Ecosystem
Go
5,236 known vulnerabilities.
Most affected packages
5,226 results · Feed
-
Medium 5.4
AdGuardHome - CSRF
In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the …
-
High 7.5
Traefik HTTP/2 connections management could cause a denial of service
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of …
-
Medium 6.5
Nomad Panics On Job Submission With Bad Artifact Stanza Source URL
HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.
-
Medium —
Blst vulnerable to incorrect results for some inputs in blst_fp_eucl_inverse function
### Impact Blst versions v0.3.0 to v0.3.2 can produce the incorrect outputs for some inputs to the blst_fp_eucl_inverse function. This could theoretically result in the creation of an invalid signature from correct inputs. However, fuzzing of higher level fun…
-
Low —
etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery
### Vulnerability type Data Validation ### Detail When an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery. ### References Find out more on this vulnerability…
-
Low —
etcd user credentials are stored in WAL logs in plaintext
### Vulnerability type Data Exposure ### Workarounds The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The…
-
Low —
etcd vulnerable to TOCTOU of gateway endpoint authentication
### Vulnerability type Authentication ### Workarounds Refer to the [gateway documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md). The vulnerability was spotted due to unclear documentation of how the gateway handles en…
-
Medium 5.4
Zinc - Stored XSS
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and al…
-
Medium 5.4
Zinc - Cross-Site Scripting
In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and…
-
Medium 6.3
Digital Signature Hash Algorithms Not Validated in sylabs/sif
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signa…
-
Critical 9.3
OAuth authorization code exposure in Dex
Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a v…
-
Medium 4.8
Default OAuth Authorization Server secret in FlyteAdmin
FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication…
-
High 7.5CVE-2022-38817 Scanner template
Dapr Dashboard vulnerable to Incorrect Access Control
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
-
High 7.5
Multiple DoS Attack Vectors in sflow packet handling
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
-
Medium 6.1
Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload
dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).
-
Critical 9.6CVE-2022-40083 Scanner template
Labstack Echo Open Redirect vulnerability
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).
-
High 7.5
Hertz contains path traversal via normalizePath function
Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.
-
Medium 4.3
bytebase - Improper Authorization
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
-
Medium 4.3
bytebase - Improper Authorization
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
-
High 8.5
Bifrost users using basic authntication can bypass write permission limit
Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only h…
-
High 7.7
Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library
Not invoking a call to `pam_acct_mgmt` after a call to `pam_authenticate` to check the validity of a login can lead to an authorization bypass. ### Impact #### Exploitability The attack can be carried over the network. A complex non-standard configuration or …
-
High —
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
### Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. ### Patches lakeFS v0.82.0 and later ### Workarounds Drop specific request to the lakeFS listen port. Any request wi…
-
Low 3.1
Server-side Denial of Service while processing a specifically crafted GIF file
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Den…
-
Medium 6.5
HashiCorp Consul vulnerable to authorization bypass
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13…
-
High 7.1
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
-
High 7.6
Grafana folders admin only permission privilege escalation
Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permi…
-
Critical 9.1
HashiCorp Vault vulnerable to incorrect metadata access
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wr…
-
Medium 6.1
XSS Vulnerabilities in WebClient
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting (XSS) vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds…
-
Medium 5.4
Cloudreve - Stored XSS
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functionality. A low privileged user will be able to share a file with an admin user, which could lead to privilege escalation.
-
Medium 6.6
Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full c…
-
High 7.1
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set acc…
-
Medium —
nftables binding to an already bound chain
### Impact An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel. A denial of service can occur upon binding to an already bound chain. Affected by this vulnerability is the function nft_verdict_init of the file net/netfilter/nf_tables_…
-
High 7.0
Talos vulnerable dependency due to race condition in Linux kernel's IP framework XFRM
### Impact A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds w…
-
Low —
Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata
### Issue If an attacker is able to control a threshold of keys to insert the same public key more than once with different key IDs into signed, trusted metadata on a TUF repository, then go-tuf [clients](https://github.com/theupdateframework/go-tuf#client) <…
-
High 7.5
Out-of-bounds Read in go-cvss
go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `ParseVector`, an Out-of-Bounds Read is possible due to a lack of tests. The Go module will then panic. T…
-
High 8.7
Path Traversal vulnerability in Kubevirt
A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. …
-
Medium 6.1
ouqiang gocron Cross-site scripting vulnerability
Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue.
-
Medium 5.5
Vulnerabilities with blob verification in sigstore cosign
Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In versions prior to 1.12.0 a number of vulnerabilities have been found in cosign verify-blob, where Cosign would successfully verify an artifact when …
-
Unscored —
Failure to strip relative path components in net/url
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from …
-
High 7.2
Talos worker join token can be used to get elevated access level to the Talos API
Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos con…