Skip to content

Commit 5ab3cde

Browse files
thatnealpatelthatnealpatel
committed
data/reports: add 17 reports
 - data/reports/GO-2025-3938.yaml - data/reports/GO-2025-3939.yaml - data/reports/GO-2025-3941.yaml - data/reports/GO-2025-3942.yaml - data/reports/GO-2025-3943.yaml - data/reports/GO-2025-3944.yaml - data/reports/GO-2025-3945.yaml - data/reports/GO-2025-3949.yaml - data/reports/GO-2025-3950.yaml - data/reports/GO-2025-3951.yaml - data/reports/GO-2025-3952.yaml - data/reports/GO-2025-3953.yaml - data/reports/GO-2025-3954.yaml - data/reports/GO-2025-3958.yaml - data/reports/GO-2025-3959.yaml - data/reports/GO-2025-3960.yaml - data/reports/GO-2025-3961.yaml Fixes #3938 Fixes #3939 Fixes #3941 Fixes #3942 Fixes #3943 Fixes #3944 Fixes #3945 Fixes #3949 Fixes #3950 Fixes #3951 Fixes #3952 Fixes #3953 Fixes #3954 Fixes #3958 Fixes #3959 Fixes #3960 Fixes #3961 Change-Id: Ibf37c5e21e25c0b277506b7a3f78f790bb3080b7 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/704637 Reviewed-by: Markus Kusano <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent 3eadd3b commit 5ab3cde

34 files changed

+1856
-0
lines changed

‎data/osv/GO-2025-3938.json‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3938",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-58437",
8+
"GHSA-j6xf-jwrj-v5qp"
9+
],
10+
"summary": "Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder",
11+
"details": "Coder vulnerable to privilege escalation could lead to a cross workspace compromise in github.com/coder/coder",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/coder/coder",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/coder/coder/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "2.22.0"
41+
},
42+
{
43+
"fixed": "2.24.4"
44+
},
45+
{
46+
"introduced": "2.25.0"
47+
},
48+
{
49+
"fixed": "2.25.2"
50+
}
51+
]
52+
}
53+
],
54+
"ecosystem_specific": {}
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"
61+
},
62+
{
63+
"type": "ADVISORY",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58437"
65+
},
66+
{
67+
"type": "FIX",
68+
"url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"
69+
},
70+
{
71+
"type": "FIX",
72+
"url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"
73+
},
74+
{
75+
"type": "FIX",
76+
"url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"
77+
},
78+
{
79+
"type": "FIX",
80+
"url": "https://github.com/coder/coder/pull/19667"
81+
},
82+
{
83+
"type": "FIX",
84+
"url": "https://github.com/coder/coder/pull/19668"
85+
},
86+
{
87+
"type": "FIX",
88+
"url": "https://github.com/coder/coder/pull/19669"
89+
}
90+
],
91+
"database_specific": {
92+
"url": "https://pkg.go.dev/vuln/GO-2025-3938",
93+
"review_status": "UNREVIEWED"
94+
}
95+
}

‎data/osv/GO-2025-3939.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3939",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-7445",
8+
"GHSA-rcw7-pqfp-735x"
9+
],
10+
"summary": "secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller",
11+
"details": "secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "sigs.k8s.io/secrets-store-sync-controller",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.0.2"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/kubernetes-sigs/secrets-store-sync-controller/security/advisories/GHSA-rcw7-pqfp-735x"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7445"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/kubernetes/kubernetes/issues/133897"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://groups.google.com/g/kubernetes-security-announce/c/NP7cQvQ1aGA"
50+
}
51+
],
52+
"database_specific": {
53+
"url": "https://pkg.go.dev/vuln/GO-2025-3939",
54+
"review_status": "UNREVIEWED"
55+
}
56+
}

‎data/osv/GO-2025-3941.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3941",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-58450",
8+
"GHSA-p46v-f2x8-qp98"
9+
],
10+
"summary": "pREST has a Systemic SQL Injection Vulnerability in github.com/prest/prest",
11+
"details": "pREST has a Systemic SQL Injection Vulnerability in github.com/prest/prest",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/prest/prest",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/prest/prest/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
}
42+
]
43+
}
44+
],
45+
"ecosystem_specific": {}
46+
}
47+
],
48+
"references": [
49+
{
50+
"type": "ADVISORY",
51+
"url": "https://github.com/prest/prest/security/advisories/GHSA-p46v-f2x8-qp98"
52+
},
53+
{
54+
"type": "ADVISORY",
55+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58450"
56+
},
57+
{
58+
"type": "FIX",
59+
"url": "https://github.com/prest/prest/commit/47d02b87842900f77d76fc694d9aa7e983b0711c"
60+
}
61+
],
62+
"database_specific": {
63+
"url": "https://pkg.go.dev/vuln/GO-2025-3941",
64+
"review_status": "UNREVIEWED"
65+
}
66+
}

‎data/osv/GO-2025-3942.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3942",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-58063",
8+
"GHSA-93mf-426m-g6x9"
9+
],
10+
"summary": "CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns",
11+
"details": "CoreDNS: DNS Cache Pinning via etcd Lease ID Confusion in github.com/coredns/coredns",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/coredns/coredns",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.2.0"
24+
},
25+
{
26+
"fixed": "1.12.4"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/coredns/coredns/security/advisories/GHSA-93mf-426m-g6x9"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58063"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/coredns/coredns/commit/e1768a5d272e9da649dfb8588595e5c6e4e640bf"
46+
}
47+
],
48+
"database_specific": {
49+
"url": "https://pkg.go.dev/vuln/GO-2025-3942",
50+
"review_status": "UNREVIEWED"
51+
}
52+
}

‎data/osv/GO-2025-3943.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3943",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-58430",
8+
"GHSA-rf24-wg77-gq7w"
9+
],
10+
"summary": "listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk",
11+
"details": "listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/knadh/listmonk",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/knadh/listmonk/security/advisories/GHSA-rf24-wg77-gq7w"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58430"
39+
}
40+
],
41+
"database_specific": {
42+
"url": "https://pkg.go.dev/vuln/GO-2025-3943",
43+
"review_status": "UNREVIEWED"
44+
}
45+
}

‎data/osv/GO-2025-3944.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3944",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-54123",
8+
"GHSA-r4h8-hfp2-ggmf"
9+
],
10+
"summary": "Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly",
11+
"details": "Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation in github.com/SpectoLabs/hoverfly",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/SpectoLabs/hoverfly",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
}
30+
],
31+
"references": [
32+
{
33+
"type": "ADVISORY",
34+
"url": "https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-r4h8-hfp2-ggmf"
35+
},
36+
{
37+
"type": "ADVISORY",
38+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54123"
39+
},
40+
{
41+
"type": "FIX",
42+
"url": "https://github.com/SpectoLabs/hoverfly/commit/17e60a9bc78826deb4b782dca1c1abd3dbe60d40"
43+
},
44+
{
45+
"type": "FIX",
46+
"url": "https://github.com/SpectoLabs/hoverfly/commit/a9d4da7bd7269651f54542ab790d0c613d568d3e"
47+
},
48+
{
49+
"type": "FIX",
50+
"url": "https://github.com/SpectoLabs/hoverfly/pull/1203"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://github.com/SpectoLabs/hoverfly/blob/master/core/hoverfly_service.go#L173"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/local_middleware.go#L13"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/SpectoLabs/hoverfly/blob/master/core/middleware/middleware.go#L93"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-3944",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

0 commit comments

Comments
 (0)