d7y.io/dragonfly/v2 vulnerabilities (Go)
15 vulnerabilities.
-
d7y.io/dragonfly/v2Go Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile 5.5 Medium -
d7y.io/dragonfly/v2Go Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth 2.9 Low -
d7y.io/dragonfly/v2Go Dragonfly Manager Job API Allows Unauthenticated Access 8.9 High -
d7y.io/dragonfly/v2Go Dragonfly tiny file download uses hard coded HTTP protocol 5.5 Medium -
d7y.io/dragonfly/v2Go Dragonfly has weak integrity checks for downloaded files 5.5 Medium -
d7y.io/dragonfly/v2Go Manager generates mTLS certificates for arbitrary IP addresses 7.7 High -
d7y.io/dragonfly/v2Go Dragonfly allows arbitrary file read and write on a peer machine 6.9 Medium -
d7y.io/dragonfly/v2Go Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error 2.7 Low -
d7y.io/dragonfly/v2Go Timing attacks against Proxy’s basic authentication are possible 2.7 Low -
d7y.io/dragonfly/v2Go Directories created via os.MkdirAll are not checked for permissions 2.0 Low -
d7y.io/dragonfly/v2Go Dragonfly incorrectly handles a task structure’s usedTraffic field 5.5 Medium -
d7y.io/dragonfly/v2Go Dragonfly Manager makes requests to external endpoints with disabled TLS authentication 2.7 Low -
d7y.io/dragonfly/v2Go Dragonfly server-side request forgery vulnerability 5.5 Medium -
d7y.io/dragonfly/v2Go Dragonfly did not enable authentication for some Manager’s endpoints 7.7 High -
d7y.io/dragonfly/v2Go Dragonfly2 vulnerable to hard coded cyptographic key 9.8 Critical