golang-github-labstack-echo.v3 vulnerabilities (Ubuntu)
18 vulnerabilities.
-
golang-github-labstack-echo.v3Ubuntu Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto 4.7 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers 5.9 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI 6.1 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: Static Middleware Double-Unescape Path Traversal 5.9 Medium -
golang-github-labstack-echo.v3Ubuntu Echo static file middleware route protection bypass via encoded dot-dot traversal 5.9 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration 5.3 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob 6.1 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default 5.3 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path 7.5 High -
golang-github-labstack-echo.v3Ubuntu Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method 5.3 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: X-Real-IP extractor trusts the header value instead of the sending peer 5.3 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: WebSocket proxy can retain connections and handlers after client disconnect 8.2 High -
golang-github-labstack-echo.v3Ubuntu Echo: Decompress permits unbounded gzip expansion in v4 8.2 High -
golang-github-labstack-echo.v3Ubuntu Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls 9.1 Critical -
golang-github-labstack-echo.v3Ubuntu Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests 6.3 Medium -
golang-github-labstack-echo.v3Ubuntu Echo: BodyDump captures request and response bodies without size limits in v4 8.2 High -
golang-github-labstack-echo.v3Ubuntu Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files 7.5 High -
golang-github-labstack-echo.v3Ubuntu Labstack Echo Open Redirect vulnerability 9.6 Critical