Vulnerabilities > Golang > GO > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-12-14 CVE-2020-29511 The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
network
high complexity
golang netapp
5.6
5.6
2020-12-14 CVE-2020-29510 The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
network
high complexity
golang netapp
5.6
5.6
2020-12-14 CVE-2020-29509 The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
network
high complexity
golang netapp
5.6
5.6
2020-09-02 CVE-2020-24553 Cross-site Scripting vulnerability in multiple products
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
network
low complexity
golang fedoraproject opensuse oracle CWE-79
6.1
6.1
2020-07-17 CVE-2020-15586 Race Condition vulnerability in multiple products
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. 		5.9
5.9
2020-07-17 CVE-2020-14039 Improper Certificate Validation vulnerability in multiple products
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows).
network
low complexity
golang opensuse CWE-295
5.3
5.3
2019-03-13 CVE-2019-9741 CRLF Injection vulnerability in multiple products
An issue was discovered in net/http in Go 1.11.5.
network
low complexity
golang debian fedoraproject redhat CWE-93
6.1
6.1
2017-10-05 CVE-2017-15042 Cleartext Transmission of Sensitive Information vulnerability in Golang GO
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1.
network
high complexity
golang CWE-319
5.9
5.9
2017-07-06 CVE-2017-8932 Incorrect Calculation vulnerability in multiple products
A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points.
network
high complexity
golang fedoraproject novell opensuse CWE-682
5.9
5.9