Vulnerabilities > Golang > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-08-02 | CVE-2021-33196 | Improper Input Validation vulnerability in multiple products In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic. | 7.5 |
| 2021-07-09 | CVE-2012-2666 | Insecure Temporary File vulnerability in Golang GO 1.0.2 golang/go in 1.0.2 fixes all.bash on shared machines. | 7.5 |
| 2021-05-26 | CVE-2021-33194 | Infinite Loop vulnerability in multiple products golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input. | 7.5 |
| 2021-03-11 | CVE-2021-27918 | Infinite Loop vulnerability in Golang GO encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. | 7.5 |
| 2021-01-26 | CVE-2021-3115 | Uncontrolled Search Path Element vulnerability in multiple products Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download). | 7.5 |
| 2021-01-11 | CVE-2021-3121 | Improper Validation of Array Index vulnerability in multiple products An issue was discovered in GoGo Protobuf before 1.3.2. | 8.6 |
| 2020-12-17 | CVE-2020-29652 | NULL Pointer Dereference vulnerability in Golang SSH 0.0.02020062221362375B288015Ac9/0.0.020201203163018Be400Aefbc4C A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. | 7.5 |
| 2020-11-18 | CVE-2020-28367 | Code Injection vulnerability in Golang GO Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. | 7.5 |
| 2020-11-18 | CVE-2020-28366 | Code Injection vulnerability in multiple products Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file. | 7.5 |
| 2020-11-18 | CVE-2020-28362 | Improper Certificate Validation vulnerability in multiple products Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. | 7.5 |