GO-2023-1468 KubePi session fixation attack allows an attacker to hijack a legitimate user session. in github.com/KubeOperator/kubepi

KubePi session fixation attack allows an attacker to hijack a legitimate user session. in github.com/KubeOperator/kubepi...

GO-2023-1292 usememos/memos Incorrect Use of Privileged APIs vulnerability in github.com/usememos/memos

usememos/memos Incorrect Use of Privileged APIs vulnerability in github.com/usememos/memos...

GO-2023-1388 Gitops Run insecure communication in github.com/weaveworks/weave-gitops

Gitops Run insecure communication in github.com/weaveworks/weave-gitops...

GO-2023-1294 easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt

easy-scrypt Observable Timing Discrepancy vulnerability in github.com/agnivade/easy-scrypt...

GO-2023-1461 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos

usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...

GO-2023-1462 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos

usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...

GO-2023-1509 Path Traversal in github.com/go-sonic/sonic

Path Traversal in github.com/go-sonic/sonic...

GO-2023-1449 usememos/memos Improper Privilege Management vulnerability in github.com/usememos/memos

usememos/memos Improper Privilege Management vulnerability in github.com/usememos/memos...

GO-2023-1285 sememos/memos vulnerable to Improper Handling of Values in github.com/usememos/memos

sememos/memos vulnerable to Improper Handling of Values in github.com/usememos/memos...

GO-2023-1465 usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos

usememos/memos vulnerable to stored Cross-site Scripting in github.com/usememos/memos...

GO-2023-1463 KubePi may allow unauthorized access to system API in github.com/KubeOperator/kubepi

KubePi may allow unauthorized access to system API in github.com/KubeOperator/kubepi...

GO-2023-1504 act vulnerable to arbitrary file upload in artifact server in github.com/nektos/act

act vulnerable to arbitrary file upload in artifact server in github.com/nektos/act...

GO-2023-1471 Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server

Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server...

GO-2023-1492 Kubernetes Privilege Escalation in k8s.io/kubernetes

Kubernetes Privilege Escalation in k8s.io/kubernetes...

GO-2024-3068 Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia

Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia...

GO-2024-3073 Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking in github.com/hashicorp/nomad

Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking in github.com/hashicorp/nomad. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2024-3058 Gorush uses deprecated TLS versions in github.com/appleboy/gorush

An issue in the RunHTTPServer function in Gorush allows attackers to intercept and manipulate data due to the use of a deprecated TLS version...

GO-2024-3016 Beego privilege escalation vulnerability via sendMail in github.com/beego/beego/v2

Beego privilege escalation vulnerability via sendMail in github.com/beego/beego/v2...

GO-2024-3075 CVE-2024-7646 in github.com/kubernetes/ingress-nginx

CVE-2024-7646 in github.com/kubernetes/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...

GO-2024-3074 Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium

Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium...

GO-2024-3071 Gateway API route matching order contradicts specification in github.com/cilium/cilium

Gateway API route matching order contradicts specification in github.com/cilium/cilium...

GO-2024-3070 SQL injection in github.com/stashapp/stash

SQL injection in github.com/stashapp/stash...

GO-2024-3072 Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium

Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium...

GO-2024-3057 NetBird uses a static initialization vector (IV) in github.com/netbirdio/netbird

NetBird uses a static initialization vector IV in github.com/netbirdio/netbird...

GO-2024-3061 OpenFGA Authorization Bypass in github.com/openfga/openfga

OpenFGA Authorization Bypass in github.com/openfga/openfga...

GO-2024-3064 Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer

Apache Answer: The link to reset the user's password will remain valid after sending a new link in github.com/apache/incubator-answer...

GO-2024-3066 open-telemetry has an Observable Timing Discrepancy in github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension

open-telemetry has an Observable Timing Discrepancy in github.com/open-telemetry/opentelemetry-collector-contrib/extension/bearertokenauthextension...

GO-2024-3059 CosmWasm wasmd has large address count in ValidateBasic in github.com/CosmWasm/wasmd

CosmWasm wasmd has large address count in ValidateBasic in github.com/CosmWasm/wasmd...

GO-2024-3063 RBAC Roles for `etcd` created by Kamaji are not disjunct in github.com/clastix/kamaji

RBAC Roles for etcd created by Kamaji are not disjunct in github.com/clastix/kamaji...

GO-2024-3065 Apache Answer: The link for resetting user password is not Single-Use in github.com/apache/incubator-answer

Apache Answer: The link for resetting user password is not Single-Use in github.com/apache/incubator-answer...

GO-2024-3056 Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea

Gitea Cross-site Scripting Vulnerability in code.gitea.io/gitea...

GO-2024-3020 Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server

Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server...

GO-2024-3054 Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast

Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast...

GO-2024-3044 lorawan-stack Open Redirect vulnerability in go.thethings.network/lorawan-stack

lorawan-stack Open Redirect vulnerability in go.thethings.network/lorawan-stack...

GO-2024-3030 Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server...

GO-2024-3022 Mattermost allows remote actor to set arbitrary RemoteId values for synced users in github.com/mattermost/mattermost-server

Mattermost allows remote actor to set arbitrary RemoteId values for synced users in github.com/mattermost/mattermost-server...

GO-2024-3053 gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc

gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc...

GO-2024-3052 gotortc vulnerable to Cross-Site Request Forgery in github.com/AlexxIT/go2rtc

gotortc vulnerable to Cross-Site Request Forgery in github.com/AlexxIT/go2rtc...

GO-2024-3048 RobotsAndPencils go-saml authentication bypass vulnerability in github.com/RobotsAndPencils/go-saml

RobotsAndPencils go-saml authentication bypass vulnerability in github.com/RobotsAndPencils/go-saml...

GO-2024-3055 gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc

gotortc Cross-site Scripting vulnerability in github.com/AlexxIT/go2rtc...

GO-2024-3045 Meshery SQL Injection vulnerability in github.com/layer5io/meshery

Meshery SQL Injection vulnerability in github.com/layer5io/meshery...

GO-2024-3051 Meshery SQL Injection vulnerability in github.com/layer5io/meshery

Meshery SQL Injection vulnerability in github.com/layer5io/meshery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...

GO-2024-3046 memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos...

GO-2024-3050 Meshery SQL Injection vulnerability in github.com/layer5io/meshery

Meshery SQL Injection vulnerability in github.com/layer5io/meshery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest a...

GO-2024-3025 Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server

Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server...

GO-2024-3024 Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server

Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server...

GO-2024-3047 memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos...

GO-2024-3031 Mattermost allows a remote actor to make an arbitrary local channel read-only in github.com/mattermost/mattermost-server

Mattermost allows a remote actor to make an arbitrary local channel read-only in github.com/mattermost/mattermost-server...

GO-2024-3049 memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos...

GO-2024-3040 Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju

Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causi...