367 matches found
PT-2026-83121
Name of the Vulnerable Software and Affected Versions CP Plus CP-XR-DE21-S affected versions not specified Description The CP Plus CP-XR-DE21-S Router contains hardcoded HTTP Digest authentication credentials within its firmware. These credentials are identical across all devices running the...
curl: Unbound cross-peer HTTP Digest challenge state
Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...
http4k: `DigestAuthProvider.verify` did not bind to request URI
Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...
CVE-2026-10050
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...
UBUNTU-CVE-2026-10050
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...
CVE-2026-10050 Digest authentication lossy encoding
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons. If the password contains...
CLSA-2026-1783705168 curl: Fix of CVE-2026-11856
CVE-2026-11856: flush cached HTTP Digest auth state when the origin or credentials change on the same easy handle so a challenge computed for one origin or set of credentials is not reused for another...
CVE-2014-6061
When an application uses an HTTP basic or digest authentication, Symfony does not parse the "Authorization" header properly, which could be exploited in some server setups no exploits have been demonstrated though...
MiracleLinux 8 : squid:4 (AXSA:2024-7336:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7336:01 advisory. squid: Denial of Service in HTTP Digest Authentication CVE-2023-46847 squid: Request/Response smuggling in HTTP/1.1 and ICAP CVE-2023-46846 Tenable...
MiracleLinux 9 : squid-5.5-5.el9.1 (AXSA:2023-6560:03)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6560:03 advisory. SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication CVE-2023-46847 SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and IC...
EUVD-2020-7675
Malware in sbrugna...
EUVD-2010-0581
Malware in sbrugna...
EUVD-2022-1939
Malicious code in bioql PyPI...
EUVD-2022-4133
Malicious code in bioql PyPI...
EUVD-2022-3341
Malicious code in bioql PyPI...
EUVD-2021-28629
Malicious code in bioql PyPI...
EUVD-2022-4937
Malicious code in bioql PyPI...
com.identityx.auth:daon-http-digest-auth (>=4.4.0.10, <=5.0.0.2), com.identityx:identityxclientsdk (>=4.4.0.10, <=5.0.0.2) +21 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (5.14)
com.nimbusds:nimbus-jose-jwt MAVEN version 5.14 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.identityx.auth:daon-http-digest-auth =4.4.0.10, =4.4.0.10, =2.1.0, =2.3.0, =2.2.0, =2.2.0, =2.1.0,...
CVE-2024-4772
An HTTP digest authentication nonce value was generated using rand which could lead to predictable values. This vulnerability affects Firefox 126...
CVE-2021-41615
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 or RFC 2617 section 3.2.1. NOTE:...