github.com/labstack/echo/v5 vulnerabilities (Go)
16 vulnerabilities.
-
github.com/labstack/echo/v5Go Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto 4.7 Medium -
github.com/labstack/echo/v5Go Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers 5.9 Medium -
github.com/labstack/echo/v5Go Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI 6.1 Medium -
github.com/labstack/echo/v5Go Echo: Static Middleware Double-Unescape Path Traversal 5.9 Medium -
github.com/labstack/echo/v5Go Echo static file middleware route protection bypass via encoded dot-dot traversal 5.9 Medium -
github.com/labstack/echo/v5Go Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration 5.3 Medium -
github.com/labstack/echo/v5Go Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob 6.1 Medium -
github.com/labstack/echo/v5Go Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default 5.3 Medium -
github.com/labstack/echo/v5Go Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path 7.5 High -
github.com/labstack/echo/v5Go Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method 5.3 Medium -
github.com/labstack/echo/v5Go Echo: X-Real-IP extractor trusts the header value instead of the sending peer 5.3 Medium -
github.com/labstack/echo/v5Go Echo: WebSocket proxy can retain connections and handlers after client disconnect 8.2 High -
github.com/labstack/echo/v5Go Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls 9.1 Critical -
github.com/labstack/echo/v5Go Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests 6.3 Medium -
github.com/labstack/echo/v5Go Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files 7.5 High -
github.com/labstack/echo/v5Go Echo has a Windows path traversal via backslash in middleware.Static default filesystem 5.3 Medium