github.com/canonical/lxd vulnerabilities (Go)
25 vulnerabilities.
-
github.com/canonical/lxdGo LXD has restricted project bypass leading to arbitrary command execution 9.9 Critical -
github.com/canonical/lxdGo LXD has project restriction bypass for custom volume copy across projects 7.7 High -
github.com/canonical/lxdGo LXD has project restriction bypass in instance copy across projects 7.7 High -
github.com/canonical/lxdGo LXD has arbitrary file write on client due to trusted image hash 9.9 Critical -
github.com/canonical/lxdGo LXD has argument injection in backup compression algorithm leading to AFW and ACE 9.9 Critical -
github.com/canonical/lxdGo LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image 9.9 Critical -
github.com/canonical/lxdGo LXD has arbitrary file read+write on host via templates/ symlink in malicious image 9.9 Critical -
github.com/canonical/lxdGo LXD has arbitrary file write on host via `exec-output` symlink in crafted image 9.9 Critical -
github.com/canonical/lxdGo SSRF via image import from URL allows internal network probing by authenticated users 5.0 Medium -
github.com/canonical/lxdGo Authenticated Denial of Service via Malicious Backup Tarball in LXD 6.5 Medium -
github.com/canonical/lxdGo Broken Access Control in Canonical LXD DevLXD API 8.4 High -
github.com/canonical/lxdGo Update of type field in restricted TLS certificate allows privilege escalation to cluster admin 9.1 Critical -
github.com/canonical/lxdGo Importing a crafted backup leads to project restriction bypass 9.1 Critical -
github.com/canonical/lxdGo VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf 9.1 Critical -
github.com/canonical/lxdGo Authorization Bypass in LXD GET /1.0/certificates Endpoint 2.1 Low -
github.com/canonical/lxdGo LXD vulnerable to a local privilege escalation through custom storage volumes 8.6 High -
github.com/canonical/lxdGo Path Traversal in LXD Instance Log File Retrieval 7.1 High -
github.com/canonical/lxdGo Project existence disclosure in LXD images API 6.9 Medium -
github.com/canonical/lxdGo Project Existence Disclosure via Error Handling in LXD Image Export 6.9 Medium -
github.com/canonical/lxdGo Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API 7.4 High -
github.com/canonical/lxdGo Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server 5.1 Medium -
github.com/canonical/lxdGo CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI 7.5 High -
github.com/canonical/lxdGo lxd has a restricted TLS certificate privilege escalation when in PKI mode 3.8 Low -
github.com/canonical/lxdGo lxd CA certificate sign check bypass 3.8 Low -
github.com/canonical/lxdGo Canonical LXD documentation improvement to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=true No score