4692 matches found
GO-2024-3273 CVE-2024-24426 in github.com/magma/magma
CVE-2024-24426 in github.com/magma/magma...
GO-2024-3269 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli
Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli...
GO-2024-3274 Stored XSS using two files in usememos/memos in github.com/usememos/memos
Stored XSS using two files in usememos/memos in github.com/usememos/memos...
GO-2024-3272 CVE-2024-24425 in github.com/magma/magma
CVE-2024-24425 in github.com/magma/magma...
GO-2024-3278 Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines
Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines...
GO-2024-3250 Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt
Improper error handling in ParseWithClaims and bad documentation may cause dangerous situations in github.com/golang-jwt/jwt...
GO-2024-3260 Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron
Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron...
GO-2024-3262 Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad
Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad...
GO-2024-3253 LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI
LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI...
GO-2024-3251 Safearchive Path Traversal vulnerability in github.com/google/safearchive
Safearchive Path Traversal vulnerability in github.com/google/safearchive...
GO-2024-3252 gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign
gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign...
GO-2024-3254 Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus
Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE in github.com/j3ssie/osmedeus...
GO-2024-3233 Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server
Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server...
GO-2024-3234 Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server
Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server...
GO-2024-3242 Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul
Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul...
GO-2024-3235 Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server
Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server...
GO-2024-3239 NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability in github.com/NVIDIA/nvidia-container-toolkit
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use TOCTOU vulnerability in github.com/NVIDIA/nvidia-container-toolkit...
GO-2024-3241 Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul...
GO-2024-3237 NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit
NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system in github.com/NVIDIA/nvidia-container-toolkit...
GO-2024-3243 Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul
Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul...
GO-2024-3240 Grafana org admin can delete pending invites in different org in github.com/grafana/grafana
Grafana org admin can delete pending invites in different org in github.com/grafana/grafana...
GO-2024-3246 Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault
Hashicorp Vault vulnerable to denial of service through memory exhaustion in github.com/hashicorp/vault...
GO-2024-3245 Ollama Out-of-bounds Read in github.com/ollama/ollama
Ollama Out-of-bounds Read in github.com/ollama/ollama...
GO-2024-3244 Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark
Gnark out-of-memory during deserialization with crafted inputs in github.com/consensys/gnark...
GO-2024-3232 Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server
Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server...
GO-2024-3230 Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno
Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno...
GO-2024-3228 Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder
Coder vulnerable to post-auth URL redirection to untrusted site 'Open Redirect' in github.com/coder/coder...
GO-2024-3227 Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server
Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server...
GO-2024-3226 Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows
Argo Workflows Controller: Denial of Service via malicious daemon Workflows in github.com/argoproj/argo-workflows...
GO-2024-3214 Plenti arbitrary file deletion vulnerability in github.com/plentico/plenti
Plenti arbitrary file deletion vulnerability in github.com/plentico/plenti...
GO-2024-3224 Missing key verification in gost in github.com/ginuerzh/gost
Missing key verification in gost in github.com/ginuerzh/gost...
GO-2024-3217 User Registration Bypass in Zitadel in github.com/zitadel/zitadel
User Registration Bypass in Zitadel in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3223 Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher
Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3222 RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rke2
RKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rke2. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2024-3216 Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel
Denied Host Validation Bypass in Zitadel Actions in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3210 Lack of JWT issuer and signer validation in github.com/awslabs/aws-alb-route-directive-adapter-for-istio
Lack of JWT issuer and signer validation in github.com/awslabs/aws-alb-route-directive-adapter-for-istio...
GO-2024-3221 Rancher Remote Code Execution via Cluster/Node Drivers in github.com/rancher/rancher
Rancher Remote Code Execution via Cluster/Node Drivers in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2024-3215 Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana
Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3211 Graphql: information disclosure via graphql introspection in openshift in github.com/openshift/console
Graphql: information disclosure via graphql introspection in openshift in github.com/openshift/console...
GO-2024-3219 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses...
GO-2024-3220 Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher
Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-3212 AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller
AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers in sigs.k8s.io/aws-load-balancer-controller. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...
GO-2024-3208 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium...
GO-2024-3213 Plenti arbitrary file write vulnerability in github.com/plentico/plenti
Plenti arbitrary file write vulnerability in github.com/plentico/plenti...
GO-2024-3207 Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito
Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito...
GO-2024-3203 VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder
VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder...
GO-2024-3204 VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder
VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder...
GO-2024-3189 Consensus failure in github.com/btcsuite/btcd
The btcd Bitcoin client versions 0.10 to 0.24 did not correctly re-implement Bitcoin Core's 'FindAndDelete' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split accepting an invalid block or Denial of Service DoS attacks rejecting a valid block...
GO-2024-3200 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not in github.com/authzed/spicedb...
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...