4632 matches found
GO-2024-2977 IP addresses were encoded in the wrong byte order in github.com/google/nftables
IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which did not work as intended might block or not block the desired addresses...
GO-2024-2965 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium
Pomerium exposed OAuth2 access and ID tokens in user info endpoint response in github.com/pomerium/pomerium...
GO-2024-2963 Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail...
GO-2024-2961 Limited directory traversal vulnerability on Windows in golang.org/x/crypto
httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator \ vs. /, allowing a user to provide a relative path, i.e...
GO-2024-2962 Output of "go env" does not sanitize values in cmd/go
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...
GO-2024-2955 Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors
Gin-Gonic CORS middleware mishandles a wildcard at the end of an origin string. Examples: https://example.community/ is accepted by the origin string https://example.com/ and http://localhost.example.com/ is accepted by the origin string http://localhost/...
GO-2024-2519 Grafana world readable configuration files in github.com/grafana/grafana
Grafana world readable configuration files in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2567 Panic in Pipeline when PgConn is busy or closed in github.com/jackc/pgx
Pipeline can panic when PgConn is busy or closed...
GO-2024-2883 Denial of service via malicious preflight requests in github.com/rs/cors
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers ACRH header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt...
GO-2024-2958 Potential memory exhaustion attack due to sparse slice deserialization in github.com/gorilla/schema
Potential memory exhaustion attack due to sparse slice deserialization in github.com/gorilla/schema...
GO-2024-2959 Session Middleware Token Injection Vulnerability in github.com/gofiber/fiber
Session Middleware Token Injection Vulnerability in github.com/gofiber/fiber...
GO-2024-2951 Denial of service when syncing with a malicious peer in github.com/cometbft/cometbft
A malicious peer can cause a syncing node to panic during blocksync. The syncing node may enter into a catastrophic invalid syncing state or get stuck in blocksync mode, never switching to consensus. Nodes that are vulnerable to this state may experience a Denial of Service condition in which...
GO-2024-2918 Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity
Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity...
GO-2024-2912 Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli
Docker CLI leaks private registry credentials to registry-1.docker.io in github.com/docker/cli...
GO-2024-2943 Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service in github.com/lightningnetwork/lnd
Lightning Network Daemon LND's onion processing logic leads to a denial of service in github.com/lightningnetwork/lnd...
GO-2024-2921 HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault
HashiCorp Vault Incorrectly Validated JSON Web Tokens JWT Audience Claims in github.com/hashicorp/vault. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2920 Denial of service vulnerability via the parseDirectives function in github.com/vektah/gqlparser
An issue in vektah gqlparser open-source-library allows a remote attacker to cause a denial of service via a crafted script to the parseDirectives function...
GO-2024-2930 RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke
When RKE provisions a cluster, it stores the cluster state in a configmap called "full-cluster-state" inside the "kube-system" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data...
GO-2024-2936 PocketBase performs password auth and OAuth2 unverified email linking in github.com/pocketbase/pocketbase
PocketBase performs password auth and OAuth2 unverified email linking in github.com/pocketbase/pocketbase...
GO-2024-2948 Code Execution on Git update in github.com/hashicorp/go-getter
A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config i...
GO-2024-2505 Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul
Privilege Escalation in HashiCorp Consul in github.com/hashicorp/consul...
GO-2024-2562 Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security...
GO-2024-2589 Mattermost denial of service through long emoji value in github.com/mattermost/mattermost-server
Mattermost denial of service through long emoji value in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2549 caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting in github.com/greenpau/caddy-security
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting in github.com/greenpau/caddy-security...
GO-2024-2430 Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs
Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2559 Cross-site Scripting in github.com/greenpau/caddy-security
Cross-site Scripting in github.com/greenpau/caddy-security...
GO-2024-2560 Open Redirect in github.com/greenpau/caddy-security
Open Redirect in github.com/greenpau/caddy-security...
GO-2024-2458 CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o
CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o...
GO-2024-2445 Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport
Withdrawn Advisory: SFTP is possible on the Proxy server for any user with SFTP access in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2512 Classic builder cache poisoning in github.com/docker/docker
Classic builder cache poisoning in github.com/docker/docker...
GO-2024-2495 Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability in github.com/apache/servicecomb-service-center
Apache ServiceComb Service-Center Server-Side Request Forgery vulnerability in github.com/apache/servicecomb-service-center. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2457 Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer
Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer...
GO-2024-2582 Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder
Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2558 Authentication Bypass by Spoofing in github.com/greenpau/caddy-security
Authentication Bypass by Spoofing in github.com/greenpau/caddy-security...
GO-2024-2517 Grafana XSS in header column rename in github.com/grafana/grafana
Grafana XSS in header column rename in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2593 Mattermost fails to check the "invite_guest" permission in github.com/mattermost/mattermost-server
Mattermost fails to check the "inviteguest" permission in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2588 Mattermost race condition in github.com/mattermost/mattermost-server
Mattermost race condition in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...
GO-2024-2479 Authentik vulnerable to PKCE downgrade attack in goauthentik.io
Authentik vulnerable to PKCE downgrade attack in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2024-2486 HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault...
GO-2024-2508 Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault
Enumeration of users in HashiCorp Vault in github.com/hashicorp/vault...
GO-2024-2592 Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server
Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2441 The DES/3DES cipher was used as part of the TLS protocol by installation tools in github.com/karmada-io/karmada
The DES/3DES cipher was used as part of the TLS protocol by installation tools in github.com/karmada-io/karmada...
GO-2024-2478 chasquid HTTP Request/Response Smuggling vulnerability in github.com/albertito/chasquid in blitiri.com.ar/go/chasquid
chasquid HTTP Request/Response Smuggling vulnerability in github.com/albertito/chasquid in blitiri.com.ar/go/chasquid...
GO-2024-2499 Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio
Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation in github.com/minio/minio...
GO-2024-2510 Grafana Cross-site Scripting (XSS) in github.com/grafana/grafana
Grafana Cross-site Scripting XSS in github.com/grafana/grafana...
GO-2024-2520 Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana
Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server
Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2024-2531 1Panel set-cookie is missing the Secure keyword in github.com/1Panel-dev/1Panel
1Panel set-cookie is missing the Secure keyword in github.com/1Panel-dev/1Panel...
GO-2024-2523 Grafana stored XSS in github.com/grafana/grafana
Grafana stored XSS in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...