CVE-2020-15216

In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revision f6188febf0c29d7ffe26a0436212b19cb9615e64 or version 1.1.0

• CWE-347
• CWE-347

• https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64Patch, Third Party Advisory
• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUH33FPUXED3FHYL25BJOQPRKFGPOMS2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZECBFD4M4PHBMBOCMSQ537NOU37QOVWP/
• https://pkg.go.dev/github.com/russellhaering/goxmldsig?tab=overviewThird Party Advisory
• https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64Patch, Third Party Advisory
• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUH33FPUXED3FHYL25BJOQPRKFGPOMS2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZECBFD4M4PHBMBOCMSQ537NOU37QOVWP/
• https://pkg.go.dev/github.com/russellhaering/goxmldsig?tab=overviewThird Party Advisory

Published

Sep 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15210In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2…6.5
• CVE-2020-15211In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2…4.8
• CVE-2020-15212In TensorFlow Lite before versions 2.2.1 and 2.3.1, models u…8.6
• CVE-2020-15213In TensorFlow Lite before versions 2.2.1 and 2.3.1, models u…4
• CVE-2020-15214In TensorFlow Lite before versions 2.2.1 and 2.3.1, models u…8.1
• CVE-2020-15215Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5…5.6
• CVE-2020-15217In GLPI before version 9.5.2, there is a leakage of user inf…5.3
• CVE-2020-15218Combodo iTop is a web based IT Service Management tool. In i…6.8
• CVE-2020-15219Combodo iTop is a web based IT Service Management tool. In i…4.3
• CVE-2020-1522An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15220Combodo iTop is a web based IT Service Management tool. In i…6.1
• CVE-2020-15221Combodo iTop is a web based IT Service Management tool. In i…5.4