Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Greenpau Component: Caddy-security Clear all filters
TI-2024-14252 CVE-2024-21495 · GHSA-c7vf-m394-m4x4

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable…

Priority HIGH 81

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0068 Published 2024-02-17 Fixed in 1.0.42 CWE-330
TI-2024-14251 CVE-2024-21494 · GHSA-vj36-3ccr-6563

Authentication bypass by spoofing in github.com/greenpau/caddy-security

Priority MEDIUM 58

All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00519 Published 2024-02-17 No fix listed CWE-290
TI-2024-14256 CVE-2024-21499 · GHSA-r969-783f-6jqr

Improper output encoding in github.com/greenpau/caddy-security

Priority LOW 21

All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00495 Published 2024-02-17 No fix listed CWE-644
TI-2024-14254 CVE-2024-21497 · GHSA-8hp3-rmr7-xh88

Open redirect in github.com/greenpau/caddy-security

Priority LOW 28

Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00499 Published 2024-02-17 No fix listed CWE-601