Skip to content

Commit a290f44

Browse files
ethanalee-workgopherbot
ethanalee-work
authored and
gopherbot
committed
data/reports: add 15 reports
 - data/reports/GO-2025-3916.yaml - data/reports/GO-2025-3917.yaml - data/reports/GO-2025-3918.yaml - data/reports/GO-2025-3919.yaml - data/reports/GO-2025-3920.yaml - data/reports/GO-2025-3921.yaml - data/reports/GO-2025-3923.yaml - data/reports/GO-2025-3924.yaml - data/reports/GO-2025-3925.yaml - data/reports/GO-2025-3927.yaml - data/reports/GO-2025-3930.yaml - data/reports/GO-2025-3934.yaml - data/reports/GO-2025-3935.yaml - data/reports/GO-2025-3936.yaml - data/reports/GO-2025-3937.yaml Fixes #3916 Fixes #3917 Fixes #3918 Fixes #3919 Fixes #3920 Fixes #3921 Fixes #3923 Fixes #3924 Fixes #3925 Fixes #3927 Fixes #3930 Fixes #3934 Fixes #3935 Fixes #3936 Fixes #3937 Change-Id: I204c0610ec5d841896550aac3ada1f234602f774 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/701335 Reviewed-by: Markus Kusano <kusano@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ethan Lee <ethanalee@google.com>
1 parent ed83adf commit a290f44

30 files changed

Lines changed: 1316 additions & 0 deletions

‎data/osv/GO-2025-3916.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3916",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-51667",
8+
"GHSA-f2m2-4q6r-cwc4"
9+
],
10+
"summary": "simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core",
11+
"details": "simple-admin-core SQL Injection vulnerability in github.com/suyuan32/simple-admin-core",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/suyuan32/simple-admin-core",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "1.2.0"
24+
},
25+
{
26+
"fixed": "1.6.8"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "ADVISORY",
37+
"url": "https://github.com/advisories/GHSA-f2m2-4q6r-cwc4"
38+
},
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51667"
42+
},
43+
{
44+
"type": "FIX",
45+
"url": "https://github.com/suyuan32/simple-admin-core/commit/f1e2c4f3c55cd5953ad7f7b0706df48adaaeb18a"
46+
},
47+
{
48+
"type": "REPORT",
49+
"url": "https://github.com/suyuan32/simple-admin-core/issues/333"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://gist.github.com/66Giraffe66/fc258f7fcc65a6a1a1a01e217977b92d"
54+
}
55+
],
56+
"database_specific": {
57+
"url": "https://pkg.go.dev/vuln/GO-2025-3916",
58+
"review_status": "UNREVIEWED"
59+
}
60+
}

‎data/osv/GO-2025-3917.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3917",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-53884",
8+
"GHSA-8ff6-pc43-jwv3"
9+
],
10+
"summary": "NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector",
11+
"details": "NeuVector has an insecure password storage vulnerable to rainbow attack in github.com/neuvector/neuvector.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/neuvector/neuvector from v5.0.0 before v5.4.6.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/neuvector/neuvector",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "5.0.0"
35+
},
36+
{
37+
"fixed": "5.4.6"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3"
49+
}
50+
],
51+
"database_specific": {
52+
"url": "https://pkg.go.dev/vuln/GO-2025-3917",
53+
"review_status": "UNREVIEWED"
54+
}
55+
}

‎data/osv/GO-2025-3918.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3918",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-8077",
8+
"GHSA-8pxw-9c75-6w56"
9+
],
10+
"summary": "NeuVector admin account has insecure default password in github.com/neuvector/neuvector",
11+
"details": "NeuVector admin account has insecure default password in github.com/neuvector/neuvector.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/neuvector/neuvector from v5.0.0 before v5.4.6.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/neuvector/neuvector",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "5.0.0"
35+
},
36+
{
37+
"fixed": "5.4.6"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56"
49+
}
50+
],
51+
"database_specific": {
52+
"url": "https://pkg.go.dev/vuln/GO-2025-3918",
53+
"review_status": "UNREVIEWED"
54+
}
55+
}

‎data/osv/GO-2025-3919.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3919",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-54467",
8+
"GHSA-w54x-xfxg-4gxq"
9+
],
10+
"summary": "NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector",
11+
"details": "NeuVector process with sensitive arguments lead to leakage in github.com/neuvector/neuvector.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/neuvector/neuvector from v5.0.0 before v5.4.6.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/neuvector/neuvector",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"custom_ranges": [
30+
{
31+
"type": "ECOSYSTEM",
32+
"events": [
33+
{
34+
"introduced": "5.0.0"
35+
},
36+
{
37+
"fixed": "5.4.6"
38+
}
39+
]
40+
}
41+
]
42+
}
43+
}
44+
],
45+
"references": [
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-w54x-xfxg-4gxq"
49+
}
50+
],
51+
"database_specific": {
52+
"url": "https://pkg.go.dev/vuln/GO-2025-3919",
53+
"review_status": "UNREVIEWED"
54+
}
55+
}

‎data/osv/GO-2025-3920.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3920",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-vxg3-w9rv-rhr2"
8+
],
9+
"summary": "Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast",
10+
"details": "Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/edgelesssys/contrast",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "1.9.0"
23+
},
24+
{
25+
"fixed": "1.12.2"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/edgelesssys/contrast/security/advisories/GHSA-vxg3-w9rv-rhr2"
37+
},
38+
{
39+
"type": "FIX",
40+
"url": "https://github.com/edgelesssys/contrast/commit/5a5512c4af63c17bb66331e7bd2768a863b2f225"
41+
},
42+
{
43+
"type": "FIX",
44+
"url": "https://github.com/edgelesssys/contrast/commit/cf58026b30c43fe7df91eac5322da02e1725d554"
45+
},
46+
{
47+
"type": "FIX",
48+
"url": "https://github.com/edgelesssys/contrast/pull/1739"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8"
53+
}
54+
],
55+
"database_specific": {
56+
"url": "https://pkg.go.dev/vuln/GO-2025-3920",
57+
"review_status": "UNREVIEWED"
58+
}
59+
}

‎data/osv/GO-2025-3921.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3921",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-3rw9-wmc8-8948"
8+
],
9+
"summary": "Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder",
10+
"details": "Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/coder/coder",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/coder/coder/v2",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
},
41+
{
42+
"fixed": "2.23.0"
43+
}
44+
]
45+
}
46+
],
47+
"ecosystem_specific": {}
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948"
54+
},
55+
{
56+
"type": "FIX",
57+
"url": "https://github.com/coder/coder/commit/1a4160803589034ce1518e24a78f232c8d08f996"
58+
}
59+
],
60+
"database_specific": {
61+
"url": "https://pkg.go.dev/vuln/GO-2025-3921",
62+
"review_status": "UNREVIEWED"
63+
}
64+
}

0 commit comments

Comments
 (0)