4632 matches found
GO-2024-2521 Moby Docker cp broken with debian containers in github.com/docker/docker
In Docker 19.03.x before 19.03.1 linked against the GNU C Library aka glibc, code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container...
GO-2024-2477 OpenFGA denial of service in github.com/openfga/openfga
OpenFGA denial of service in github.com/openfga/openfga...
GO-2024-2500 Moby (Docker Engine) Insufficiently restricted permissions on data directory in github.com/docker/docker
Moby Docker Engine Insufficiently restricted permissions on data directory in github.com/docker/docker...
GO-2024-2496 Apache ServiceComb Service-Center Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/servicecomb-service-center
Apache ServiceComb Service-Center Exposure of Sensitive Information to an Unauthorized Actor vulnerability in github.com/apache/servicecomb-service-center. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...
GO-2024-2446 Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server
Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2431 Insecure random string generator used for sensitive data in github.com/cubefs/cubefs
Insecure random string generator used for sensitive data in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners...
GO-2024-2591 Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server
Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2434 CubeFS leaks users key in logs in github.com/cubefs/cubefs
CubeFS leaks users key in logs in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit t...
GO-2024-2488 HashiCorp Vault Authentication bypass in github.com/hashicorp/vault
HashiCorp Vault Authentication bypass in github.com/hashicorp/vault...
GO-2024-2433 CubeFS leaks magic secret key when starting Blobstore access service in github.com/cubefs/cubefs
CubeFS leaks magic secret key when starting Blobstore access service in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2516 Grafana XSS via a column style in github.com/grafana/grafana
Grafana XSS via a column style in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...
GO-2024-2491 Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc
Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc...
GO-2024-2501 Denial of service in HashiCorp Consul in github.com/hashicorp/consul
Denial of service in HashiCorp Consul in github.com/hashicorp/consul...
GO-2024-2483 Grafana XSS via adding a link in General feature in github.com/grafana/grafana
Grafana XSS via adding a link in General feature in github.com/grafana/grafana...
GO-2024-2444 Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server
Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2485 HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault
HashiCorp Vault Improper Privilege Management in github.com/hashicorp/vault...
GO-2024-2529 Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd
Etcd embed auto compaction retention negative value causing a compaction loop or a crash in go.etcd.io/etcd...
GO-2024-2528 Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd
Etcd Gateway TLS endpoint validation only confirms TCP reachability in go.etcd.io/etcd...
GO-2024-2527 Insecure ciphers are allowed by default in go.etcd.io/etcd
The TLS ciphers list supported by etcd contains insecure cipher suites. Users may specify that an insecure cipher is used via “--cipher-suites” flag. A list of secure suites is used by default...
GO-2024-2511 Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault
Hashicorp Vault may expose sensitive log information in github.com/hashicorp/vault...
GO-2024-2557 Insufficient Session Expiration in github.com/greenpau/caddy-security
Insufficient Session Expiration in github.com/greenpau/caddy-security...
GO-2024-2564 Improper Validation of Array Index in github.com/greenpau/caddy-security
Improper Validation of Array Index in github.com/greenpau/caddy-security...
GO-2024-2481 Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2024-2563 Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security
Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security...
GO-2024-2428 Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2024-2447 Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users in github.com/gravitational/teleport
Withdrawn Advisory: Teleport Proxy and Teleport Agents: SSRF to arbitrary hosts is possible from low privileged users in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions...
GO-2024-2476 Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex
Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2449 Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport
Withdrawn Advisory: User-provided environment values allow execution on macOS agents in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...
GO-2024-2432 CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs
CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2590 Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server
Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2530 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd...
GO-2024-2595 Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server
Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2024-2448 Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server
Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2440 Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws
Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability in github.com/buildkite/elastic-ci-stack-for-aws...
GO-2024-2442 Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport
Withdrawn Advisory: Teleport Access List owners can escalate their privileges in github.com/gravitational/teleport. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2024-2513 Grafana information disclosure in github.com/grafana/grafana
Grafana information disclosure in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit...
GO-2024-2540 Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira
Mattermost Jira Plugin does not properly check security levels in github.com/mattermost/mattermost-plugin-jira. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...
GO-2024-2472 Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry
Go package github.com/notaryproject/notation configured with permissive trust policies potentially susceptible to rollback attack from compromised registry...
GO-2024-2532 Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary
Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary...
GO-2024-2480 Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF in github.com/0xJacky/Nginx-UI
Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2515 Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana
Grafana XSS via the OpenTSDB datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugges...
GO-2024-2561 Server-Side Request Forgery in github.com/greenpau/caddy-security
Server-Side Request Forgery in github.com/greenpau/caddy-security...
GO-2024-2535 Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' in github.com/rancher/rancher
Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2514 Token leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault
Token leases could outlive their TTL in HashiCorp Vault in github.com/hashicorp/vault...
GO-2024-2523 Grafana stored XSS in github.com/grafana/grafana
Grafana stored XSS in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the...
GO-2024-2499 Minio unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation in github.com/minio/minio
Minio unsafe default: Access keys inherit admin of root user, allowing privilege escalation in github.com/minio/minio...
GO-2024-2510 Grafana Cross-site Scripting (XSS) in github.com/grafana/grafana
Grafana Cross-site Scripting XSS in github.com/grafana/grafana...
GO-2024-2520 Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana
Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2541 Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server
Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positiv...