Skip to content

Commit 05fd91d

Browse files
nicholashusinnicholashusin
committed
data/reports: add 12 reports
 - data/reports/GO-2025-4114.yaml - data/reports/GO-2025-4115.yaml - data/reports/GO-2025-4117.yaml - data/reports/GO-2025-4118.yaml - data/reports/GO-2025-4119.yaml - data/reports/GO-2025-4120.yaml - data/reports/GO-2025-4122.yaml - data/reports/GO-2025-4124.yaml - data/reports/GO-2025-4125.yaml - data/reports/GO-2025-4126.yaml - data/reports/GO-2025-4127.yaml - data/reports/GO-2025-4128.yaml Fixes #4114 Fixes #4115 Fixes #4117 Fixes #4118 Fixes #4119 Fixes #4120 Fixes #4122 Fixes #4124 Fixes #4125 Fixes #4126 Fixes #4127 Fixes #4128 Change-Id: Ic47352d07ca57ba8b1f3ef12ec3ccd49901cb6c1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/721082 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Markus Kusano <kusano@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
1 parent 6c519d2 commit 05fd91d

24 files changed

+1392
-0
lines changed

‎data/osv/GO-2025-4114.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4114",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-64513",
8+
"GHSA-mhjq-8c7m-3f7p"
9+
],
10+
"summary": "Milvus Proxy has a Critical Authentication Bypass Vulnerability in github.com/milvus-io/milvus",
11+
"details": "Milvus Proxy has a Critical Authentication Bypass Vulnerability in github.com/milvus-io/milvus.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/milvus-io/milvus before v2.4.24, from v2.5.0 before v2.5.21, from v2.6.0 before v2.6.5.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/milvus-io/milvus",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.10.3-0.20251107071934-6102f001a971"
27+
},
28+
{
29+
"introduced": "0.10.4"
30+
}
31+
]
32+
}
33+
],
34+
"ecosystem_specific": {
35+
"custom_ranges": [
36+
{
37+
"type": "ECOSYSTEM",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "2.4.24"
44+
},
45+
{
46+
"introduced": "2.5.0"
47+
},
48+
{
49+
"fixed": "2.5.21"
50+
},
51+
{
52+
"introduced": "2.6.0"
53+
},
54+
{
55+
"fixed": "2.6.5"
56+
}
57+
]
58+
}
59+
]
60+
}
61+
}
62+
],
63+
"references": [
64+
{
65+
"type": "ADVISORY",
66+
"url": "https://github.com/milvus-io/milvus/security/advisories/GHSA-mhjq-8c7m-3f7p"
67+
},
68+
{
69+
"type": "ADVISORY",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64513"
71+
},
72+
{
73+
"type": "FIX",
74+
"url": "https://github.com/milvus-io/milvus/commit/6102f001a971c8c8055a4a4cae704442d5cab793"
75+
},
76+
{
77+
"type": "FIX",
78+
"url": "https://github.com/milvus-io/milvus/pull/45379"
79+
},
80+
{
81+
"type": "FIX",
82+
"url": "https://github.com/milvus-io/milvus/pull/45383"
83+
},
84+
{
85+
"type": "FIX",
86+
"url": "https://github.com/milvus-io/milvus/pull/45391"
87+
}
88+
],
89+
"database_specific": {
90+
"url": "https://pkg.go.dev/vuln/GO-2025-4114",
91+
"review_status": "UNREVIEWED"
92+
}
93+
}

‎data/osv/GO-2025-4115.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4115",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-64507",
8+
"GHSA-56mx-8g9f-5crf"
9+
],
10+
"summary": "Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus",
11+
"details": "Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/lxc/incus",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/lxc/incus/v6",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "6.1.0"
41+
}
42+
]
43+
}
44+
],
45+
"ecosystem_specific": {}
46+
}
47+
],
48+
"references": [
49+
{
50+
"type": "ADVISORY",
51+
"url": "https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf"
52+
},
53+
{
54+
"type": "ADVISORY",
55+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64507"
56+
},
57+
{
58+
"type": "FIX",
59+
"url": "https://github.com/lxc/incus/pull/2642"
60+
},
61+
{
62+
"type": "REPORT",
63+
"url": "https://github.com/lxc/incus/issues/2641"
64+
}
65+
],
66+
"database_specific": {
67+
"url": "https://pkg.go.dev/vuln/GO-2025-4115",
68+
"review_status": "UNREVIEWED"
69+
}
70+
}

