Ipfs - vulnerabilities (CVEs)
9 CVEs in 8 products, 0 in the last 30 days, newest from 2023-05-10.
Products
- Go-ipfs - 2 CVEs
- Aegir - 1 CVEs
- Boxo - 1 CVEs
- Go-bitfield - 1 CVEs
- Go-ipfs-dep - 1 CVEs
- Go-merkledag - 1 CVEs
- Go-unixfs - 1 CVEs
- Go-unixfsnode - 1 CVEs
Newest CVEs of Ipfs
- CVE-2023-25568 - CVSS 8.2 (high), 2023-05-10: Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able…
- CVE-2023-23626 - CVSS 7.5 (high), 2023-02-09: go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into…
- CVE-2023-23631 - CVSS 7.5 (high), 2023-02-09: github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2…
- CVE-2023-23625 - CVSS 7.5 (high), 2023-02-09: go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and…
- CVE-2022-23495 - CVSS 7.5 (high), 2022-12-08: go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such…
- CVE-2020-26283 - CVSS 8.8 (high), 2021-03-24: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control…
- CVE-2020-26279 - CVSS 8.1 (high), 2021-03-24: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is…
- CVE-2020-11059 - CVSS 9.6 (critical), 2020-05-27: In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser…
- CVE-2016-10563 - CVSS 8.1 (high), 2018-05-31: During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise…
