755 matches found
caddy-security Security Vulnerabilities
caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security that stems from improper input cleanup and is susceptible to cross-site scripting XSS attacks via the Referer header...
caddy-security Security Vulnerabilities
caddy-security is a security application and plugin for Caddy. A security vulnerability exists in versions prior to caddy-security 1.0.42 that stems from the use of an insecure random number generation library that is susceptible to insecure randomness...
caddy-security Security Vulnerabilities
caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security that stems from vulnerability to HTTP header injection attacks via the X-Forwarded-Proto header...
PT-2024-18908
Name of the Vulnerable Software and Affected Versions github.com/greenpau/caddy-security affected versions not specified Description The issue is related to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid ev...
PT-2024-18913 · Unknown · Caddy-Security
Name of the Vulnerable Software and Affected Versions: github.com/greenpau/caddy-security versions all Description: The issue is related to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or...
PT-2024-18911 · Unknown · Caddy-Security
Name of the Vulnerable Software and Affected Versions: github.com/greenpau/caddy-security versions all Description: The issue is related to Cross-site Scripting XSS via the Referer header, caused by improper input sanitization. Although some characters are escaped to prevent XSS, the sanitization...
Cross Site Scripting (XSS)
https://github.com/greenpau/caddy-security is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input sanitization when handling /admin or /settings/mfa/delete/ GET requests. An attacker can inject arbitrary JavaScript code into the users browser, resulting in XSS...
caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
GHSA-XWMV-CX7P-FQFC caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
Cross site scripting
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The CVE-2023-52430 entry concerns the caddy-security plugin for Caddy (version 1.1.20). A reflected Cross-Site Scripting (XSS) vulnerability exists in GET requests where the URL payload begins with /admin or /settings/mfa/delete/. Root cause: insufficient input sanitization in handling those endp...
CVE-2023-52430: Improper Neutralization of Input During Web Page Generation
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
CVE-2023-52430
The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring...
caddy-security Security Vulnerabilities
caddy-security is a security application and plugin for Caddy. A security vulnerability exists in caddy-security version 1.1.20, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability...
PT-2024-14586 · Caddy · Caddy +1
Name of the Vulnerable Software and Affected Versions: caddy-security plugin for Caddy version 1.1.20 Description: The issue allows reflected Cross-site Scripting XSS via a GET request to a URL that contains an XSS payload and begins with either a "/admin" or "/settings/mfa/delete/" substring. Th...