‎data/osv/GO-2025-4117.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4117",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-64523",
8+
"GHSA-6cqf-cfhv-659g"
9+
],
10+
"summary": "File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function in github.com/filebrowser/filebrowser",
11+
"details": "File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function in github.com/filebrowser/filebrowser",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/filebrowser/filebrowser",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {}
29+
},
30+
{
31+
"package": {
32+
"name": "github.com/filebrowser/filebrowser/v2",
33+
"ecosystem": "Go"
34+
},
35+
"ranges": [
36+
{
37+
"type": "SEMVER",
38+
"events": [
39+
{
40+
"introduced": "0"
41+
},
42+
{
43+
"fixed": "2.45.1"
44+
}
45+
]
46+
}
47+
],
48+
"ecosystem_specific": {}
49+
}
50+
],
51+
"references": [
52+
{
53+
"type": "ADVISORY",
54+
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6cqf-cfhv-659g"
55+
},
56+
{
57+
"type": "ADVISORY",
58+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64523"
59+
},
60+
{
61+
"type": "FIX",
62+
"url": "https://github.com/filebrowser/filebrowser/commit/291223b3cefe1e50fae8f73d70464b1dc25351a4"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-4117",
67+
"review_status": "UNREVIEWED"
68+
}
69+
}

‎data/osv/GO-2025-4118.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4118",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-6jqf-mv7m-3q7p"
8+
],
9+
"summary": "File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser",
10+
"details": "File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/filebrowser/filebrowser",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
}
24+
]
25+
}
26+
],
27+
"ecosystem_specific": {}
28+
},
29+
{
30+
"package": {
31+
"name": "github.com/filebrowser/filebrowser/v2",
32+
"ecosystem": "Go"
33+
},
34+
"ranges": [
35+
{
36+
"type": "SEMVER",
37+
"events": [
38+
{
39+
"introduced": "0"
40+
},
41+
{
42+
"fixed": "2.45.2"
43+
}
44+
]
45+
}
46+
],
47+
"ecosystem_specific": {}
48+
}
49+
],
50+
"references": [
51+
{
52+
"type": "ADVISORY",
53+
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6jqf-mv7m-3q7p"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22871"
58+
}
59+
],
60+
"database_specific": {
61+
"url": "https://pkg.go.dev/vuln/GO-2025-4118",
62+
"review_status": "UNREVIEWED"
63+
}
64+
}

‎data/osv/GO-2025-4119.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-4119",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"GHSA-7wq2-32h4-9hc9"
8+
],
9+
"summary": "AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql",
10+
"details": "AWS Advanced Go Wrapper: Privilege Escalation in Aurora PostgreSQL Instance in github.com/aws/aws-advanced-go-wrapper/awssql",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "github.com/aws/aws-advanced-go-wrapper/awssql",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "1.1.1"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {}
31+
}
32+
],
33+
"references": [
34+
{
35+
"type": "ADVISORY",
36+
"url": "https://github.com/aws/aws-advanced-go-wrapper/security/advisories/GHSA-7wq2-32h4-9hc9"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://github.com/aws/aws-advanced-go-wrapper/commit/7b405f95fe71db644cd8336ba5fa28b41e89d03e"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/aws/aws-advanced-go-wrapper/pull/270"
45+
}
46+
],
47+
"database_specific": {
48+
"url": "https://pkg.go.dev/vuln/GO-2025-4119",
49+
"review_status": "UNREVIEWED"
50+
}
51+
}

0 commit comments

Comments
 (0)