Search CVE reports
11 – 20 of 44181 results
go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the...
1 affected package
golang-github-go-chi-chi
| Package | 26.04 LTS |
|---|---|
| golang-github-go-chi-chi | Needs evaluation |
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 26.04 LTS |
|---|---|
| golang-github-labstack-echo | Needs evaluation |
| golang-github-labstack-echo.v2 | Not in release |
| golang-github-labstack-echo.v3 | Not in release |