CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-17846
https://notcve.org/view.php?id=CVE-2018-17846
01 Oct 2018 — The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification. El paquete html (también conocido como x/net/html) hasta el 2018-09-25 en Go gestiona de manera incorrecta , lo que conduce a un bucle infinito durante una llamada html.Parse. Esto se debe a que inSelectIM e inSelectInTableIM no cumplen con una especificación. • https://github.com/golang/go/issues/27842 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2018-17847
https://notcve.org/view.php?id=CVE-2018-17847
01 Oct 2018 — The html package (aka x/net/html) through 2018-09-25 in Go mishandles
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 1CVE-2018-17848
https://notcve.org/view.php?id=CVE-2018-17848
01 Oct 2018 — The html package (aka x/net/html) through 2018-09-25 in Go mishandles
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2018-17142
https://notcve.org/view.php?id=CVE-2018-17142
17 Sep 2018 — The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call. El paquete html (también conocido como x/net/html) hasta el 2018-09-17 en Go gestiona de manera incorrecta , lo que conduce a un "panic: runtime error" en parseCurrentToken en parse.go durante una llamada html.Parse. • https://github.com/golang/go/issues/27702 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2018-17143
https://notcve.org/view.php?id=CVE-2018-17143
17 Sep 2018 — The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call. El paquete html (también conocido como x/net/html) hasta el 2018-09-17 en Go gestiona de manera incorrecta /action=0>, lo que conduce a un "panic: runtime error" en inBodyIM en parse.go durante una llamada html.Parse. • https://github.com/golang/go/issues/27704 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 2CVE-2018-17075
https://notcve.org/view.php?id=CVE-2018-17075
16 Sep 2018 — The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of
CVSS: 9.3EPSS: 18%CPEs: 4EXPL: 1CVE-2018-7187 – Debian Security Advisory 4379-1
https://notcve.org/view.php?id=CVE-2018-7187
16 Feb 2018 — The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site. La implementación "go get" en Go 1.9.4, cuando se emplea la opción -insecure command-line, no valida la ruta de importación (get/vcs.go solo busca "://" en cualquier lugar de la cadena), lo que permite que atacantes remotos ejecuten comandos a... • https://gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 28%CPEs: 13EXPL: 83CVE-2018-6574 – golang: arbitrary code execution during "go get" via C compiler options
https://notcve.org/view.php?id=CVE-2018-6574
07 Feb 2018 — Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked. Go, en versiones anteriores a la 1.8.7; Go en versiones 1.9.x anteriores a la 1.9.4 y los prelanzamientos de Go 1.10 anteriores a Go 1.10rc2 permiten la ejecución remota de comandos "go get" durante la construcción del código fuente aprovechando la caracter... • https://github.com/neargle/Go-Get-RCE-CVE-2018-6574-POC • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 2%CPEs: 16EXPL: 0CVE-2015-5739 – golang: HTTP request smuggling in net/http library
https://notcve.org/view.php?id=CVE-2015-5739
18 Oct 2017 — The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length." La biblioteca net/http en net/textproto/reader.go en Go en versiones anteriores a la 1.4.3 no analiza sintácticamente claves de cabecera HTTP correctamente, lo que permite que atacantes remotos lleven a cabo ataques de contrabando de... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 9.8EPSS: 2%CPEs: 16EXPL: 0CVE-2015-5740 – golang: HTTP request smuggling in net/http library
https://notcve.org/view.php?id=CVE-2015-5740
18 Oct 2017 — The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers. La biblioteca net/http en net/http/transfer.go en Go en versiones anteriores a la 1.4.3 no analiza sintácticamente cabeceras HTTP correctamente, lo que permite que atacantes remotos lleven a cabo ataques de contrabando de peticiones HTTP mediante una petición con dos cabeceras Content-lengt... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •