Golang
Page 3 of 3 — Golang CVEs from a corpus of 227, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9634 | High | 7.8 | 2019-03-08 | Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. |
CVE-2019-6486 | High | 8.2 | 2019-01-24 | Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or… |
CVE-2018-16875 | Medium | 5.9 | 2018-12-14 | The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow… |
CVE-2018-16874 | High | 8.1 | 2018-12-14 | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go pa… |
CVE-2018-16873 | High | 8.1 | 2018-12-14 | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of… |
CVE-2018-17848 | High | 7.5 | 2018-10-01 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of ran… |
CVE-2018-17847 | High | 7.5 | 2018-10-01 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out… |
CVE-2018-17846 | High | 7.5 | 2018-10-01 | The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Par… |
CVE-2018-17143 | High | 7.5 | 2018-09-17 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in p… |
CVE-2018-17142 | High | 7.5 | 2018-09-17 | The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken… |
CVE-2018-17075 | High | 7.5 | 2018-09-16 | The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <templ… |
CVE-2018-1002207 | Medium | 5.5 | 2018-07-25 | mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary fi… |
CVE-2018-7187 | High | 8.8 | 2018-02-16 | The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" an… |
CVE-2018-6574 | High | 7.8 | 2018-02-07 | Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leverag… |
CVE-2015-5740 | Critical | 9.8 | 2017-10-18 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smu… |
CVE-2015-5739 | Critical | 9.8 | 2017-10-18 | The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP requ… |
CVE-2017-15042 | Medium | 5.9 | 2017-10-05 | An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on… |
CVE-2017-15041 | Critical | 9.8 | 2017-10-05 | Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg… |
CVE-2017-1000098 | High | 7.5 | 2017-10-05 | The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It… |
CVE-2017-1000097 | High | 7.5 | 2017-10-05 | On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not… |
CVE-2017-8932 | Medium | 5.9 | 2017-07-06 | A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect resul… |
CVE-2017-3204 | High | 8.1 | 2017-04-04 | The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to r… |
CVE-2016-5386 | High | 8.1 | 2016-07-19 | The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications… |
CVE-2016-3959 | High | 7.5 | 2016-05-23 | The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which… |
CVE-2016-3958 | High | 7.8 | 2016-05-23 | Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the cu… |
CVE-2015-8618 | High | 7.5 | 2016-01-27 | The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier… |
CVE-2014-7189 | | 2014-10-07 | crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors. |