Open Source Vulnerabilities

octobot

gollum

Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog

angular

Angular (deprecated package) Cross-site Scripting

github.com/containrrr/shoutrrr

Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages

terser, terser

Terser insecure use of regular expressions leads to ReDoS

github.com/quay/claircore

Path traversal in github.com/quay/claircore

github.com/containers/buildah

Environment variable leakage in github.com/containers/buildah

stdlib, golang.org/x/sys

Incorrect privilege reporting in syscall and golang.org/x/sys/unix

github.com/argoproj/argo-events

Path traversal in github.com/argoproj/argo-events

github.com/blevesearch/bleve, github.com/blevesearch/bleve/v2

No access control in github.com/blevesearch/bleve and bleve/v2

helm.sh/helm/v3

Repository credentials passed to alternate domain in helm.sh/helm/v3

github.com/nats-io/jwt

Incorrect handling of credential expiry in github.com/nats-io/jwt

github.com/prometheus/client_golang

Uncontrolled resource consumption in github.com/prometheus/client_golang

github.com/google/go-attestation

Improper input validation in github.com/google/go-attestation

github.com/graph-gophers/graphql-go

Panic via malicious inputs in github.com/graph-gophers/graphql-go

stdlib, golang.org/x/net

Unbounded memory growth in net/http and golang.org/x/net/http2

github.com/opencontainers/runc

Namespace restriction bypass in github.com/opencontainers/runc

github.com/kataras/iris/v12, github.com/kataras/iris

Directory traversal in github.com/kataras/iris and github.com/kataras/iris/v12

github.com/ethereum/go-ethereum

Panic via maliciously crafted message in github.com/ethereum/go-ethereum

github.com/ethereum/go-ethereum

Consensus flaw during block processing in github.com/ethereum/go-ethereum

github.com/cloudflare/cfrpki

Resource exhaustion via GZIP bomb in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Panic on misconfigured IP address in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Panic on NUL character in ROA in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Directory traversal in manifest path extraction in github.com/cloudflare/cfrpki

github.com/cloudflare/cfrpki

Insufficient validation in github.com/cloudflare/cfrpki

github.com/satori/go.uuid

Insufficient randomness in UUIDs in github.com/satori/go.uuid

stdlib, golang.org/x/net

Panic due to large headers in net/http and golang.org/x/net/http/httpguts

stdlib

Denial of service in chain verification in crypto/x509

distributed

Workers for local Dask clusters mistakenly listened on public interfaces

github.com/cilium/cilium, github.com/cilium/cilium

Cilium host policy bypass in endpoint-routes mode with dual-stack

shescape

Shescape vulnerable to insufficient escaping of whitespace