622 matches found
Cross-site Scripting (XSS)
Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that...
Improper Restriction of Excessive Authentication Attempts
Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. Although the application blocks the user after several failed...
Insecure Randomness
Amendment This was deemed not a vulnerability. Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted...
[SECURITY] Fedora 37 Update: caddy-2.6.4-1.fc37
Caddy is the web server with automatic HTTPS...
[SECURITY] Fedora 38 Update: caddy-2.6.4-1.fc38
Caddy is the web server with automatic HTTPS...
Fedora 38 : caddy (2023-74e5545901)
The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-74e5545901 advisory. This update takes caddy from 2.5.2 to 2.6.4. The primary purpose is to resolve a long standing FTBFS related to golang 1.20. The current F38 package is...
Fedora: Security Advisory for caddy (FEDORA-2023-74e5545901)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory for caddy (FEDORA-2023-4926525509)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory for caddy (FEDORA-2023-a258bed79b)
The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 36 Update: caddy-2.4.6-6.fc36
Caddy is the web server with automatic HTTPS...
Fedora 36 : caddy (2023-a258bed79b)
The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a258bed79b advisory. Backport of upstream fix for CVE-2022-29718. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Ness...
GO-2023-1567 Open redirect in github.com/caddyserver/caddy/v2
Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks...
SUSE CVE-2022-28923
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...
SUSE CVE-2022-29718
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...
SUSE CVE-2022-34037
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...
CVE-2022-28923
An open redirect flaw was found in caddy. This issue may allow a malicious user to craft a link that redirects to any url they choose...
GHSA-QPM3-VR34-H8W8 Open Redirect in Caddy
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...
Open Redirect in Caddy
Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...
