Skip to content

Commit 8ed6db9

Browse files
tatianabtatianab
committed
data/reports: add 44 unreviewed reports
 - data/reports/GO-2024-2576.yaml - data/reports/GO-2024-2695.yaml - data/reports/GO-2024-2737.yaml - data/reports/GO-2024-2795.yaml - data/reports/GO-2024-2799.yaml - data/reports/GO-2024-2715.yaml - data/reports/GO-2024-2798.yaml - data/reports/GO-2024-2793.yaml - data/reports/GO-2024-2705.yaml - data/reports/GO-2024-2808.yaml - data/reports/GO-2024-2875.yaml - data/reports/GO-2024-2635.yaml - data/reports/GO-2024-2707.yaml - data/reports/GO-2024-2797.yaml - data/reports/GO-2024-2726.yaml - data/reports/GO-2024-2650.yaml - data/reports/GO-2024-2698.yaml - data/reports/GO-2024-2760.yaml - data/reports/GO-2024-2788.yaml - data/reports/GO-2024-2629.yaml - data/reports/GO-2024-2771.yaml - data/reports/GO-2024-2794.yaml - data/reports/GO-2024-2637.yaml - data/reports/GO-2024-2734.yaml - data/reports/GO-2024-2764.yaml - data/reports/GO-2024-2762.yaml - data/reports/GO-2024-2566.yaml - data/reports/GO-2024-2789.yaml - data/reports/GO-2024-2664.yaml - data/reports/GO-2024-2688.yaml - data/reports/GO-2024-2697.yaml - data/reports/GO-2024-2719.yaml - data/reports/GO-2024-2718.yaml - data/reports/GO-2024-2468.yaml - data/reports/GO-2024-2717.yaml - data/reports/GO-2024-2761.yaml - data/reports/GO-2024-2796.yaml - data/reports/GO-2024-2706.yaml - data/reports/GO-2024-2722.yaml - data/reports/GO-2024-2665.yaml - data/reports/GO-2024-2750.yaml - data/reports/GO-2024-2809.yaml - data/reports/GO-2024-2696.yaml - data/reports/GO-2024-2732.yaml Fixes #2576 Fixes #2695 Fixes #2737 Fixes #2795 Fixes #2799 Fixes #2715 Fixes #2798 Fixes #2793 Fixes #2705 Fixes #2808 Fixes #2875 Fixes #2635 Fixes #2707 Fixes #2797 Fixes #2726 Fixes #2650 Fixes #2698 Fixes #2760 Fixes #2788 Fixes #2629 Fixes #2771 Fixes #2794 Fixes #2637 Fixes #2734 Fixes #2764 Fixes #2762 Fixes #2566 Fixes #2789 Fixes #2664 Fixes #2688 Fixes #2697 Fixes #2719 Fixes #2718 Fixes #2468 Fixes #2717 Fixes #2761 Fixes #2796 Fixes #2706 Fixes #2722 Fixes #2665 Fixes #2750 Fixes #2809 Fixes #2696 Fixes #2732 Change-Id: I8f664cb56ccc1fbce1437179178f78fa3825a1c5 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/590278 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
1 parent 69991d5 commit 8ed6db9

File tree

88 files changed

+3973
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

88 files changed

+3973
-0
lines changed

‎data/osv/GO-2024-2468.json

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2468",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2022-3328",
8+
"GHSA-cjqf-877p-7m3f"
9+
],
10+
"summary": "snapd Race Condition vulnerability in github.com/snapcore/snapd",
11+
"details": "snapd Race Condition vulnerability in github.com/snapcore/snapd",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/snapcore/snapd",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3328"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://github.com/advisories/GHSA-cjqf-877p-7m3f"
39+
},
40+
{
41+
"type": "ADVISORY",
42+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3328"
43+
},
44+
{
45+
"type": "FIX",
46+
"url": "https://github.com/snapcore/snapd/commit/21ebc51f00b8a1417888faa2e83a372fd29d0f5e"
47+
},
48+
{
49+
"type": "FIX",
50+
"url": "https://github.com/snapcore/snapd/commit/6226cdc57052f4b7057d92f2e549aa169e35cd2d"
51+
},
52+
{
53+
"type": "FIX",
54+
"url": "https://github.com/snapcore/snapd/pull/12380"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://ubuntu.com/security/notices/USN-5753-1"
59+
}
60+
],
61+
"database_specific": {
62+
"url": "https://pkg.go.dev/vuln/GO-2024-2468",
63+
"review_status": "UNREVIEWED"
64+
}
65+
}

