templater

Sep 10, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 29, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 24, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 20, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 16, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 15, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 14, 2023 GO-2023-2397 +1 more

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Aug 8, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 18, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 9, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 4, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 1, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jun 1, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 21, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 21, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

May 10, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 24, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 19, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Apr 5, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 28, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 28, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 26, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 9, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 9, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Mar 6, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 26, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 23, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 8, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 7, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Feb 2, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 29, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 22, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 17, 2023 GO-2023-2012 +3 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

  GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs

Jan 8, 2023 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 22, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 14, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Dec 13, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 24, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 16, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Nov 8, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 24, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 12, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 4, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 3, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 22, 2022 GO-2023-2012 +2 more

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Oct 9, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 5, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Sep 4, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 30, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 23, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 23, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 22, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 17, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 11, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Aug 3, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 14, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Jul 11, 2022 GO-2022-1019 +3 more

  GO-2022-1019: lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

  GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

  GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs

  GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

Changes in this version

+ var ErrBadFuncRet = errors.New("wrong number of return values")

+ var ErrNotAuthorized = errors.New("unauthorized")

+ var ErrNotFound = errors.New("template not found")

+ var ErrPathTraversalBlocked = errors.New("path traversal blocked")

+ var ErrTemplateFailed = errors.New("")

+ func WrapFuncMapWithData(funcMap template.FuncMap, data interface{}) template.FuncMap

+ type AuthService interface

+ type ControlledParams struct

+ Auth AuthService

+ Ctx context.Context

+ Header http.Header

+ Phase Phase

+ Store map[string]interface{}

+ User *auth_model.User

+ type Credentials struct

+ Key string

+ Secret string

+ type Expander interface

+ Expand func(w io.Writer, params *Params) error

+ func MakeExpander(name, tmpl string, cfg *config.Config, auth AuthService) (Expander, error)

+ type ExpanderMap struct

+ func NewExpanderMap(fs fs.FS, cfg *config.Config, auth AuthService) *ExpanderMap

+ func (em *ExpanderMap) Get(ctx context.Context, username, name string) (Expander, error)

+ type Params struct

+ Controlled *ControlledParams

+ Data *UncontrolledData

+ type Phase string

+ const PhaseExpand

+ const PhasePrepare

+ type Service interface

+ Expand func(ctx context.Context, w http.ResponseWriter, user *model.User, ...) error

+ func NewService(fs fs.FS, cfg *config.Config, auth AuthService) Service

+ type UncontrolledData struct

+ Query map[string]string

+ Username string