4632 matches found
GO-2025-3561 Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium
Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium...
GO-2025-3549 Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server
Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server...
GO-2025-3529 Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive
Openshift Hive Exposes VCenter Credentials via ClusterProvision in github.com/openshift/hive...
GO-2025-3510 Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad
Unintentional exposure of the workload identity token and client secret in logs in github.com/hashicorp/nomad...
GO-2025-3460 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution...
GO-2025-3454 Plenti - Code Injection - Denial of Services in github.com/plentico/plenti
Plenti - Code Injection - Denial of Services in github.com/plentico/plenti...
GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however,...
GO-2025-3401 matrix-media-repo (MMR) allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo
matrix-media-repo MMR allows denial of service/high operating costs through unauthenticated downloads in github.com/t2bot/matrix-media-repo...
GO-2025-3384 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2024-3360 OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive
OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation in github.com/openshift/hive...
GO-2024-3358 SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol
SQL injection in Apache Traffic Control in github.com/apache/trafficcontrol...
GO-2024-3101 Excessive number of function parameters in compiled Wasm in github.com/CosmWasm/wasmvm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts...
GO-2024-3288 Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig...
GO-2024-3140 Grafana plugin SDK Information Leakage in github.com/grafana/grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running "git remote get-url origin". If credentials are included in the repository URI for instance, to allow for fetching of private...
GO-2024-3275 Unpatched Remote Code Execution in Gogs in gogs.io/gogs
Unpatched Remote Code Execution in Gogs in gogs.io/gogs...
GO-2024-3217 User Registration Bypass in Zitadel in github.com/zitadel/zitadel
User Registration Bypass in Zitadel in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3216 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3223 Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher
Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3207 Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito
Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito...
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-3190 Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist
Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist...
GO-2024-3188 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd...
GO-2024-3141 OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa
OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions...
GO-2024-3124 Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp
Buffer Overflow vulnerability allows a remote attacker to cause a denial of service via an fsm error handling function...
GO-2022-1066 Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node
Potential inter-blockchain communication IBC protocol compromise via "Dragonberry" vulnerability in cheqd in github.com/cheqd/cheqd-node...
GO-2022-0937 Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish
Elvish vulnerable to remote code execution via the web UI backend in github.com/elves/elvish...
GO-2022-0888 Crash due to malformed relay protocol message in github.com/syncthing/syncthing
Crash due to malformed relay protocol message in github.com/syncthing/syncthing...
GO-2022-0855 Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server
Denial of service in github.com/nats-io/nats-server/server in github.com/nats-io/nats-server...
GO-2022-0825 Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault in github.com/hashicorp/vault
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault in github.com/hashicorp/vault...
GO-2022-0778 Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault
Information Disclosure in HashiCorp Vault in github.com/hashicorp/vault...
GO-2022-0751 Path Traversal in Docker in github.com/docker/docker
Path Traversal in Docker in github.com/docker/docker...
GO-2022-0732 Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad
Privilege escalation in Hashicorp Nomad in github.com/hashicorp/nomad...
GO-2022-0612 Stored Cross-site Scripting in gitea in code.gitea.io/gitea
Stored Cross-site Scripting in gitea in code.gitea.io/gitea...
GO-2022-0584 Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad
Arbitrary file reads in HashiCorp Nomad in github.com/hashicorp/nomad...
GO-2022-0583 Server-Side Request Forgery in gogs webhook in gogs.io/gogs
Server-Side Request Forgery in gogs webhook in gogs.io/gogs...
GO-2022-0559 HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul...
GO-2022-0389 Unchecked hostname resolution could allow access to local network resources by users outside the local network in github.com/pterodactyl/wings
Unchecked hostname resolution could allow access to local network resources by users outside the local network in github.com/pterodactyl/wings...
GO-2022-0368 Improper random number generation in github.com/coredns/coredns
Improper random number generation in github.com/coredns/coredns...
GO-2022-0325 Skip the router TLS configuration when the host header is an FQDN in github.com/traefik/traefik
Skip the router TLS configuration when the host header is an FQDN in github.com/traefik/traefik...
GO-2022-0354 Code Injection in CRI-O in github.com/cri-o/cri-o
Code Injection in CRI-O in github.com/cri-o/cri-o...
GO-2022-0365 User object created with invalid provider data in GoTrue in github.com/netlify/gotrue
User object created with invalid provider data in GoTrue in github.com/netlify/gotrue...
GO-2022-0315 Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea
Reuse of one time passwords allowed in Gitea in code.gitea.io/gitea...
GO-2022-0360 Ambiguous OCI manifest parsing in github.com/containerd/containerd
Ambiguous OCI manifest parsing in github.com/containerd/containerd...
GO-2023-2376 Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik...
GO-2023-1991 Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher
Rancher Privilege Escalation Vulnerability in github.com/rancher/rancher...
GO-2023-1950 Traefik Missing Authentication in github.com/traefik/traefik
Traefik Missing Authentication in github.com/traefik/traefik...
GO-2023-1894 code.gitea.io/gitea Open Redirect vulnerability
code.gitea.io/gitea Open Redirect vulnerability...
GO-2023-1793 secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver
secrets-store-csi-driver discloses service account tokens in logs in sigs.k8s.io/secrets-store-csi-driver...
GO-2023-1828 Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances in github.com/hashicorp/consul...
GO-2023-1716 Answer vulnerable to Insertion of Sensitive Information Into Sent Data in github.com/answerdev/answer
Answer vulnerable to Insertion of Sensitive Information Into Sent Data in github.com/answerdev/answer...