Ecosystem
Go
5,236 known vulnerabilities.
Most affected packages
5,226 results · Feed
-
Critical 9.1
Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unau…
-
High 8.4
lakeFS logs S3 credentials in plain text
### Impact S3 credentials are logged in plain text ``` S3Creds:{Key:AKIAIOSFODNN7EXAMPLE Secret:wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY ``` appears as part of the log message: ``` time="2023-05-12T13:51:52Z" level=error msg="failed to perform diff" func="pkg…
-
Medium 6.2
User with permission to write actions can impersonate another user when auth token is configured in environment variable
### Impact When lakeFS is configured with **ALL** of the following: - Configuration option `auth.encrypt.secret_key` passed through environment variable - Actions enabled via configuration option `actions.enabled` (default enabled) then a user who can configu…
-
High 8.8
Rancher users retain access after moving namespaces into projects they don't have access to
In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project.
-
Medium 5.3
Captcha verification bypass in github.com/mojocn/base64Captcha
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always cons…
-
Medium 6.5
Header spoofing in caddy-geo-ip
The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in …
-
Low —
eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations
### Impact The eventing-gitlab cluster-local server doesn't set `ReadHeaderTimeout` which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to…
-
High 7.5
Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memor…
-
Low —
eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations
### Impact The eventing-github cluster-local server doesn't set `ReadHeaderTimeout` which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to…
-
Unscored —
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affec…
-
Unscored —
Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…
-
Medium 5.3
Public endpoint /metrics of Calls plugin reveals channel IDs
Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public /metrics endpoint is revealing channelIDs.
-
High 7.1
Client side path traversal due to lack of route parameters validation
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side path traversal.
-
Medium 5.9
pubnub Insufficient Entropy vulnerability
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions …
-
Low —
Canonical LXD documentation improvement to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=true
### Summary If a user has restricted access to a project that is configured with `restricted=true`, they can gain root access on the system by creating a disk device with `shift=true` and creating a setuid root executable. This is possible because the `shift`…
-
Unscored —
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…
-
Medium 5.3
Malicious parameters can cause a denial of service in lestrrat-go/jwx
lestrrat-go/jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. A p2c parameter set too high in JWE's algorithm PBES2-* could lead to a denial of service. The JWE key management algorithms based on PBKDF2 r…
-
High —
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks
### Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. ### Patches The issue has been pat…
-
Medium 4.9
Possible private key restoration in go package github.com/ecies/go
ecies is an Elliptic Curve Integrated Encryption Scheme for secp256k1 in Golang. If funcations Encapsulate(), Decapsulate() and ECDH() could be called by an attacker, they could recover any private key that interacts with it. This vulnerability was patched in…
-
High 7.5
Uncontrolled Resource Consumption in Traefik
Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This is…
-
Medium 4.8
Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL…
-
Medium 5.9
Denial of service whith ACME HTTPChallenge in Traefik
Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attack…
-
High 8.1
ZITADEL vulnerable account takeover via malicious host header injection
ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten a…
-
Medium 5.9
HTTP request body disclosure in github.com/go-resty/resty/v2
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync…
-
Medium 6.5
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Servic…
-
Medium 4.3
Open redirect in /oauth/<service>/mobile_login?redirect_to=
Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providing a invalid custom url scheme in /oauth/{service}/mobile_login?redirect_to=
-
Medium 4.3
Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
-
Medium 4.3
Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting …
-
Medium 4.3
Log Flooding due to specially crafted requests in different endpoints
Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log.
-
Low 3.1
HTML injection via channel autocomplete
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.
-
Medium 4.3
Denial of Service via specially crafted block fields in Mattermost Boards
Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted…
-
Medium 4.3
Denial of Service via Board Import Zip Bomb
Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted…
-
Medium 4.3
Users full name disclosure through Mattermost Boards with Show Full Name Option disabled
Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled.
-
Medium 4.3
Username and Icon override can be used by members when Hardened Mode is enabled
Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and i…
-
Critical 9.8
OwnCast remote code execution vulnerability
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.
-
Critical 9.8
Authentication bypass using an empty token in capsule-proxy
capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running…
-
Critical 9.1
SQL injection vulnerability in Meshery
A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter
-
Medium —
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-servic…
-
High 7.5
Inefficient Regular Expression Complexity in git-urls
git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.
-
High —
Free5gc allows a local attacker to cause a denial of service via the free5gc-compose component
An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.