‎data/osv/GO-2024-2566.json

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2566",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-24776",
8+
"GHSA-r833-w756-h5p2"
9+
],
10+
"summary": "Mattermost fails to check the required permissions in github.com/mattermost/mattermost/server/v8",
11+
"details": "Mattermost fails to check the required permissions in github.com/mattermost/mattermost/server/v8",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/mattermost/mattermost/server/v8",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-r833-w756-h5p2"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24776"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://mattermost.com/security-updates"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2024-2566",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/osv/GO-2024-2576.json

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2576",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-1485",
8+
"GHSA-84xv-jfrm-h4gm"
9+
],
10+
"summary": "registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library",
11+
"details": "registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/devfile/registry-support/registry-library",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-84xv-jfrm-h4gm"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1485"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://access.redhat.com/security/cve/CVE-2024-1485"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264106"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/devfile/registry-support/pull/197"
55+
}
56+
],
57+
"database_specific": {
58+
"url": "https://pkg.go.dev/vuln/GO-2024-2576",
59+
"review_status": "UNREVIEWED"
60+
}
61+
}

‎data/osv/GO-2024-2629.json

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2629",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-1442",
8+
"GHSA-5mxf-42f5-j782"
9+
],
10+
"summary": "Grafana's users with permissions to create a data source can CRUD all data sources in github.com/grafana/grafana",
11+
"details": "Grafana's users with permissions to create a data source can CRUD all data sources in github.com/grafana/grafana",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/grafana/grafana",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-5mxf-42f5-j782"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1442"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://grafana.com/security/security-advisories/cve-2024-1442"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2024-2629",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/osv/GO-2024-2635.json

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2635",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-1952",
8+
"GHSA-r4fm-g65h-cr54"
9+
],
10+
"summary": "Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost/server/v8",
11+
"details": "Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost/server/v8",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/mattermost/mattermost/server/v8",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/advisories/GHSA-r4fm-g65h-cr54"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1952"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://mattermost.com/security-updates"
43+
}
44+
],
45+
"database_specific": {
46+
"url": "https://pkg.go.dev/vuln/GO-2024-2635",
47+
"review_status": "UNREVIEWED"
48+
}
49+
}

‎data/osv/GO-2024-2637.json

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2637",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-28197",
8+
"GHSA-mq4x-r2w3-j7mr"
9+
],
10+
"summary": "Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel",
11+
"details": "Account Takeover via Session Fixation in Zitadel [Bypassing MFA] in github.com/zitadel/zitadel",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/zitadel/zitadel",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-mq4x-r2w3-j7mr"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28197"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/zitadel/zitadel/commit/d4c553b75a214e41299af010ef4b26174a0f802c"
43+
},
44+
{
45+
"type": "FIX",
46+
"url": "https://github.com/zitadel/zitadel/commit/e82cb51eb819c6cdba8123c9c34c5739b46b29eb"
47+
}
48+
],
49+
"database_specific": {
50+
"url": "https://pkg.go.dev/vuln/GO-2024-2637",
51+
"review_status": "UNREVIEWED"
52+
}
53+
}

‎data/osv/GO-2024-2650.json

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2650",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-v8mx-hp2q-gw85"
8+
],
9+
"summary": "Golang SDK for Vela Insecure Variable Substitution in github.com/go-vela/sdk-go",
10+
"details": "Golang SDK for Vela Insecure Variable Substitution in github.com/go-vela/sdk-go",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/go-vela/sdk-go",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.23.2"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/go-vela/sdk-go/security/advisories/GHSA-v8mx-hp2q-gw85"
37+
},
38+
{
39+
"type": "FIX",
40+
"url": "https://github.com/go-vela/sdk-go/commit/e3a34719badf37928e60f4402abe51f8b50055e1"
41+
}
42+
],
43+
"database_specific": {
44+
"url": "https://pkg.go.dev/vuln/GO-2024-2650",
45+
"review_status": "UNREVIEWED"
46+
}
47+
}

0 commit comments

Comments
 (0)