CVE-2020-24713

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...

CVE-2020-24707

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content...

CVE-2020-24709

Cross Site Scripting XSS vulnerability in Gophish through 0.10.1 via a crafted landing page or email template...

CVE-2020-24711

The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack...

CVE-2020-24713

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...

CVE-2020-24710

Gophish before 0.11.0 allows SSRF attacks...

CVE-2020-24709

Cross Site Scripting XSS vulnerability in Gophish through 0.10.1 via a crafted landing page or email template...

Code injection

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content...

Information disclosure

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...

Cross site scripting

Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page...

Cross site scripting

Cross Site Scripting XSS vulnerability in Gophish through 0.10.1 via a crafted landing page or email template...

Cross site scripting

Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...

Server side request forgery (ssrf)

Gophish before 0.11.0 allows SSRF attacks...

Design/Logic Flaw

The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack...

CVE-2020-24707

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content...

CVE-2020-24707

Gophish (before 0.11.0) is affected by a CSV injection vulnerability: it allows creation of CSV sheets containing malicious content. The issue is documented across multiple sources, with remediation to upgrade to v0.11.0 (see references to v0.11.0 release).

CVE-2020-24713

Gophish versions up to 0.10.1 are affected by a cookie handling issue where the gophish cookie is not invalidated on logout. This is documented across multiple sources (NVD entry CVE-2020-24713 and Red Hat/CNVD variants) with CVSS details: CVSSv2 base score 5.0 (MEDIUM) and CVSSv3.1 base score 7....

CVE-2020-24713

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...

CVE-2020-24711

The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack...

CVE-2020-24711

CVE-2020-24711 affects Gophish prior to 0.11.0. The Reset button on the Account Settings page can be exploited via clickjacking, causing a denial of service. Public details describe that an authenticated administrator could be tricked into clicking the Reset button, which may reset the API key an...