622 matches found
PT-2024-18908
Name of the Vulnerable Software and Affected Versions github.com/greenpau/caddy-security affected versions not specified Description The issue is related to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid ev...
PT-2024-18911 · Unknown · Caddy-Security
Name of the Vulnerable Software and Affected Versions: github.com/greenpau/caddy-security versions all Description: The issue is related to Cross-site Scripting XSS via the Referer header, caused by improper input sanitization. Although some characters are escaped to prevent XSS, the sanitization...
PT-2024-18913 · Unknown · Caddy-Security
Name of the Vulnerable Software and Affected Versions: github.com/greenpau/caddy-security versions all Description: The issue is related to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or...
Cross Site Scripting (XSS)
https://github.com/greenpau/caddy-security is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input sanitization when handling /admin or /settings/mfa/delete/ GET requests. An attacker can inject arbitrary JavaScript code into the users browser, resulting in XSS...
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
GHSA-XWMV-CX7P-FQFC caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
Cross site scripting
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The CVE-2023-52430 entry concerns the caddy-security plugin for Caddy (version 1.1.20). A reflected Cross-Site Scripting (XSS) vulnerability exists in GET requests where the URL payload begins with /admin or /settings/mfa/delete/. Root cause: insufficient input sanitization in handling those endp...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
caddy-security Security Vulnerabilities
caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security version 1.1.20, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability...
PT-2024-14586 · Caddy · Caddy +1
Name of the Vulnerable Software and Affected Versions: caddy-security plugin for Caddy version 1.1.20 Description: The issue allows reflected Cross-site Scripting XSS via a GET request to a URL that contains an XSS payload and begins with either a "/admin" or "/settings/mfa/delete/" substring. Th...
CVE-2023-49295 vulnerabilities
Vulnerabilities for packages: caddy, frp...
CVE-2023-49295 vulnerabilities
Vulnerabilities for packages: frp, caddy...
GHSA-PPXX-5M9H-6VXF vulnerabilities
Vulnerabilities for packages: frp, caddy...
GHSA-PPXX-5M9H-6VXF vulnerabilities
Vulnerabilities for packages: caddy, frp...
GO-2023-2394 Spoofed source IP address in github.com/shift72/caddy-geo-ip
The caddy-geo-ip aka GeoIP middleware for Caddy 2 allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism trustedproxy directive in reverseproxy or IP address range restrictions...