github.com/xuri/excelize/v2 vulnerabilities (Go)
18 vulnerabilities.
-
github.com/xuri/excelize/v2Go Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml 6.5 Medium -
github.com/xuri/excelize/v2Go Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader 6.5 Medium -
github.com/xuri/excelize/v2Go Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process 7.1 High -
github.com/xuri/excelize/v2Go Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check 6.5 Medium -
github.com/xuri/excelize/v2Go Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API 6.5 Medium -
github.com/xuri/excelize/v2Go Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref 6.5 Medium -
github.com/xuri/excelize/v2Go Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile 7.5 High -
github.com/xuri/excelize/v2Go Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics 5.3 Medium -
github.com/xuri/excelize/v2Go Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows 7.5 High -
github.com/xuri/excelize/v2Go Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow 7.5 High -
github.com/xuri/excelize/v2Go Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS 7.5 High -
github.com/xuri/excelize/v2Go Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks 7.5 High -
github.com/xuri/excelize/v2Go Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element 8.7 High -
github.com/xuri/excelize/v2Go Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days 7.5 High -
github.com/xuri/excelize/v2Go Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic 8.7 High -
github.com/xuri/excelize/v2Go Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) 7.5 High -
github.com/xuri/excelize/v2Go Excelize: Negative shared-string index causes panic in GetCellValue and GetRows 6.9 Medium -
github.com/xuri/excelize/v2Go Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation 8.7 High