CVE-2024-21500

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this...

CVE-2024-21498

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...

CVE-2024-21498

CVE-2024-21498 : SSRF in the Go package github.com/greenpau/caddy-security across all versions, caused by manipulation of the X-Forwarded-Host header. Impact: attacker may access sensitive data or reach internal services. Remediation status: no concrete fix version is identified in the provided d...

CVE-2024-21492

All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers w...

CVE-2024-21492

CVE-2024-21492 affects github.com/greenpau/caddy-security. All versions are reported vulnerable to Insufficient Session Expiration due to improper user session invalidation after Sign Out, allowing sessions to remain active after requests to /logout and /oauth2/google/logout and enabling actions ...

CVE-2024-21496

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for th...

CVE-2024-21496

CVE-2024-21496 affects all versions of the Go package github.com/greenpau/caddy-security. The vulnerability is a Cross-site Scripting (XSS) flaw via the Referer header caused by incomplete input sanitization. While some characters (e.g., &, , ", ') are escaped, the check does not cover attacks us...

caddy-security Security Vulnerabilities

caddy-security is a security application and plugin for Caddy. A security vulnerability exists in versions prior to caddy-security 1.0.42 that stems from the use of an insecure random number generation library that is susceptible to insecure randomness...

caddy-security Security Vulnerabilities

caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security that stems from vulnerability to HTTP header injection attacks via the X-Forwarded-Proto header...

caddy-security Security Vulnerabilities

caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security that stems from incorrect user session expiration and vulnerability to insufficient session expiration...

caddy-security Security Vulnerabilities

caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security that stems from vulnerability to improper array index validation...

caddy-security Security Vulnerabilities

caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security that stems from improper input cleanup and is susceptible to cross-site scripting XSS attacks via the Referer header...

PT-2024-18908

Name of the Vulnerable Software and Affected Versions github.com/greenpau/caddy-security affected versions not specified Description The issue is related to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid ev...

PT-2024-18913 · Unknown · Caddy-Security

Name of the Vulnerable Software and Affected Versions: github.com/greenpau/caddy-security versions all Description: The issue is related to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or...

PT-2024-18911 · Unknown · Caddy-Security

Name of the Vulnerable Software and Affected Versions: github.com/greenpau/caddy-security versions all Description: The issue is related to Cross-site Scripting XSS via the Referer header, caused by improper input sanitization. Although some characters are escaped to prevent XSS, the sanitization...

Cross Site Scripting (XSS)

https://github.com/greenpau/caddy-security is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input sanitization when handling /admin or /settings/mfa/delete/ GET requests. An attacker can inject arbitrary JavaScript code into the users browser, resulting in XSS...

caddy-security Security Vulnerabilities

caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security version 1.1.20, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability...

CVE-2023-52430

The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...

Cross-site Scripting (XSS)

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that...

Insufficient Session Expiration

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests...