4692 matches found
GO-2024-3306 Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess
Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess...
GO-2024-3295 Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh
Violation of GitHub host security boundary when sourcing authentication token within a codespace in github.com/cli/go-gh...
GO-2024-3268 Harbor fails to validate the user permissions when updating p2p preheat policies in github.com/goharbor/harbor
Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in oth...
GO-2024-3326 SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file write in the host via /api/asset/upload in github.com/siyuan-note/siyuan/kernel...
GO-2024-3325 kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp
kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp...
GO-2024-3324 SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel
SiYuan has an SSTI via /api/template/renderSprig in github.com/siyuan-note/siyuan/kernel...
GO-2024-3327 SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read via /api/template/render in github.com/siyuan-note/siyuan/kernel...
GO-2024-3323 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel...
GO-2024-3248 KubeSphere IDOR vulnerability in github.com/kubesphere/kubesphere
An Insecure Direct Object Reference IDOR vulnerability in KubeSphere allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks. NOTE: A fix is expected in v4.1.3 in January 2025...
GO-2024-3218 Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht
Content Censorship in the InterPlanetary File System IPFS via Kademlia DHT abuse in github.com/libp2p/go-libp2p-kad-dht...
GO-2024-3205 Infinite loop in github.com/gomarkdown/markdown
Infinite loop in github.com/gomarkdown/markdown...
GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...
GO-2024-3314 Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo
Hugo does not escape some attributes in internal templates in github.com/gohugoio/hugo...
GO-2024-3315 CVE-2024-46455 in github.com/Unstructured-IO/unstructured
CVE-2024-46455 in github.com/Unstructured-IO/unstructured...
GO-2024-3319 Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd
Simulation of Wasmd message can cause crashing in github.com/CosmWasm/wasmd...
GO-2024-3312 CA certificate sign check bypass in github.com/canonical/lxd
CA certificate sign check bypass in github.com/canonical/lxd...
GO-2024-3311 NULL Pointer Dereference on moby image history in github.com/moby/moby
NULL Pointer Dereference on moby image history in github.com/moby/moby...
GO-2024-3313 Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd
Restricted TLS certificate privilege escalation when in PKI mode in github.com/canonical/lxd...
GO-2024-3308 Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) in github.com/kolide/launcher
Kolide Agent Privilege Escalation Windows, Versions = 1.5.3, 1.12.3 in github.com/kolide/launcher...
GO-2024-3310 Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli...
GO-2024-3307 CVE-2024-50948 in github.com/mochi-mqtt/server
CVE-2024-50948 in github.com/mochi-mqtt/server...
GO-2024-3292 CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o
CRI-O: Maliciously structured checkpoint file can gain arbitrary node access in github.com/cri-o/cri-o...
GO-2024-3305 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2024-3304 Moby Race Condition vulnerability in github.com/moby/moby
Moby Race Condition vulnerability in github.com/moby/moby...
GO-2024-3302 ICMP Packet Too Large Injection Attack on Linux in github.com/quic-go/quic-go
ICMP Packet Too Large Injection Attack on Linux in github.com/quic-go/quic-go...
GO-2024-3303 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode in github.com/argoproj/argo-workflows
Argo Workflows Allows Access to Archived Workflows with Fake Token in client mode in github.com/argoproj/argo-workflows...
GO-2024-3296 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in github.com/cli/cli...
GO-2024-3294 Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb
Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb...
GO-2024-3300 sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo
sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo...
GO-2024-3299 Traefik's X-Forwarded-Prefix Header still allows for Open Redirect in github.com/traefik/traefik
Traefik's X-Forwarded-Prefix Header still allows for Open Redirect in github.com/traefik/traefik...
GO-2024-3289 OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console
OpenShift Console Server Side Request Forgery vulnerability in github.com/openshift/console...
GO-2024-3291 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs...
GO-2024-3290 Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium...
GO-2024-3288 Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig
Taurus multi-party-sig has OT-based ECDSA protocol implementation flaws in github.com/taurusgroup/multi-party-sig...
GO-2024-3284 PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb
PingCAP TiDB nil pointer dereference in github.com/pingcap/tidb. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3287 Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer
Apache Answer: Predictable Authorization Token Using UUIDv1 in github.com/apache/incubator-answer...
GO-2024-3286 Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes
Kubernetes kubelet arbitrary command execution in k8s.io/kubernetes...
GO-2024-3279 Mismatched bit-length validation in can lead to panic in cosmossdk.io/math
Mismatched bit-length validation in can lead to panic in cosmossdk.io/math...
GO-2024-3282 Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager
Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager...
GO-2024-3280 Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher
Rancher Helm Applications may have sensitive values leaked in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3283 SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo
SFTPGo allows administrators to restrict command execution from the EventManager in github.com/drakkan/sftpgo...
GO-2024-3281 github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve
github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve...
GO-2024-3265 Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis
Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis...
GO-2024-3122 Groth16 commitment extension unsound for more than one commitment in github.com/consensys/gnark
Groth16 commitment extension unsound for more than one commitment in github.com/consensys/gnark...
GO-2024-3259 CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data in github.com/cometbft/cometbft...
GO-2024-3140 Grafana plugin SDK Information Leakage in github.com/grafana/grafana-plugin-sdk-go
The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running "git remote get-url origin". If credentials are included in the repository URI for instance, to allow for fetching of private...
GO-2024-3275 Unpatched Remote Code Execution in Gogs in gogs.io/gogs
Unpatched Remote Code Execution in Gogs in gogs.io/gogs...
GO-2024-3277 Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes
Kubernetes Nil pointer dereference in KCM after v1 HPA patch request in k8s.io/kubernetes...
GO-2024-3267 Zoraxy has an authenticated command injection in the Web SSH feature in github.com/tobychui/zoraxy
Zoraxy has an authenticated command injection in the Web SSH feature in github.com/tobychui/zoraxy. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...