https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:53:40 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2020-29509 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2020-29509 https://cve.radiocsirt.org/vuln/bit-golang-2020-29509 <p><strong>Affected:</strong> Bitnami: golang</p> <p>The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.</p> <p><strong>Affected:</strong> Bitnami: golang</p> <p>The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.</p> https://cve.radiocsirt.org/vuln/bit-golang-2020-29509 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0969 https://cve.radiocsirt.org/vuln/euvd-2026-184423 EUVD-2026-184423 https://cve.radiocsirt.org/vuln/euvd-2026-184423 https://cve.radiocsirt.org/vuln/fkie_cve-2020-29509 <p>The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.</p> <p>The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-29509 https://cve.radiocsirt.org/vuln/ghsa-xhqq-x44f-9fgg <p><strong>Affected:</strong> Go: github.com/russellhaering/gosaml2</p> <p>### Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed.</p> <p>Depending on the implementation of the Service Provider this enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the Identity Provider, or full authentication bypass.</p> <p>### Patches Service Providers utilizing gosaml2 should upgrade to v0.6.0 or greater.</p> <p><strong>Affected:</strong> Go: github.com/russellhaering/gosaml2</p> <p>### Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed.</p> <p>Depending on the implementation of the Service Provider this enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the Identity Provider, or full authentication bypass.</p> <p>### Patches Service Providers utilizing gosaml2 should upgrade to v0.6.0 or greater.</p> https://cve.radiocsirt.org/vuln/ghsa-xhqq-x44f-9fgg https://cve.radiocsirt.org/vuln/gsd-2020-29509 gsd-2020-29509 https://cve.radiocsirt.org/vuln/gsd-2020-29509 https://cve.radiocsirt.org/vuln/msrc_cve-2020-29509 msrc_CVE-2020-29509 https://cve.radiocsirt.org/vuln/msrc_cve-2020-29509 https://cve.radiocsirt.org/vuln/oesa-2021-1011 <p><strong>Affected:</strong> openEuler:20.03-LTS: golang, openEuler:20.03-LTS-SP1: golang</p> <p>The Go Programming Language.\r\n\r\n Security Fix(es):\r\n\r\n The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.(CVE-2020-29509)\r\n\r\n</p> <p><strong>Affected:</strong> openEuler:20.03-LTS: golang, openEuler:20.03-LTS-SP1: golang</p> <p>The Go Programming Language.\r\n\r\n Security Fix(es):\r\n\r\n The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.(CVE-2020-29509)\r\n\r\n</p> https://cve.radiocsirt.org/vuln/oesa-2021-1011 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-29509 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:18.04:LTS: golang-1.9, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14 and 1 more</p> <p>The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.10, Ubuntu:Pro:18.04:LTS: golang-1.13, Ubuntu:18.04:LTS: golang-1.8, Ubuntu:18.04:LTS: golang-1.9, Ubuntu:20.04:LTS: golang-1.13, Ubuntu:20.04:LTS: golang-1.14 and 1 more</p> <p>The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-29509 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0794 <p>Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0794