github.com/openziti/zrok/v2 vulnerabilities (Go)
5 vulnerabilities.
-
github.com/openziti/zrok/v2Go zrok copy writes attacker-controlled WebDAV paths outside the destination root 8.3 High -
github.com/openziti/zrok/v2Go zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write 8.7 High -
github.com/openziti/zrok/v2Go zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records 5.3 Medium -
github.com/openziti/zrok/v2Go zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing 7.5 High -
github.com/openziti/zrok/v2Go zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering 6.1 Medium