251 matches found
CVE-2020-24709
The CVE-2020-24709 entry concerns Gophish
CVE-2020-24708
Gophish is affected by a Cross-Site Scripting (XSS) vulnerability (CVE-2020-24708) in versions prior to 0.11.0, exploitable via the Host field on the send profile form. Root cause: improper handling of input in the Host field leading to script injection. Impact: potential script execution in the ...
CVE-2020-24708
Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...
CVE-2020-24708
Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...
PT-2020-15821 · Gophish · Gophish
Name of the Vulnerable Software and Affected Versions: Gophish versions prior to 0.11.0 Description: The issue allows for Server-Side Request Forgery SSRF attacks. This means an attacker can potentially force the server to make unauthorized requests, leading to various security issues...
PT-2020-15823
Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.11.0 Description The issue is related to a Cross Site Scripting XSS vulnerability. It occurs via the IMAP Host field on the account settings page. Recommendations For versions prior to 0.11.0, update to version 0.11...
CVE-2020-24707: Improper Neutralization of Formula Elements in a CSV File
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content...
CVE-2020-24710: Server-Side Request Forgery (SSRF)
Gophish before 0.11.0 allows SSRF attacks...
CVE-2020-24712: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page...
CVE-2020-24709: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in Gophish through 0.10.1 via a crafted landing page or email template...
CVE-2020-24708: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in Gophish before 0.11.0 via the Host field on the send profile form...
PT-2020-15820
Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.10.2 Description A Cross Site Scripting XSS issue exists, allowing for the execution of malicious scripts via a crafted landing page or email template. Recommendations For versions prior to 0.10.2, update to version...
PT-2020-15819
Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.11.0 Description The issue is related to a Cross Site Scripting XSS vulnerability. It occurs via the Host field on the send profile form. Recommendations For versions prior to 0.11.0, update to version 0.11.0 or lat...
PT-2020-15824
Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.10.2 Description The issue arises because Gophish does not invalidate the gophish cookie when a user logs out. This could potentially allow unauthorized access. Recommendations For versions prior to 0.10.2, update t...
PT-2020-15822
Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.11.0 Description The issue allows attackers to cause a denial of service via a clickjacking attack, specifically targeting the Reset button on the Account Settings page. Recommendations For versions prior to 0.11.0,...
PT-2020-15818
Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.11.0 Description The issue allows the creation of CSV sheets that contain malicious content. Recommendations For versions prior to 0.11.0, update to version 0.11.0 or later to resolve the issue...
CVE-2020-24713: Insufficient Session Expiration
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout...
CVE-2020-24711: Improper Restriction of Rendered UI Layers or Frames
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack...
Cross-Site Scripting (XSS)
github.com/gophish/gophish is vulnerable to cross-site scripting XSS. The attack is possible because there are many unsanitized user.username values in users.js, allowing an attacker to inject malicious script via those parameters in User Management Page...
