4692 matches found
GO-2024-3110 Can be confused to create empty files/directories on the host in github.com/opencontainers/runc
Can be confused to create empty files/directories on the host in github.com/opencontainers/runc...
GO-2024-3118 Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill
Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill...
GO-2024-3116 sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go
sigstore-go has an unbounded loop over untrusted input can lead to endless data attack in github.com/sigstore/sigstore-go...
GO-2024-3108 Hoverfly allows an arbitrary file read in the `/api/v2/simulation` endpoint (`GHSL-2023-274`) in github.com/SpectoLabs/hoverfly
Hoverfly allows an arbitrary file read in the /api/v2/simulation endpoint GHSL-2023-274 in github.com/SpectoLabs/hoverfly...
GO-2024-3121 Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security
Interchain Security: The signers of ICS messages do not need to match the provider address in github.com/cosmos/interchain-security...
GO-2024-3113 Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault
Vault Leaks Client Token and Token Accessor in Audit Devices in github.com/hashicorp/vault...
GO-2024-3119 Path traversal vulnerability in stripe-cli in github.com/stripe/stripe-cli
Path traversal vulnerability in stripe-cli in github.com/stripe/stripe-cli...
GO-2024-3107 Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...
GO-2024-3105 Stack exhaustion in all Parse functions in go/parser
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion...
GO-2024-3106 Stack exhaustion in Decoder.Decode in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635...
GO-2024-3086 Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036) in github.com/casdoor/casdoor
Casdoor has reflected XSS in QrCodePage.js GHSL-2024-036 in github.com/casdoor/casdoor...
GO-2024-3082 CWA-2024-005: Stackoverflow in wasmd in github.com/CosmWasm/wasmd
CWA-2024-005: Stackoverflow in wasmd in github.com/CosmWasm/wasmd...
GO-2024-3097 Mattermost Cross-Site Request Forgery vulnerability in github.com/mattermost/mattermost-server
Mattermost Cross-Site Request Forgery vulnerability in github.com/mattermost/mattermost-server...
GO-2024-3083 Openshift Console insufficient entropy vulnerability in github.com/openshift/console
Openshift Console insufficient entropy vulnerability in github.com/openshift/console...
GO-2024-3094 Mattermost doesn't restrict which roles can promote a user as system admin in github.com/mattermost/mattermost-server
Mattermost doesn't restrict which roles can promote a user as system admin in github.com/mattermost/mattermost-server...
GO-2024-3092 Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server
Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server...
GO-2024-3081 CWA-2024-006: wasmd non-deterministic module_query_safe query in github.com/CosmWasm/wasmd
CWA-2024-006: wasmd non-deterministic modulequerysafe query in github.com/CosmWasm/wasmd...
GO-2024-3100 Chisel's AUTH environment variable not respected in server entrypoint in github.com/jpillora/chisel
Chisel's AUTH environment variable not respected in server entrypoint in github.com/jpillora/chisel...
GO-2024-3091 Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server
Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server...
GO-2024-3087 Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor
Casdoor CORS misconfiguration GHSL-2024-035 in github.com/casdoor/casdoor...
GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server
Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server...
GO-2024-3089 Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server
Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server...
GO-2024-3085 GoAuthentik vulnerable to Insufficient Authorization for several API endpoints in goauthentik.io
GoAuthentik vulnerable to Insufficient Authorization for several API endpoints in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-3093 Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server
Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server...
GO-2024-3104 Ollama can extract members of a ZIP archive outside of the parent directory in github.com/ollama/ollama
Ollama can extract members of a ZIP archive outside of the parent directory in github.com/ollama/ollama...
GO-2024-3095 Mattermost Plugin Channel Export excessive resource consumption in github.com/mattermost/mattermost-plugin-channel-export
Mattermost Plugin Channel Export excessive resource consumption in github.com/mattermost/mattermost-plugin-channel-export...
GO-2024-3088 memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos
memos CORS Misconfiguration in server.go GHSL-2024-034 in github.com/usememos/memos...
GO-2024-3103 Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor
Hwameistor Potential Permission Leakage of Cluster Level in github.com/hwameistor/hwameistor...
GO-2024-3090 Mattermost allows team admin user without "Add Team Members" permission to disable invite URL in github.com/mattermost/mattermost-server
Mattermost allows team admin user without "Add Team Members" permission to disable invite URL in github.com/mattermost/mattermost-server...
GO-2024-3102 OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver
OpenTelemetry Collector module AWS Firehose Receiver Authentication Bypass Vulnerability in github.com/open-telemetry/opentelemetry-collector-contrib/receiver/awsfirehosereceiver...
GO-2024-3099 Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric
Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric...
GO-2024-3076 Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog
Trufflehog vulnerable to Blind SSRF in some Detectors in github.com/trufflesecurity/trufflehog...
GO-2024-3079 Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana
Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-3080 Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister
Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister...
GO-2024-3077 Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule
Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule...
GO-2024-3078 LF Edge eKuiper has a SQL Injection in sqlKvStore in github.com/lf-edge/ekuiper
LF Edge eKuiper has a SQL Injection in sqlKvStore in github.com/lf-edge/ekuiper...
GO-2022-1264 usememos/memos has Incorrectly Specified Destination in a Communication Channel in github.com/usememos/memos
usememos/memos has Incorrectly Specified Destination in a Communication Channel in github.com/usememos/memos...
GO-2022-1263 usememos/memos Improper Access Control vulnerability in github.com/usememos/memos
usememos/memos Improper Access Control vulnerability in github.com/usememos/memos...
GO-2022-1266 usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos...
GO-2022-1245 usememos/memos Improper Authorization vulnerability in github.com/usememos/memos
usememos/memos Improper Authorization vulnerability in github.com/usememos/memos...
GO-2022-1225 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos
usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...
GO-2022-1259 usememos/memos Improper Authorization vulnerability in github.com/usememos/memos
usememos/memos Improper Authorization vulnerability in github.com/usememos/memos...
GO-2022-1240 usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel in github.com/usememos/memos...
GO-2022-1260 usememos/memos vulnerable to Comparison of Object References Instead of Object Contents in github.com/usememos/memos
usememos/memos vulnerable to Comparison of Object References Instead of Object Contents in github.com/usememos/memos...
GO-2022-1244 usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts in github.com/usememos/memos
usememos/memos vulnerable Improper Restriction of Excessive Authentication Attempts in github.com/usememos/memos...
GO-2022-1253 usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos
usememos/memos has Insufficient Granularity of Access Control in github.com/usememos/memos...
GO-2022-1257 usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos
usememos/memos Cross-Site Request Forgery vulnerability in github.com/usememos/memos...
GO-2022-1220 usememos/memos may leak user information to an authenticated user in github.com/usememos/memos
usememos/memos may leak user information to an authenticated user in github.com/usememos/memos...