Ecosystem
Go
5,236 known vulnerabilities.
Most affected packages
5,226 results · Feed
-
Unscored —
Panic during division of very large numbers in math/big
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
-
Unscored —
Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
-
Unscored —
Arbitrary code execution via the go command with cgo in cmd/go
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
-
Medium 5.9
Denial of Service in teler
In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills. The issue is patched…
-
Critical 9.8
Incorrect handling of credential expiry by /nats-io/nats-server
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
-
High 7.5
Nil dereference in NATS JWT, DoS of nats-server
The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).
-
Critical 9.8
Git LFS can execute a Git binary from the current directory
Git LFS 2.12.0 allows Remote Code Execution.
-
High 7.5
Denial of service in HashiCorp Consul
HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.
-
High 7.5
Access Restriction Bypass in go-ipfs
An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the at…
-
Medium 5.3
Gophish vulnerable to Server-Side Request Forgery
Gophish before 0.11.0 allows SSRF attacks.
-
Medium 6.1
Grafana XSS via a query alias for the ElasticSearch datasource
Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.
-
Critical 9.1
Use After Free in HashiCorp Nomad
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
-
Medium 6.1
containerd can be coerced into leaking credentials during image pull
In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific im…
-
High 7.2
Arbitrary Code Execution in Gitea
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented imme…
-
High 8.2
Path traversal and files overwrite with unsquashfs
Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host fi…
-
Medium 6.1
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is an issue in which an an attacker can override the registered redirect URL by performing an OAuth flow and requesting a r…
-
Medium 6.1
Redirect URL matching ignores character casing
ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower w…
-
Medium 6.4
Local Privilege Escalation in cloudflared
`cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` searches for configuration files which could be abused by a malicious entity to execute commands as a p…
-
Medium 6.8
Authorization bypass in Istio
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypass…
-
Critical 9.8
Token leases could outlive their TTL in HashiCorp Vault
HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.
-
High 7.5CVE-2020-26160 Public exploit
Authorization bypass in github.com/dgrijalva/jwt-go
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if th…
-
Medium 4.3
Authenticated users can exploit an enumeration vulnerability in Harbor
Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.
-
Medium 5.3
Signature Validation Bypass in goxmldsig
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxml…
-
High 8.1
Replay of private_key_jwt possible in ORY Fosite
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId …
-
High 8.0
Ignored storage errors on token revokation in ORY Fosite
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the tok…
-
Medium 5.3
Information disclosure in podman
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from th…
-
Low 3.0
Duplicate plugin entries in Helm
In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a …
-
Low 3.4
Improper sanitization of plugin names in Helm
In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofin…
-
Low 2.2
Duplicated chart entries in Helm
In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repositor…
-
Low 3.7
Aliases are never checked in Helm
In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A po…
-
High 8.8
Insecure permissions on build temporary rootfs in Singularity
Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.
-
High 8.1
Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity
Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.
-
High 7.5
xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service
xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
-
Unscored —
Cross-site scripting in net/http/cgi and net/http/fcgi
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction.
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction.
-
Medium 6.5
Grafana Arbitrary File Read
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
-
High 8.2
HashiCorp Vault Authentication bypass
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.
-
High 8.2
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..