GO-2024-3026 casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification in github.com/casdoor/casdoor

casdoor's use ofssh.InsecureIgnoreHostKey disables host key verification in github.com/casdoor/casdoor...

GO-2024-3032 Mattermost did not properly restrict channel creation in github.com/mattermost/mattermost-server

Mattermost did not properly restrict channel creation in github.com/mattermost/mattermost-server...

GO-2024-3028 Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel in github.com/mattermost/mattermost-server

Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel in github.com/mattermost/mattermost-server...

GO-2024-3042 Podman vulnerable to memory-based denial of service in github.com/containers/podman

Podman vulnerable to memory-based denial of service in github.com/containers/podman...

GO-2024-3010 CVE-2024-6984 in github.com/juju/juju

CVE-2024-6984 in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report. The...

GO-2024-3002 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd

Argo CD Unauthenticated Denial of Service DoS Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd...

GO-2024-3034 Volcano has insecure permissions in volcano.sh/volcano

Volcano has insecure permissions in volcano.sh/volcano...

GO-2024-3019 soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve

soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests in github.com/charmbracelet/soft-serve...

GO-2024-3011 pREST vulnerable to jwt bypass + sql injection in github.com/prest/prest

pREST vulnerable to jwt bypass + sql injection in github.com/prest/prest...

GO-2024-3023 Mattermost allows remote actor to create/update/delete posts in arbitrary channels in github.com/mattermost/mattermost-server

Mattermost allows remote actor to create/update/delete posts in arbitrary channels in github.com/mattermost/mattermost-server...

GO-2024-3009 snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd

snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2024-3039 Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean

Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean...

GO-2024-2999 Woodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker

Woodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker...

GO-2024-3007 snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd

snapd failed to restrict writes to the $HOME/bin path in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2024-3038 In regclient, pinned manifest digests may be ignored in github.com/regclient/regclient

In regclient, pinned manifest digests may be ignored in github.com/regclient/regclient...

GO-2024-3036 cortex establishes TLS connections with `InsecureSkipVerify` set to `true` in github.com/cortexproject/cortex

cortex establishes TLS connections with InsecureSkipVerify set to true in github.com/cortexproject/cortex...

GO-2024-2998 Woodpecker's custom environment variables allow to alter execution flow of plugins in go.woodpecker-ci.org/woodpecker

Woodpecker's custom environment variables allow to alter execution flow of plugins in go.woodpecker-ci.org/woodpecker...

GO-2024-3014 ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel

ZITADEL "ignoring unknown usernames" vulnerability in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2024-3040 Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju

Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm in github.com/juju/juju. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causi...

GO-2024-3008 snapd failed to properly check the file type when extracting a snap in github.com/snapcore/snapd

snapd failed to properly check the file type when extracting a snap in github.com/snapcore/snapd. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3029 Navidrome uses MD5 hashing algorithm in github.com/navidrome/navidrome

Navidrome uses MD5 hashing algorithm in github.com/navidrome/navidrome...

GO-2024-3027 fabedge has insecure permissions in github.com/fabedge/fabedge

fabedge has insecure permissions in github.com/fabedge/fabedge...

GO-2024-3033 Filestash configured to skip TLS certificate verification when using the FTPS protocol in github.com/mickael-kerjean/filestash

Filestash configured to skip TLS certificate verification when using the FTPS protocol in github.com/mickael-kerjean/filestash...

GO-2024-3006 The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd

The Argo CD web terminal session does not handle the revocation of user permissions properly in github.com/argoproj/argo-cd...

GO-2024-3035 Filestash skips TLS certificate verification process when sending out email verification codes in github.com/mickael-kerjean/filestash

Filestash skips TLS certificate verification process when sending out email verification codes in github.com/mickael-kerjean/filestash...

GO-2024-3037 APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server

APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3015 ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel

ZITADEL has improper HTML sanitization in emails and Console UI in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2024-3012 Malicious code in github.com/PromonLogicalis/asn1

Version 7bdca06d0edf of the github.com/PromonLogicalis/asn1 module contains malicious code which downloads a program from a remote web server and executes it...

GO-2024-3005 Moby authz zero length regression in github.com/moby/moby

Moby authz zero length regression in github.com/moby/moby...

GO-2024-2993 Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver

Sliver Allows Authenticated Operator-to-Server Remote Code Execution in github.com/bishopfox/sliver. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-2994 Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes

Kubernetes sets incorrect permissions on Windows containers logs in k8s.io/kubernetes...

GO-2024-2996 CVE-2024-21527 in github.com/gotenberg/gotenberg

CVE-2024-21527 in github.com/gotenberg/gotenberg...

GO-2024-2997 CVE-2024-21583 in github.com/gitpod-io/gitpod

CVE-2024-21583 in github.com/gitpod-io/gitpod. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report...

GO-2024-2984 Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2

Linkerd potential access to the shutdown endpoint in github.com/linkerd/linkerd2...

GO-2024-2987 Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper

Skupper uses a static cookie secret for the openshift oauth-proxy in github.com/skupperproject/skupper...

GO-2024-2992 1Panel SQL injection in github.com/1Panel-dev/1Panel

1Panel SQL injection in github.com/1Panel-dev/1Panel...

GO-2024-2989 projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei

projectdiscovery/nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei...

GO-2024-2990 1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel

1Panel has an SQL injection issue related to the orderBy clause in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

GO-2024-2981 SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend

SQL Injection in the KubeClarity REST API in github.com/openclarity/kubeclarity/backend...

GO-2024-2980 NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server

NATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects in github.com/nats-io/nats-server...

GO-2024-2982 Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault

Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions in github.com/hashicorp/vault. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2024-2979 Cache driver GetBlob() allows read access to any blob without access control check in zotregistry.dev/zot

Cache driver GetBlob allows read access to any blob without access control check in zotregistry.dev/zot. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-2971 Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs

Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs...

GO-2024-2972 Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs

Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs...

GO-2024-2969 github.com/gogs/gogs affected by CVE-2024-39930

github.com/gogs/gogs affected by CVE-2024-39930...

GO-2024-2968 ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel

ZITADEL Vulnerable to Session Information Leakage in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...

GO-2024-2970 Gogs allows deletion of internal files in github.com/gogs/gogs

Gogs allows deletion of internal files in github.com/gogs/gogs...

GO-2024-2974 Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos

Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos...

GO-2024-2973 Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes in github.com/traefik/traefik

Bypassing IP allow-lists in traefik via HTTP/3 early data requests in QUIC 0-RTT handshakes in github.com/traefik/traefik...

GO-2024-2977 IP addresses were encoded in the wrong byte order in github.com/google/nftables

IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which did not work as intended might block or not block the desired addresses...