174 matches found
CVE-2020-24713
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...
Cross site scripting
Cross Site Scripting XSS vulnerability in Gophish through 0.10.1 via a crafted landing page or email template...
Code injection
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content...
Cross site scripting
Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page...
Cross site scripting
Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...
Information disclosure
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...
Design/Logic Flaw
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack...
Server side request forgery (ssrf)
Gophish before 0.11.0 allows SSRF attacks...
CVE-2020-24707
Gophish (before 0.11.0) is affected by a CSV injection vulnerability: it allows creation of CSV sheets containing malicious content. The issue is documented across multiple sources, with remediation to upgrade to v0.11.0 (see references to v0.11.0 release).
CVE-2020-24707
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content...
CVE-2020-24713
Gophish versions up to 0.10.1 are affected by a cookie handling issue where the gophish cookie is not invalidated on logout. This is documented across multiple sources (NVD entry CVE-2020-24713 and Red Hat/CNVD variants) with CVSS details: CVSSv2 base score 5.0 (MEDIUM) and CVSSv3.1 base score 7....
CVE-2020-24713
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...
CVE-2020-24711
CVE-2020-24711 affects Gophish prior to 0.11.0. The Reset button on the Account Settings page can be exploited via clickjacking, causing a denial of service. Public details describe that an authenticated administrator could be tricked into clicking the Reset button, which may reset the API key an...
CVE-2020-24711
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack...
CVE-2020-24710
Gophish before 0.11.0 allows SSRF attacks...
CVE-2020-24710
Gophish (github.com/gophish/gophish) before version 0.11.0 is vulnerable to Server-Side Request Forgery (SSRF). The issue stems from improper validation of external resource requests, enabling crafted requests to internal services. Public references confirm the affected product and upgrade path: ...
CVE-2020-24712
Gophish before 0.11.0 contains a Cross Site Scripting (XSS) vulnerability exploitable via the IMAP Host field on the account settings page. The issue is documented across multiple feeds (NVD, Red Hat, CNVD, OSV, CVE listing) with consistent description: XSS in versions prior to 0.11.0. The known ...
CVE-2020-24712
Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page...