CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2023-0475 |
| MOYENNE6.5 |
HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0. |
| 16/02/2023 |
| CVE-2022-30323 | ÉLEVÉE8.6 | go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0. | 25/05/2022 |
| CVE-2022-30322 | ÉLEVÉE8.6 | go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0. | 25/05/2022 |
| CVE-2022-30321 | ÉLEVÉE8.6 | go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0. | 25/05/2022 |
| CVE-2022-26945 | CRITIQUE9.8 | go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0. | 25/05/2022 |
| CVE-2022-29810 | MOYENNE5.5 | The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter. | 27/04/2022 |