Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 143

Export CSV
CVE-2022-29526

golang: syscall: faccessat checks wrong group

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

CVSS 3.1 · 5.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Fedoraproject Golang Linux and 2 more
Products
Fedora Go Linux Kernel and 12 more
CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf and 13 more
CVE-2022-27664

golang: net/http: handle server errors after sending GOAWAY

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Acm and 16 more
CVE-2022-0691

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Redhat Url-parse Project
Products
Rhmt Url-parse
CVE-2022-0686

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

CVSS 3.1 · 9.1 Critical EPSS 1.8% KEV · Not listed
Vendors
Redhat Url-parse Project
Products
Rhmt Url-parse
CVE-2022-0512

Authorization Bypass Through User-Controlled Key in unshiftio/url-parse

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

CVSS 3.1 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat Url-parse Project
Products
Rhmt Url-parse
CVE-2021-44717

golang: syscall: don't close fd 0 on ForkExec error

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

CVSS 3.1 · 4.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Golang Opengroup and 1 more
Products
Debian Linux Go Unix and 7 more
CVE-2021-44716

golang: net/http: limit growth of header canonicalization cache

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Cloud Insights Telegraf and 13 more
CVE-2021-43138

async: Prototype Pollution in async

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

CVSS 3.1 · 7.8 High EPSS 3.3% KEV · Not listed
Vendors
Async Project Fedoraproject Redhat
Products
Async Fedora Rhmt and 1 more
CVE-2021-41772

golang: archive/zip: Reader.Open panics on empty string

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Golang Oracle and 1 more
Products
Fedora Go Timesten In-memory Database and 5 more
CVE-2021-41771

golang: debug/macho: invalid dynamic symbol table command can cause panic

ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

CVSS 3.1 · 7.5 High EPSS 4.7% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 1 more
Products
Debian Linux Fedora Go and 3 more
CVE-2021-41190

Clarify Content-Type handling in OCI spec

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

CVSS 3.1 · 3 Low EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Linuxfoundation Redhat
Products
Fedora Open Container Initiative Distribution Specification Open Container Initiative Image Format Specification and 7 more
CVE-2021-3948

mig-controller: incorrect namespaces handling may lead to not authorized usage of Migration Toolkit for Containers (MTC)

An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker may be able to migrate a malicious workload to the target cluster, impacting confidentiality, integrity, and availability of the services located on that cluster.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Konveyor Redhat
Products
Mig-controller Enterprise Linux Migration Toolkit and 1 more
CVE-2021-3757

Prototype Pollution in immerjs/immer

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Immer Project Redhat
Products
Immer Rhmt
CVE-2021-3749

Inefficient Regular Expression Complexity in axios/axios

axios is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Axios Oracle Redhat and 1 more
Products
Axios Goldengate Acm and 6 more
CVE-2021-39293

golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Cloud Insights Telegraf Advanced Cluster Security and 4 more
CVE-2021-36221

golang: net/http/httputil: panic due to racy read of persistConn after handler panic

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

CVSS 3.1 · 5.9 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 3 more
Products
Debian Linux Fedora Go and 12 more