SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:0800-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0800-1 advisory. - Upgrade go to version 1.21.8 - CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookie...

SUSE CVE-2023-45289

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

CVE-2023-45289

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

AZL-98628 CVE-2023-45289 affecting package golang 1.27.1-1

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

AZL-37473 CVE-2023-45289 affecting package golang for versions less than 1.21.6-1

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

AZL-37462 CVE-2023-45289 affecting package golang for versions less than 1.21.6-1

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

UBUNTU-CVE-2023-45289

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer. Go Vulnerability Report: When following an HTTP redirect to a domain which is not a subdomain match or exac...

PT-2024-2133

Name of the Vulnerable Software and Affected Versions golang versions affected versions not specified http.Client affected versions not specified Description The issue is related to how an http.Client handles HTTP redirects. When an HTTP redirect is made to a domain that is not a subdomain match ...

Authorization Header Leakage

scrapy is vulnerable to Authorization Header Leakage. The vulnerability is due to improper handling of the Authorization header when the response includes a redirection. The Authorization header is not ommited when Scrapy is redirected, resulting in the Authorization header being sent to the...

undici Information Disclosure Vulnerability

undici is an HTTP/1.1 client. An information disclosure vulnerability exists in undici v5.28.2 and earlier, and versions 6.0.0 through 6.6.0, which stems from an information disclosure vulnerability due to failure to clear the Proxy-Authorization header...

GHSA-CW9J-Q3VF-HRRV Scrapy authorization header leakage on cross-domain redirect

Impact When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain...

Scrapy authorization header leakage on cross-domain redirect

Impact When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain...

D-Link DCS-8300LHV2 RTSP ValidateAuthorizationHeader Username Stack-Based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Authorization header by the RTSP server,...

PT-2024-1092 · D Link · D-Link Dcs-8300Lhv2

Name of the Vulnerable Software and Affected Versions: D-Link DCS-8300LHV2 affected versions not specified Description: The issue is related to a buffer overflow in the RTSP server of D-Link DCS-8300LHV2 IP cameras, allowing remote attackers to execute arbitrary code on affected installations. Th...

CVE-2023-50248

CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-craft...

Apache CouchDB Information Disclosure Vulnerability

Apache CouchDB is a document-oriented database system developed by the Apache Foundation using Erlang. An information disclosure vulnerability exists in Apache CouchDB 3.3.2 and earlier, and IBM Cloudan 8413 and earlier, which stems from a Design document function that receives the object of a...

CVE-2023-49091

CVE-2023-49091 affects Cosmos-server. The vulnerability arises because the authorization header token used for user login remains valid after logout, allowing an attacker to access the application/system even after the user has logged out. Impact is described as high/critical in multiple sources,...

CVE-2023-49091 Jwttoken in Cosmos server never expires after password changed and logging out

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an...

Network Optix NxCloud Security Breach

Network Optix NxCloud is an application from Network Optix, Inc. used to provide high performance capabilities for design and manufacturing. A security vulnerability exists in Network Optix NxCloud versions prior to 23.1.0.40440 that stems from the ability to add a fake VMS server to NxCloud by...