CVE-2024-27289 vulnerabilities

Vulnerabilities for packages: step, trillian, step-ca, caddy, argo-workflows, kots...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step, ferretdb, kube-bench, src, trillian, kine, spicedb, step-ca, temporal-server, caddy, argo-workflows, k3s, amass, kots...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: temporal-server-fips, trillian-fips, caddy, amass, src, ferretdb, temporal-server, kine, wavefront-collector-for-kubernetes, caddy-fips, trillian, step, kube-bench-fips, argo-workflows-fips, k3s, spicedb, kube-bench, kots, argo-workflows, falcosidekick-fips, step-ca...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: temporal-server-fips, trillian-fips, caddy, amass, src, ferretdb, temporal-server, kine, wavefront-collector-for-kubernetes, caddy-fips, trillian, step, kube-bench-fips, argo-workflows-fips, k3s, spicedb, kube-bench, kots, argo-workflows, falcosidekick-fips, step-ca...

GHSA-M7WR-2XF7-CM9P vulnerabilities

Vulnerabilities for packages: trillian, step, trillian-fips, kots, argo-workflows, caddy, argo-workflows-fips, wavefront-collector-for-kubernetes, step-ca, caddy-fips...

openSUSE: Security Advisory for caddy (openSUSE-SU-2022:10080-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for caddy (openSUSE-SU-2022:10007-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-22b915e51a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Restriction Of Excessive Authentication Attempts

github.com/greenpau/caddy-security is vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. The vulnerability is due to improper 2FA timeout functionality, allowing an attackers to bypass this blocking mechanism by automating the...

HTTP Header Injection

github.com/greenpau/caddy-security is vulnerable to HTTP Header Injection. The vulnerability is due the handling of the X-Forwarded-Proto header, specifically when redirecting to the injected protocol. Exploiting this vulnerability could lead to the bypass of security mechanisms or TLS protocol...

Cross-site Scripting (XSS)

github.com/greenpau/caddy-security is vulnerable to Cross-site Scripting XSS via the Referer header. The vulnerability is due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for an attack...

Open Redirection

github.com/greenpau/caddy-security is vulnerable to Open Redirect. The vulnerability is caused when a user clicks on a specially crafted link with a redirecturl parameter while logged in, resulting in the user being redirected to an arbitrary site. The user must take an action, such as clicking o...

[SECURITY] Fedora 39 Update: caddy-2.7.6-1.fc39

Caddy is an extensible server platform that uses TLS by default...

Fedora 39 : caddy (2024-22b915e51a)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-22b915e51a advisory. Update to the latest upstream version, which includes a fix for CVE-2023-45142. https://github.com/caddyserver/caddy/releases/tag/v2.7.6 Tenable has extracte...

Open Redirect in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirecturl parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this...

Server-Side Request Forgery in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...

GHSA-93X8-66J2-WWR5 Server-Side Request Forgery in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...

GHSA-R969-783F-6JQR Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS...

Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this...

GHSA-VP66-GF7W-9M4X Insufficient Session Expiration in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers w...