4632 matches found
GO-2024-2644 Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid
Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime in github.com/fluid-cloudnative/fluid...
GO-2024-2647 CLI for Vela Insecure Variable Substitution in github.com/go-vela/cli
CLI for Vela Insecure Variable Substitution in github.com/go-vela/cli...
GO-2024-2779 Access Restriction Bypass in go-ipfs in github.com/ipfs/go-ipfs
Access Restriction Bypass in go-ipfs in github.com/ipfs/go-ipfs...
GO-2024-2645 Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei
Nuclei allows unsigned code template execution through workflows in github.com/projectdiscovery/nuclei...
GO-2024-2580 Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer
Apache Answer Race Condition vulnerability in github.com/apache/incubator-answer...
GO-2024-2859 source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller
source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller...
GO-2024-2846 Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd
Containers started with non-empty inheritable Linux process capabilities in github.com/containerd/containerd...
GO-2024-2763 Heketi Arbitrary Code Execution in github.com/heketi/heketi
Heketi Arbitrary Code Execution in github.com/heketi/heketi...
GO-2024-2853 sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address in github.com/tg123/sshpiper
sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address in github.com/tg123/sshpiper...
GO-2024-2579 Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer
Apache Answer Unrestricted Upload of File with Dangerous Type vulnerability in github.com/apache/incubator-answer...
GO-2024-2860 goreleaser shows environment by default in github.com/goreleaser/goreleaser
goreleaser shows environment by default in github.com/goreleaser/goreleaser...
GO-2024-2785 CoreDNS may return invalid cache entries in github.com/coredns/coredns
A flaw was found in coredns. This issue could lead to invalid cache entries returning due to incorrectly implemented caching...
GO-2024-2704 Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul
Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers in github.com/hashicorp/consul...
GO-2024-2723 Apache Solr Operator liveness and readiness probes may leak basic auth credentials in github.com/apache/solr-operator
Apache Solr Operator liveness and readiness probes may leak basic auth credentials in github.com/apache/solr-operator...
GO-2024-2641 Insecure Variable Substitution in Vela in github.com/go-vela/worker
Insecure Variable Substitution in Vela in github.com/go-vela/worker...
GO-2024-2747 Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo
Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo...
GO-2024-2703 Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia
Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output in github.com/kopia/kopia...
GO-2024-2766 Information disclosure in podman in github.com/containers/libpod
Information disclosure in podman in github.com/containers/libpod...
GO-2024-2569 Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium
Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium...
GO-2024-2727 Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation
Constellation has pods exposed to peers in VPC in github.com/edgelesssys/constellation...
GO-2024-2756 Privilege Escalation in kubevirt in kubevirt.io/kubevirt
Privilege Escalation in kubevirt in kubevirt.io/kubevirt...
GO-2024-2648 Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server
Server/API for Vela Insecure Variable Substitution in github.com/go-vela/server...
GO-2024-2636 1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel
1Panel is vulnerable to command injection in github.com/1Panel-dev/1Panel...
GO-2024-2701 Minder GetRepositoryByName data leak in github.com/stacklok/minder
Minder GetRepositoryByName data leak in github.com/stacklok/minder...
GO-2024-2675 Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server
Temporal UI Server cross-site scripting vulnerability in github.com/temporalio/ui-server...
GO-2024-2642 Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings...
GO-2024-2792 Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd
Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd...
GO-2024-2728 Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd
Argo CD's API server does not enforce project sourceNamespaces in github.com/argoproj/argo-cd...
GO-2024-2814 Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings...
GO-2024-2572 Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk
Missing BlockedAddressed Validation in Vesting Module in github.com/cosmos/cosmos-sdk...
GO-2024-2879 Dapr API Token Exposure in github.com/dapr/dapr
Dapr API Token Exposure in github.com/dapr/dapr...
GO-2024-2874 Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go
The ibc-go module is affected by the Inter-Blockchain Communication IBC protocol "Huckleberry" vulnerability. The vulnerability allowed an attacker to send arbitrary transactions onto target chains and trigger arbitrary state transitions, including but not limited to, theft of funds. It was...
GO-2024-2571 Invalid block proposal in github.com/cosmos/cosmos-sdk
Invalid block proposal in github.com/cosmos/cosmos-sdk...
GO-2024-2870 Credential leakage in github.com/aquasecurity/trivy
A malicious registry can cause Trivy to leak credentials for legitimate registries such as AWS Elastic Container Registry ECR, Google Cloud Artifact/Container Registry, or Azure Container Registry ACR if the registry is scanned from directly using Trivy. These tokens can then be used to push/pull...
GO-2024-2812 Some CORS middleware allow untrusted origins in github.com/jub0bs/fcors
Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...
GO-2024-2813 Some CORS middleware allow untrusted origins in github.com/jub0bs/cors
Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin patter...
GO-2024-2748 Privilege Escalation in Kubernetes in k8s.io/apimachinery
The Kubernetes kube-apiserver is vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise...
GO-2024-2632 JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx
An attacker with a trusted public key may cause a Denial-of-Service DoS condition by crafting a malicious JSON Web Encryption JWE token with an exceptionally high compression ratio. When this token is processed by the recipient, it results in significant memory allocation and processing time duri...
GO-2024-2574 Insecure CORS Configuration allowing wildcard origin with credentials in github.com/gofiber/fiber/v2
The CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard "" while also having the Access-Control-Allow-Credentials set to true...
GO-2024-2694 Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go
Potential Reentrancy using Timeout Callbacks in ibc-hooks in github.com/cosmos/ibc-go...
GO-2024-2702 Code injection vulnerability in github.com/flipped-aurora/gin-vue-admin/server
Gin-vue-admin has a code injection vulnerability in the backend. In the Plugin System - Plugin Template feature, an attacker can perform directory traversal by manipulating the 'plugName' parameter. They can create specific folders such as 'api', 'config', 'global', 'model', 'router', 'service',...
GO-2024-2842 Unexpected authenticated registry accesses in github.com/containers/image/v5
An attacker may trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...
GO-2024-2864 Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder
Denial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder...
GO-2024-2831 ATX protocol validation problem in github.com/spacemeshos/go-spacemesh
Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier but not the latest ATX as previous breaks this...
GO-2024-2830 Arbitrary file write in github.com/1Panel-dev/1Panel
A maliciously crafted packet can write to an arbitrary file...
GO-2024-2833 Denial of service in github.com/octo-sts/app
Excessively large requests can be processed, consuming a large amount of resources. This could potentially lead to a denial of service...
GO-2024-2638 ValidateVoteExtensions function in Cosmos SDK may allow incorrect voting power assumptions in github.com/cosmos/cosmos-sdk
The default ValidateVoteExtensions helper function infers total voting power based on the injected VoteExtension, which are injected by the proposer. If your chain utilizes the ValidateVoteExtensions helper in ProcessProposal, a dishonest proposer can potentially mutate voting power of each...
GO-2024-2800 Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter
When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository's HEAD reference of its default branch by passing arguments to the Git binary on the host...
GO-2024-2821 Denial of Service from untrusted requests in github.com/stacklok/minder
HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. An untrusted request can cause the server to allocate large amounts of memory resulting in a denial of service...
GO-2024-2826 Denial of service attack by triggering unbounded memory usage in vitess.io/vitess
When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service...