Skip to content
OpenAdvisories

Package · Go

github.com/stacklok/minder

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2024-34084

    Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests

    Minder's `HandleGithubWebhook` is susceptible to a denial of service attack from an untrusted HTTP request. The vulnerability exists before the request has been validated, and as such the request is still untrusted at the point of failure. This allows an atta…

    stacklok minder github.com/stacklok/minder Go
  • High 7.1
    CVE-2024-27916

    `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user

    Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the r…

    stacklok minder github.com/stacklok/minder Go