4632 matches found
GO-2024-2857 Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana
Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
GO-2024-2867 Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana
Grafana Spoofing originalUrl of snapshots in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2872 github.com/bincyber/go-sqlcrypter vulnerable to IV collision
github.com/bincyber/go-sqlcrypter vulnerable to IV collision...
GO-2024-2856 Grafana Race condition allowing privilege escalation in github.com/grafana/grafana
Grafana Race condition allowing privilege escalation in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners,...
GO-2024-2865 Stakater Forecastle has a directory traversal vulnerability in github.com/stakater/Forecastle
Stakater Forecastle has a directory traversal vulnerability in github.com/stakater/Forecastle...
GO-2024-2843 Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana
Grafana Email addresses and usernames can not be trusted in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2866 Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator
Submariner Operator sets unnecessary RBAC permissions in helm charts in github.com/submariner-io/submariner-operator...
GO-2024-2811 piraeus-operator allows attacker to impersonate service account in github.com/piraeusdatastore/piraeus-operator
piraeus-operator allows attacker to impersonate service account in github.com/piraeusdatastore/piraeus-operator...
GO-2024-2886 MinIO information disclosure vulnerability in github.com/minio/minio
MinIO information disclosure vulnerability in github.com/minio/minio...
GO-2024-2850 NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server
NATS server TLS missing ciphersuite settings when CLI flags used in github.com/nats-io/nats-server...
GO-2024-2816 kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt
kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt...
GO-2024-2848 Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana
Grafana when using email as a username can block other users from signing in in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2885 Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder
Denial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder...
GO-2024-2882 github.com/huandu/facebook may expose access_token in error message.
github.com/huandu/facebook may expose accesstoken in error message...
GO-2024-2844 Grafana User enumeration via forget password in github.com/grafana/grafana
Grafana User enumeration via forget password in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...
GO-2024-2880 Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik
Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop in github.com/traefik/traefik...
GO-2024-2877 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache in github.com/argoproj/argo-cd...
GO-2024-2852 Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana
Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
GO-2024-2871 Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder
Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder...
GO-2024-2855 Grafana Plugin signature bypass in github.com/grafana/grafana
Grafana Plugin signature bypass in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an edi...
GO-2024-2849 dotmesh arbitrary file read and/or write in github.com/dotmesh-io/dotmesh
dotmesh arbitrary file read and/or write in github.com/dotmesh-io/dotmesh...
GO-2024-2847 Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana
Grafana Escalation from admin to server admin when auth proxy is used in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2024-2851 Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana
Grafana Data source and plugin proxy endpoints leaking authentication tokens to some destination plugins in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2024-2804 Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel
Zitadel exposing internal database user name and host information in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...
GO-2024-2854 Grafana folders admin only permission privilege escalation in github.com/grafana/grafana
Grafana folders admin only permission privilege escalation in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2024-2817 karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada
karmada vulnerable to arbitrary code execution via a crafted command in github.com/karmada-io/karmada...
GO-2024-2887 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...
GO-2024-2888 Mishandling of corrupt central directory record in archive/zip
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...
GO-2024-2690 HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault
HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault...
GO-2024-2578 Apache Answer Cross-site Scripting vulnerability in github.com/apache/incubator-answer
Apache Answer Cross-site Scripting vulnerability in github.com/apache/incubator-answer...
GO-2024-2791 CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o
CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o...
GO-2024-2689 Temporal Server Denial of Service in go.temporal.io/server
Temporal Server Denial of Service in go.temporal.io/server...
GO-2024-2765 Permissions bypass in KubeVirt in kubevirt.io/kubevirt
Permissions bypass in KubeVirt in kubevirt.io/kubevirt...
GO-2024-2757 Buffer Overflow in gitea in code.gitea.io/gitea
Buffer Overflow in gitea in code.gitea.io/gitea...
GO-2024-2692 Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble
Pebble service manager's file pull API allows access by any user in github.com/canonical/pebble...
GO-2024-2597 Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb
Integer overflow in chunking helper causes dispatching to miss elements or panic in github.com/authzed/spicedb...
GO-2024-2803 Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome
Navidrome Parameter Tampering vulnerability in github.com/navidrome/navidrome...
GO-2024-2581 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs
User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs...
GO-2024-2649 Types for Vela Insecure Variable Substitution in github.com/go-vela/types
Types for Vela Insecure Variable Substitution in github.com/go-vela/types...
GO-2024-2754 Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes
Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes...
GO-2024-2861 azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver
azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver...
GO-2024-2746 Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes
Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission plugin in k8s.io/kubernetes...
GO-2024-2716 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb
SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used in github.com/authzed/spicedb...
GO-2024-2836 sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy
sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy...
GO-2024-2741 Owncast Path Traversal vulnerability in github.com/owncast/owncast
Owncast Path Traversal vulnerability in github.com/owncast/owncast...
GO-2024-2575 Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3
Helm's Missing YAML Content Leads To Panic in helm.sh/helm/v3...
GO-2024-2568 Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium
Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium...
GO-2024-2863 wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl
wolfictl leaks GitHub tokens to remote non-GitHub git servers in github.com/wolfi-dev/wolfictl...
GO-2024-2729 OpenFGA Authorization Bypass in github.com/openfga/openfga
OpenFGA Authorization Bypass in github.com/openfga/openfga...
GO-2024-2644 Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid
Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid...