CVE-2024-27289 vulnerabilities

Vulnerabilities for packages: step, trillian, step-ca, caddy, argo-workflows, kots...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step, ferretdb, kube-bench, src, trillian, kine, spicedb, step-ca, temporal-server, caddy, argo-workflows, k3s, amass, kots...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: k3s, kots, kine, argo-workflows, argo-workflows-fips, ferretdb, step-ca, kube-bench, trillian, amass, step, falcosidekick-fips, trillian-fips, temporal-server-fips, src, wavefront-collector-for-kubernetes, temporal-server, spicedb, kube-bench-fips, caddy, caddy-fips...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: k3s, kots, kine, argo-workflows, argo-workflows-fips, ferretdb, step-ca, kube-bench, trillian, amass, step, falcosidekick-fips, trillian-fips, temporal-server-fips, src, wavefront-collector-for-kubernetes, temporal-server, spicedb, kube-bench-fips, caddy, caddy-fips...

GHSA-M7WR-2XF7-CM9P vulnerabilities

Vulnerabilities for packages: step, trillian-fips, argo-workflows, argo-workflows-fips, step-ca, kots, caddy, wavefront-collector-for-kubernetes, trillian, caddy-fips...

openSUSE: Security Advisory for caddy (openSUSE-SU-2022:10080-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for caddy (openSUSE-SU-2022:10007-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-22b915e51a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Restriction Of Excessive Authentication Attempts

github.com/greenpau/caddy-security is vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. The vulnerability is due to improper 2FA timeout functionality, allowing an attackers to bypass this blocking mechanism by automating the...

HTTP Header Injection

github.com/greenpau/caddy-security is vulnerable to HTTP Header Injection. The vulnerability is due the handling of the X-Forwarded-Proto header, specifically when redirecting to the injected protocol. Exploiting this vulnerability could lead to the bypass of security mechanisms or TLS protocol...

Cross-site Scripting (XSS)

github.com/greenpau/caddy-security is vulnerable to Cross-site Scripting XSS via the Referer header. The vulnerability is due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for an attack...

Open Redirection

github.com/greenpau/caddy-security is vulnerable to Open Redirect. The vulnerability is caused when a user clicks on a specially crafted link with a redirecturl parameter while logged in, resulting in the user being redirected to an arbitrary site. The user must take an action, such as clicking o...

[SECURITY] Fedora 39 Update: caddy-2.7.6-1.fc39

Caddy is an extensible server platform that uses TLS by default...

Fedora 39 : caddy (2024-22b915e51a)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-22b915e51a advisory. Update to the latest upstream version, which includes a fix for CVE-2023-45142. https://github.com/caddyserver/caddy/releases/tag/v2.7.6 Tenable has extracte...

Server-Side Request Forgery in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...

Open Redirect in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirecturl parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this...

Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. Although the application blocks the user after several failed attempts to provide 2FA codes, attackers can bypass this...

GHSA-93X8-66J2-WWR5 Server-Side Request Forgery in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by...

GHSA-R969-783F-6JQR Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS...

GHSA-VP66-GF7W-9M4X Insufficient Session Expiration in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to /logout and /oauth2/google/logout. Attackers w...