Search CVE reports
1 – 10 of 53375 results
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write...
1 affected package
gopass
| Package | 20.04 LTS |
|---|---|
| gopass | Needs evaluation |
FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose...
1 affected package
freeimage
| Package | 20.04 LTS |
|---|---|
| freeimage | Needs evaluation |
FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs...
1 affected package
freeimage
| Package | 20.04 LTS |
|---|---|
| freeimage | Needs evaluation |
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a]('...
1 affected package
python-markdown2
| Package | 20.04 LTS |
|---|---|
| python-markdown2 | Needs evaluation |
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 20.04 LTS |
|---|---|
| golang-github-labstack-echo | — |
| golang-github-labstack-echo.v2 | Needs evaluation |
| golang-github-labstack-echo.v3 | Needs evaluation |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 20.04 LTS |
|---|---|
| golang-github-labstack-echo | — |
| golang-github-labstack-echo.v2 | Needs evaluation |
| golang-github-labstack-echo.v3 | Needs evaluation |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 20.04 LTS |
|---|---|
| golang-github-labstack-echo | — |
| golang-github-labstack-echo.v2 | Needs evaluation |
| golang-github-labstack-echo.v3 | Needs evaluation |
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 20.04 LTS |
|---|---|
| golang-github-labstack-echo | — |
| golang-github-labstack-echo.v2 | Needs evaluation |
| golang-github-labstack-echo.v3 | Needs evaluation |
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 20.04 LTS |
|---|---|
| golang-github-labstack-echo | — |
| golang-github-labstack-echo.v2 | Needs evaluation |
| golang-github-labstack-echo.v3 | Needs evaluation |
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client...
3 affected packages
golang-github-labstack-echo, golang-github-labstack-echo.v2, golang-github-labstack-echo.v3
| Package | 20.04 LTS |
|---|---|
| golang-github-labstack-echo | — |
| golang-github-labstack-echo.v2 | Needs evaluation |
| golang-github-labstack-echo.v3 | Needs evaluation |