github.com/charmbracelet/soft-serve vulnerabilities (Go)
12 vulnerabilities.
-
github.com/charmbracelet/soft-serveGo charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users 5.9 Medium -
github.com/charmbracelet/soft-serveGo charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories 5.3 Medium -
github.com/charmbracelet/soft-serveGo Soft Serve: Authenticated repo import can clone server-local private repositories 7.1 High -
github.com/charmbracelet/soft-serveGo Soft Serve: SSRF via unvalidated LFS endpoint in repo import 9.1 Critical -
github.com/charmbracelet/soft-serveGo Soft Serve has Critical Authentication Bypass 8.1 High -
github.com/charmbracelet/soft-serveGo Soft Serve is missing an authorization check in LFS lock deletion 5.4 Medium -
github.com/charmbracelet/soft-serveGo Soft Serve is vulnerable to SSRF through its Webhooks 9.1 Critical -
github.com/charmbracelet/soft-serveGo Soft Serve does not sanitize ANSI escape sequences in user input 4.6 Medium -
github.com/charmbracelet/soft-serveGo Soft Serve is vulnerable to arbitrary file writing through its SSH API 7.7 High -
github.com/charmbracelet/soft-serveGo Soft Serve allows path traversal attacks 5.3 Medium -
github.com/charmbracelet/soft-serveGo Soft Serve allows arbitrary code execution by crafting git-lfs requests 8.1 High -
github.com/charmbracelet/soft-serveGo Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled 7.5 High