Vulnerabilities

TI-2022-20284 CVE-2022-41943

Incorrect default permissions found in Sourcegraph

MEDIUM 45

sourcegraph is a code intelligence platform.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.01848 Published 2022-11-22 Fixed in 4.1.0 CWE-276

TI-2022-20283 CVE-2022-41942

Sourcegraph vulnerable to Comand Injection via gitserver

MEDIUM 42

Sourcegraph is a code intelligence platform.

CVSS 3.1HIGH 7.9 Adjacent network Low privileges No interaction EPSS 0.02833 Published 2022-11-22 Fixed in 4.1.0 CWE-20

TI-2022-13198 CVE-2022-31155

Unauthorized overwriting of saved searches in Sourcegraph

LOW 21

Sourcegraph is an opensource code search and navigation engine.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00506 Published 2022-08-01 Fixed in 3.41.0 CWE-863

TI-2022-13197 CVE-2022-31154

Indirect Object Access in Sourcegraph Code Monitoring

LOW 29

Sourcegraph is an opensource code search and navigation engine.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00506 Published 2022-08-01 Fixed in 3.42 CWE-863

TI-2022-11715 CVE-2022-29171

Remote Code Execution in sourcegraph

LOW 36

Sourcegraph is a fast and featureful code search and navigation engine.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01353 Published 2022-05-05 Fixed in 3.38.0 CWE-74

TI-2022-07694 CVE-2022-23642

Code Injection in Sourcegraph

HIGH 79

Sourcegraph is a code search and navigation engine.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.7431 Published 2022-02-18 Fixed in 3.37 CWE-94

TI-2022-07695 CVE-2022-23643

Side-channel attack in Sourcegraph Code Monitors

LOW 30

Sourcegraph is a code search and navigation engine.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00801 Published 2022-02-15 Fixed in 3.35.2, 3.36.3 CWE-200

TI-2021-19629 CVE-2021-43823

Side-channel attack in Sourcegraph

LOW 30

Sourcegraph is a code search and navigation engine.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00865 Published 2021-12-13 Fixed in 3.33.2 CWE-200

TI-2021-12453 CVE-2021-32787

Low risk information disclosure in Sourcegraph

LOW 21

Sourcegraph is a code search and navigation engine.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00649 Published 2021-08-02 Fixed in 3.30.0 CWE-200

TI-2020-09815 CVE-2020-12283 · GHSA-mx43-r985-5h4m

Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper…

LOW 30

Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01333 Published 2020-04-30 Fixed in 3.14.4, 3.15.1 CWE-601

Vulnerabilities

Filters