Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Crypto
MEDIUM 5.3
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is …
Crypto
MEDIUM 5.3
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause u…
Go
MEDIUM 5.3
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response …
Go
HIGH 7.5
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the ce…
Go
HIGH 7.5
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equa…
Go
HIGH 7.5
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untr…
Go
MEDIUM 5.3
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
Go
MEDIUM 5.3
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is…
Go
MEDIUM 5.3
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IP…
Go
MEDIUM 6.5
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", a…
Go
HIGH 7.0
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can resu…
Go
HIGH 8.6
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is…
Go
MEDIUM 5.5
os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, O…
Go
CRITICAL 9.8
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which woul…
Go
MEDIUM 5.5
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment cou…
Go
HIGH 7.5
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via th…
Go
MEDIUM 5.3
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network…
Go
HIGH 7.5
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing att…
Go
HIGH 7.5
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equiv…
Go
MEDIUM 5.3
On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", a…
Go
HIGH 7.5
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total…
Go
HIGH 8.1
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed …
Go
HIGH 7.5
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
Go
HIGH 7.5
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection …
Go
CRITICAL 9.8
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "…
Go
MEDIUM 6.1
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may caus…
Go
MEDIUM 6.1
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script…
Networking
MEDIUM 6.1
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS at…
Image
MEDIUM 6.5
A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excess…
Image
MEDIUM 6.5
The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (bot…