/fcgi
When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response. The Content-Type header is now set based on the contents of the...
GO-2021-0109 Improper handling of token revocation in github.com/ory/fosite
Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage...
GO-2020-0007 Improper input validation in github.com/seccomp/libseccomp-golang
Filters containing rules with multiple syscall arguments are improperly constructed, such that all arguments are required to match rather than any of the arguments AND is used rather than OR. These filters can be bypassed by only specifying a subset of the arguments due to this behavior...
GO-2021-0081 Insufficiently Protected Credentials in github.com/containers/image
The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, allowing an attacker that is able to MITM the connection to steal credentials...
GO-2021-0071 Race condition in github.com/lxc/lxd
A race between chown and chmod operations during a container filesystem shift may allow a user who can modify the filesystem to chmod an arbitrary path of their choice, rather than the expected path...
GO-2021-0061 Denial of service in gopkg.in/yaml.v2
Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector...
GO-2020-0041 Path Traversal in github.com/unknwon/cae
Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...
GO-2025-3812 File Browser’s insecure JWT handling can lead to session replay attacks after logout in github.com/filebrowser/filebrowser
File Browser’s insecure JWT handling can lead to session replay attacks after logout in github.com/filebrowser/filebrowser...
GO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...
GO-2025-3472 SSRF in sliver teamserver in github.com/bishopfox/sliver
SSRF in sliver teamserver in github.com/bishopfox/sliver...
GO-2022-1244 usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts in github.com/usememos/memos
usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts in github.com/usememos/memos...
GO-2023-1961 Minikube RCE via DNS Rebinding in k8s.io/minikube
Minikube RCE via DNS Rebinding in k8s.io/minikube...
GO-2023-1659 Answer vulnerable to Authentication Bypass by Capture-replay in github.com/answerdev/answer
Answer vulnerable to Authentication Bypass by Capture-replay in github.com/answerdev/answer...
GO-2023-1618 Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer
Answer vulnerable to Cross-site Scripting in github.com/answerdev/answer...
GO-2023-1560 Path Traversal in gin-vue-admin in github.com/flipped-aurora/gin-vue-admin
Path Traversal in gin-vue-admin in github.com/flipped-aurora/gin-vue-admin...
GO-2023-1388 Gitops Run insecure communication in github.com/weaveworks/weave-gitops
Gitops Run insecure communication in github.com/weaveworks/weave-gitops...
GO-2023-1465 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2024-2968 ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel
ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2024-2959 Session Middleware Token Injection Vulnerability in github.com/gofiber/fiber
Session Middleware Token Injection Vulnerability in github.com/gofiber/fiber...
GO-2024-2440 Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws
Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws...
GO-2024-2938 LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI
LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2024-2775 IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax
IBAX go-ibax vulnerable to SQL injection in github.com/IBAX-io/go-ibax...
GO-2024-2642 Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings...
GO-2024-2702 Code injection vulnerability in github.com/flipped-aurora/gin-vue-admin/server
Gin-vue-admin has a code injection vulnerability in the backend. In the Plugin System - Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service',...
GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
GO-2023-1568 Path traversal on Windows in path/filepath
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative if invalid path into an absolute path could enable a directory traversal...
GO-2022-0979 Incorrect DNSSEC validation due to unchecked owner names in github.com/peterzen/goresolver
DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for...
GO-2022-0761 Improper input validation in net/http and net/http/cgi
An input validation flaw in the CGI components allows the HTTPPROXY environment variable to be set by the incoming Proxy header, which changes where Go by default proxies all outbound HTTP requests. This environment variable is also used to set the outgoing proxy, enabling an attacker to insert a...
GO-2022-0400 Race condition in github.com/ntbosscher/gobase
A race condition can cause incorrect HTTP request routing...
GO-2022-0213 Panic on invalid DSA public keys in crypto/dsa
Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server tha...
GO-2022-0289 Misdirected I/O in syscall
When a Go program running on a Unix system is out of file descriptors and calls syscall.ForkExec including indirectly by using the os/exec package, syscall.ForkExec can close file descriptor 0 as it fails. If this happens or can be provoked repeatedly, it can result in misdirected I/O such as...
GO-2021-0160 Incorrect calculation affecting RSA computations in math/big
Int.Exp Montgomery mishandled carry propagation and produced an incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors. This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibl...
GO-2020-0032 Path traversal in github.com/goadesign/goa
Due to improper sanitization of user input, Controller.FileHandler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
GO-2022-1080 OpenFGA Authorization Bypass via tupleset wildcard in github.com/openfga/openfga
OpenFGA Authorization Bypass via tupleset wildcard in github.com/openfga/openfga...
GO-2022-0971 Elrond-go has improper initialization in github.com/ElrondNetwork/elrond-go
Elrond-go has improper initialization in github.com/ElrondNetwork/elrond-go...
GO-2023-2426 ewen-lbh/ffcss Late-Unicode normalization vulnerability in github.com/ewen-lbh/ffcss
ewen-lbh/ffcss Late-Unicode normalization vulnerability in github.com/ewen-lbh/ffcss...
GO-2023-2067 Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input in github.com/contribsys/faktory
Faktory Web Dashboard can lead to denial of serviceDOS via malicious user input in github.com/contribsys/faktory...