Ecosystem
Go
5,236 known vulnerabilities.
Most affected packages
2,199 results · Clear filters · Feed
-
Medium 6.9
Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames
beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3…
-
Medium 4.4
Cert-manager: potential dos when parsing specially crafted pem inputs
A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of…
-
Medium 6.9
SiYuan has an SSTI via /api/template/renderSprig
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows a…
-
Medium 6.4
kcp's impersonation allows access to global administrative groups
### Impact [Impersonation](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) is a feature of the Kubernetes API, allowing to override user information. As downstream project, kcp inherits this feature. As per the link…
-
Medium —
CosmWasm VM Incorrect metering
# CWA-2024-007 **Severity** Medium (Moderate + Likely)[^1] **Affected versions:** - wasmvm >= 2.1.0, < 2.1.3 - wasmvm >= 2.0.0, < 2.0.4 - wasmvm < 1.5.5 - cosmwasm-vm >= 2.1.0, < 2.1.4 - cosmwasm-vm >= 2.0.0, < 2.0.7 - cosmwasm-vm < 1.5.8 **Patched versions:*…
-
Medium —
Panic in wasmvm can slow down block production
# CWA-2024-008 **Severity** Medium (Moderate + Likely)[^1] **Affected versions:** - wasmvm >= 2.1.0, < 2.1.3 - wasmvm >= 2.0.0, < 2.0.4 - wasmvm < 1.5.5 - cosmwasm-vm >= 2.1.0, < 2.1.4 - cosmwasm-vm >= 2.0.0, < 2.0.7 - cosmwasm-vm < 1.5.8 **Patched versions:*…
-
Medium 5.3
Hugo does not escape some attributes in internal templates
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust the…
-
Medium 6.3
GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability
The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run do…
-
Medium 4.9
Vitess allows HTML injection in /debug/querylogz & /debug/env
Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page …
-
Medium 6.5CVE-2024-53259 Public exploit
quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-…
-
Medium 6.3
Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using `--auth-mode=client`, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: `/api/v1/workflow…
-
Medium 5.3
Brute force takeover of OpenID Connect session cookies in sftpgo
sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other …
-
Medium 6.3
X-Forwarded-Prefix Header still allows for Open Redirect in traefik
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1.…
-
Medium 6.5
Moby Race Condition vulnerability
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.
-
Medium 6.5
NULL Pointer Dereference on moby image history
moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.
-
Medium 6.5
Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli
The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com. This vulner…
-
Medium 6.5
go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace
go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a code…
-
Medium 5.1
Open Redirect Vulnerability in Loading Page in bunkerweb
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading e…
-
Medium 5.7
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion
lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a …
-
Medium 5.8
Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specif…
-
Medium 5.3
Openshift-console: openshift console: server-side request forgery
A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed serv…
-
Medium 5.1
SFTPGo allows administrators to restrict command execution from the EventManager
SFTPGo is a full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob. One powerful feature of SFTPGo is the ability to have the EventManager execute scripts or run applications in response to certain e…
-
Medium 5.4
Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify owners…
-
Medium 6.5
CVE-2024-24425 in github.com/magma/magma
Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
-
Medium 6.4
Harbor fails to validate the user permissions when updating a robot account
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. By sending a request that attempts to update a robot account, and specifying a robot account id and robo…
-
Medium 6.4
Harbor fails to validate the user permissions when updating tag immutability policies
Harbor fails to validate the user permissions when updating tag immutability policies. By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker co…
-
Medium 5.9
Path Traversal in Safearchive
There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems (e.g., NTFS). This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7…
-
Medium 6.1
LocalAI Cross-site Scripting vulnerability
localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.
-
Medium 5.5
Out-of-memory during deserialization with crafted inputs
gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal err…
-
Medium 6.1
Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation
A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.
-
Medium 4.6
Client-Side Path Traversal Leading to CSRF in Playbooks
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
-
Medium 4.3
DoS via Amplified GraphQL Response in Playbooks
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn cou…
-
Medium 4.3
Arbitrary post deletion via Playbooks /ignore-thread endpoint
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.
-
Medium 4.3
Private channel names leaked with Ctrl+K when ElasticSearch is enabled
Mattermost versions 9.5.x <= 9.5.9 fail to properly filter the channel data when ElasticSearch is enabled which allows a user to get private channel names by using cmd+K/ctrl+K.
-
Medium 5.7
Argo Workflows Controller: Denial of Service via malicious daemon Workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access t…
-
Medium 5.9
Denied Host Validation Bypass in Zitadel Actions
Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to lo…
-
Medium 5.3
Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse
The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content I…
-
Medium 5.3
Graphql: information disclosure via graphql introspection in openshift
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surfac…
-
Medium 4.0
CIDR deny policies may not take effect when a more narrow CIDR allow is present
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule…
-
Medium 6.5
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling, the Kube API secret values are written in plaintext on the AppliedSpec. Cluster owners, Cluster membe…