4632 matches found
GO-2024-2861 azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver
azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver...
GO-2023-1987 Large RSA keys can cause high CPU usage in crypto/tls
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...
GO-2023-1704 Excessive memory allocation in net/http and net/textproto
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than requir...
GO-2023-1558 Denial of service via malformed size parameters in github.com/ipfs/go-bitfield
When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happens when the size is a not a multiple of 8 or is negative. A workaround is to ensure size%8 == 0 && size = 0 yourself before calling NewBitfield or FromBytes...
GO-2023-1519 Command injection in github.com/rancher/wrangler
A command injection vulnerability exists in the Wrangler Git package. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host. A workaround is to sanitize input passed...
GO-2022-1188 Uncontrolled memory allocation in code.sajari.com/docconv
An attacker can remotely supply a specially crafted input that causes uncontrolled memory allocation...
GO-2022-1148 Resource exhaustion in github.com/libp2p/go-libp2p
go-libp2p is vulnerable to targeted resource exhaustion attacks. These attacks target libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory ultimately leading to the process getting killed by the host's operating system. While a...
GO-2022-1008 Unauthorized file access in github.com/containers/buildah
SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other...
GO-2022-0201 Remote command execution via "go get" command with cgo in cmd/go
The "go get" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature. When cgo is enabled, the build step during "go get" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support ...
GO-2022-0519 Improper validation of access tokens in github.com/flyteorg/flyteadmin
Improper validation of access tokens can permit use of expired tokens...
GO-2022-0272 Directory traversal in github.com/kataras/iris and github.com/kataras/iris/v12
The Context.UploadFormFiles function is vulnerable to directory traversal attacks, and can be made to write to arbitrary locations outside the destination directory. This vulnerability only occurs when built with Go versions prior to 1.17. Go 1.17 and later strip directory paths from filenames...
GO-2021-0317 Uncontrolled memory consumption in math/big
Rat.SetString had an overflow issue that can lead to uncontrolled memory consumption...
GO-2021-0240 Panic when reading certain archives in archive/zip
NewReader and OpenReader can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size...
GO-2021-0242 Panic on inputs with large exponents in math/big
Rat.SetString and Rat.UnmarshalText may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents...
GO-2020-0022 Out-of-bounds write in github.com/cloudflare/golz4
LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input...
GO-2020-0017 Authorization bypass in github.com/dgrijalva/jwt-go
If a JWT contains an audience claim with an array of strings, rather than a single string, and MapClaims.VerifyAudience is called with req set to false, then audience verification will be bypassed, allowing an invalid set of audiences to be provided...
GO-2026-5171 SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection in github.com/siyuan-note/siyuan/kernel
SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...
GO-2025-3736 Gokapi has stored XSS vulnerability in friendly name for API keys in github.com/forceu/gokapi
Gokapi has stored XSS vulnerability in friendly name for API keys in github.com/forceu/gokapi. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server
Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server...
GO-2024-3077 Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule
Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule...
GO-2022-0939 Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker in github.com/StevenWeathers/thunderdome-planning-poker
Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker in github.com/StevenWeathers/thunderdome-planning-poker...
GO-2022-0857 Information Exposure in Kubernetes in github.com/kubernetes/kubernetes
Information Exposure in Kubernetes in github.com/kubernetes/kubernetes...
GO-2022-0813 Authentication bypass by capture-replay in github.com/cosmos/ethermint
Authentication bypass by capture-replay in github.com/cosmos/ethermint...
GO-2022-0626 Insufficient Session Expiration in Kiali in github.com/kiali/kiali
Insufficient Session Expiration in Kiali in github.com/kiali/kiali...
GO-2022-0480 Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o
Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o...
GO-2022-0348 Account compromise in Evmos in github.com/tharsis/evmos
Account compromise in Evmos in github.com/tharsis/evmos...
GO-2023-1555 Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings
Pterodactyl Wings contains UNIX Symbolic Link Symlink Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings...
GO-2024-3063 RBAC Roles for `etcd` created by Kamaji are not disjunct in github.com/clastix/kamaji
RBAC Roles for etcd created by Kamaji are not disjunct in github.com/clastix/kamaji...
GO-2024-2511 Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault
Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault...
GO-2024-2715 Evmos transaction execution not accounting for all state transition after interaction with precompiles in github.com/evmos/evmos
Evmos transaction execution not accounting for all state transition after interaction with precompiles in github.com/evmos/evmos...
GO-2024-2664 ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel
ZITADEL's actions can overload reserved claims in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2644 Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid
Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid...
GO-2024-2461 Cross-site scripting in github.com/gofiber/template/django/v3
Cross-site scripting in github.com/gofiber/template/django/v3...
GO-2023-2334 Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service...
GO-2023-1874 Denial of service in github.com/corazawaf/coraza/v2 and v3
Due to the misuse of log.Fatalf, Coraza may crash after receiving crafted requests from attackers...
GO-2023-1631 Panic when parsing invalid messages in google.golang.org/protobuf
Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic...
GO-2023-1597 Cross site scripting in github.com/kitabisa/teler-waf
Improper sanitization and filtering of HTML entities in user input can lead to cross-site scripting XSS attacks where arbitrary JavaScript code is executed in the browser...
GO-2022-1166 Denial of service via schema file in helm.sh/helm/v3
Certain JSON schema validation files can cause a Helm Client to panic, leading to a possible denial of service. The chartutil package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The...
GO-2022-0621 Exposure of sensitive information in k8s.io/kube-state-metrics
Exposing annotations as metrics can leak secrets. An experimental feature of kube-state-metrics enables annotations to be exposed as metrics. By default, metrics only expose metadata about secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire...
GO-2020-0031
Due to improper setting of finalizers, memory passed to C may be freed before it is used, leading to crashes due to memory corruption or possible code execution...
GO-2020-0028 Denial of service via malformed zone file in github.com/miekg/dns
Due to a nil pointer dereference, parsing a malformed zone file containing TA records may cause a panic. If parsing user supplied input, this may be used as a denial of service vector...
GO-2020-0003 Resource exhaustion in github.com/revel/revel
An attacker can cause an application that accepts slice parameters https://revel.github.io/manual/parameters.htmlslices to allocate large amounts of memory and crash through manipulating the request query sent to the application...
GO-2020-0020 Improper access control in github.com/gorilla/handlers
Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy...
GO-2026-6278 Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in github.com/gorilla/websocket...
GO-2024-3203 VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder
VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder...
GO-2022-1264 usememos/memos has Incorrectly Specified Destination in a Communication Channel in github.com/usememos/memos
usememos/memos has Incorrectly Specified Destination in a Communication Channel in github.com/usememos/memos...
GO-2022-1235 usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos
usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos...
GO-2022-0429 Smokescreen SSRF via deny list bypass in github.com/stripe/smokescreen
Smokescreen SSRF via deny list bypass in github.com/stripe/smokescreen...