4692 matches found
GO-2024-3196 Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. in github.com/codeclysm/extract
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. in github.com/codeclysm/extract...
GO-2024-3201 JWT token compromise can allow malicious actions including Remote Code Execution (RCE) in github.com/neuvector/neuvector
JWT token compromise can allow malicious actions including Remote Code Execution RCE in github.com/neuvector/neuvector...
GO-2024-3171 Link Following in github.com/containers/common
Link Following in github.com/containers/common...
GO-2024-3190 Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist
Alist reflected Cross-Site Scripting vulnerability in github.com/alist-org/alist...
GO-2024-3185 XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready
XML Signature Bypass via differential XML parsing in ssoready in github.com/ssoready/ssoready...
GO-2024-3188 Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd
Authd allows attacker-controlled usernames to yield controllable UIDs in github.com/ubuntu/authd...
GO-2024-3184 Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome
Adguard Home arbitrary file read vulnerability in github.com/AdguardTeam/AdGuardHome...
GO-2024-3191 Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault
Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault...
GO-2024-3186 Buildah allows arbitrary directory mount in github.com/containers/buildah
Buildah allows arbitrary directory mount in github.com/containers/buildah...
GO-2024-3164 Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server
Mattermost fails to strip embeds from metadata when broadcasting posted events in github.com/mattermost/mattermost-server...
GO-2024-3167 Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
GO-2024-3163 Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle
Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-3175 Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju
Vulnerable juju introspection abstract UNIX domain socket in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2024-3179 Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium
Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium...
GO-2024-3181 PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd
PAM module may allow accessing with the credentials of another user in github.com/ubuntu/authd...
GO-2024-3162 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault...
GO-2024-3172 Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer
Portainer improperly uses an encryption algorithm in the AesEncrypt function in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-3166 Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf
Incorrect delegation lookups can make go-tuf download the wrong artifact in github.com/theupdateframework/go-tuf...
GO-2024-3169 Improper Input Validation in Buildah and Podman in github.com/containers/buildah
Improper Input Validation in Buildah and Podman in github.com/containers/buildah...
GO-2024-3182 OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu
OpenTofu potential leaking of secret variable values when using static evaluation in v1.8 in github.com/opentofu/opentofu...
GO-2024-3161 Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher
Rancher agents can be hijacked by taking over the Rancher Server URL in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3170 Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/agent
Grafana Agent Flow mode on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/agent...
GO-2024-3173 JUJU_CONTEXT_ID is a predictable authentication secret in github.com/juju/juju
JUJUCONTEXTID is a predictable authentication secret in github.com/juju/juju...
GO-2024-3174 Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju
Vulnerable juju hook tool abstract UNIX domain socket in github.com/juju/juju...
GO-2024-3168 Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy
Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy...
GO-2024-3135 HTTP client can manipulate custom HTTP headers that are added by Traefik in github.com/traefik/traefik
HTTP client can manipulate custom HTTP headers that are added by Traefik in github.com/traefik/traefik...
GO-2024-3139 ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel
ZITADEL's Service Users Deactivation not Working in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-3153 Navidrome has Multiple SQL Injections and ORM Leak in github.com/navidrome/navidrome
Navidrome has Multiple SQL Injections and ORM Leak in github.com/navidrome/navidrome...
GO-2024-3157 Mellium allows Authentication Bypass by Spoofing in mellium.im/xmpp
Mellium allows Authentication Bypass by Spoofing in mellium.im/xmpp...
GO-2024-3137 ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel
ZITADEL's User Grant Deactivation not Working in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-3155 CVE-2024-47218 in github.com/vesoft-inc/nebula
CVE-2024-47218 in github.com/vesoft-inc/nebula...
GO-2024-3138 ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel
ZITADEL Allows Unauthorized Access After Organization or Project Deactivation in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3160 Ory Kratos's setting required_aal `highest_available` does not properly respect code + mfa credentials in github.com/ory/kratos
Ory Kratos's setting requiredaal highestavailable does not properly respect code + mfa credentials in github.com/ory/kratos...
GO-2024-3156 CVE-2024-47219 in github.com/vesoft-inc/nebula
CVE-2024-47219 in github.com/vesoft-inc/nebula...
GO-2024-3158 Apache Answer: Avatar URL leaked user email addresses in github.com/apache/incubator-answer
Apache Answer: Avatar URL leaked user email addresses in github.com/apache/incubator-answer...
GO-2024-3136 Dragonfly2 has hard coded cyptographic key in d7y.io/dragonfly
Dragonfly2 has hard coded cyptographic key in d7y.io/dragonfly...
GO-2024-3134 CoreDNS Cache Poisoning via a birthday attack in github.com/coredns/coredns
CoreDNS enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack...
GO-2024-3133 Chaosblade vulnerable to OS command execution in github.com/chaosblade-io/chaosblade
Chaosblade vulnerable to OS command execution in github.com/chaosblade-io/chaosblade...
GO-2024-3131 SpiceDB having multiple caveats on resources of the same type may improperly result in no permission in github.com/authzed/spicedb
SpiceDB having multiple caveats on resources of the same type may improperly result in no permission in github.com/authzed/spicedb...
GO-2024-3130 CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns
CoreDNS vulnerable to TuDoor Attacks in github.com/coredns/coredns...
GO-2024-3141 OPA for Windows has an SMB force-authentication vulnerability in github.com/open-policy-agent/opa
OPA for Windows has an SMB force-authentication vulnerability. Due to improper input validation, it allows a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions...
GO-2024-3129 OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer in github.com/openshift/builder
OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer in github.com/openshift/builder...
GO-2024-3128 OpenShift Controller Manager Improper Privilege Management in github.com/openshift/openshift-controller-manager
OpenShift Controller Manager Improper Privilege Management in github.com/openshift/openshift-controller-manager. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-3124 Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp
Buffer Overflow vulnerability allows a remote attacker to cause a denial of service via an fsm error handling function...
GO-2024-3123 Commitments to private witnesses in Groth16 as implemented break zero-knowledge property in github.com/consensys/gnark
Commitments to private witnesses in Groth16 as implemented break zero-knowledge property in github.com/consensys/gnark...
GO-2024-3112 CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft
CometBFT's state syncing validator from malicious node may lead to a chain split github.com/cometbft/cometbft...
GO-2024-3098 The req library may send an unintended request when a malformed URL is provided in github.com/imroc/req
The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in...
GO-2024-3125 Gouniverse GoLang CMS vulnerable to Cross-site Scripting in github.com/gouniverse/cms
Gouniverse GoLang CMS vulnerable to Cross-site Scripting in github.com/gouniverse/cms...
GO-2024-3126 External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets
External Secrets Operator vulnerable to privilege escalation in github.com/external-secrets/external-secrets...