Ecosystem
Go
5,236 known vulnerabilities.
Most affected packages
2,199 results · Clear filters · Feed
-
Medium 4.1
Unsafe media served inline on download endpoints in matrix-media-repo
matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with `Content-Disposition: inline` u…
-
Medium 5.3
Vulnerability in Ctx.IsFromLocal() in gofiber
Fiber is an Express inspired web framework built in the go language. Versions of gofiber prior to 2.49.2 did not properly restrict access to localhost. This issue impacts users of our project who rely on the `ctx.IsFromLocal` method to restrict access to loca…
-
Medium 6.3
Terraform Allows Arbitrary File Write During Init Operation
Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
-
Medium 6.5
Denial of Service to Argo CD repo-server
Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-con…
-
Medium —
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
### Impact For Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to…
-
Medium —
Cosmos-SDK Cosmovisor component may be vulnerable to denial of service
**Component**: Cosmovisor **Criticality**: Medium **Affected Versions**: Cosmovisor < v1.0.0 (distributed with Cosmos-SDK < 0.46) **Affected Users**: Validators and Node operators utilizing unsupported versions of Cosmovisor **Impact**: DOS, potential RCE on …
-
Medium 5.5
Index out of bounds leading to crash
ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width. NOTE: it is unclear whether there are common use cases in which this panic could have any security conseq…
-
Medium 4.0
Improper log output when using GitHub Status Notifications in spinnaker
Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that th…
-
Medium 6.5
OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using …
-
Medium 4.7
Argo CD web terminal session doesn't expire
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has…
-
Medium 5.8
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files
### Impact The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in. An attacker can inject a malicious script inline, downl…
-
Medium 6.5
Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web applica…
-
Medium 4.5
Audit logging fails to sanitize post metadata
Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged
-
Medium 6.7
Incorrect authorization allows a user manager to update a system admin
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.
-
Medium 6.3
A guest user can perform various actions on public playbooks
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.
-
Medium 6.5
1Panel Unauthorized access in Backend
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file conte…
-
Medium —
Blst has logical error in SigValidate in Go bindings
### Impact Blst versions v0.3.0 through 0.3.10 failed to perform a signature group-check if the call to `SigValidate` in the Go bindings was complemented with a check for infinity. Formally speaking, infinity, or the identity element of the elliptic curve gro…
-
Medium 6.5
Gitea erroneous repo clones
In Gitea through 1.17.1, repo cloning can occur in the migration function.
-
Medium 6.5
Race Condition within a Thread in answerdev/answer
Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
-
Medium 4.1
Insufficient Session Expiration in answerdev/answer
Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0.
-
Medium 6.5
Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.
-
Medium 6.5
Excessive resource consumption in golang.org/x/image/tiff
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed dat…
-
Medium 6.1
Improper rendering of text nodes in golang.org/x/net/html
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
-
Medium 5.3
Vault's LDAP Auth Method Allows for User Enumeration
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP…
-
Medium 6.1
Apptainer's ineffective privileges drop when requesting container network
Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users…
-
Medium 6.5
Leak password hash of any user
KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including admin). A sufficiently motivated attacker may be able to crack leaded password hashes. This issue ha…
-
Medium 6.8
API token authentication bypass in HTTP endpoints in Dapr
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from t…
-
Medium 5.3
Nomad Search API Leaks Information About CSI Plugins
HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.
-
Medium 4.1
Nomad ACL Policies without Label are Applied to Unexpected Resources
HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.
-
Medium —
Tokenizer vulnerable to client brute-force of token secrets
### Impact Authorized clients, having an `inject_processor` secret, could brute-force the secret token value by abusing the `fmt` parameter to the `Proxy-Tokenizer` header. ### Patches This was fixed in https://github.com/superfly/tokenizer/pull/8 and further…
-
Medium —
iprange may panic when parsing ranges with invalid masks
Parsing a range with a mask larger than 32 bits causes a panic.
-
Medium 6.5
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries
Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r ### Summary Jaeger UI is using the `json-markup` dependency to display span attributes and resources. This dependency is not sanitising keys …
-
Medium —
Barberry Security Advisory - regarding x/auth periodic vesting accounts
### Impact In `PeriodicVestingAccount`, defined in `x/auth`, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds …
-
Medium 6.3
1Panel vulnerable to command injection when adding container repositories
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed…
-
Medium 6.3
1Panel vulnerable to ommand injection when entering the container terminal
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulnerability has been fi…
-
Medium 6.5CVE-2023-2728 Public exploit
Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the…
-
Medium 6.5
Bypassing policies imposed by the ImagePolicyWebhook admission plugin
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
-
Medium 5.9
OpenFGA denial of service die to circular relationship
OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship defi…
-
Medium 6.0
Vega's validators able to submit duplicate transactions
Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events f…
-
Medium 6.5CVE-2023-34927 Public exploit
Casdoor Cross-Site Request Forgery vulnerability
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.