513 matches found
Medium: ecs-service-connect-agent
Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's defaul...
CRLF Injection
Overview Affected versions of this package are vulnerable to CRLF Injection due to header-related attributes: Header, HeaderCollection and Authorize, through the HttpHeaders.TryAddWithoutValidation method. An attacker can manipulate HTTP headers or perform HTTP request smuggling. Notes: 1 This is...
Sinatra 安全漏洞
Sinatra is a Sinatra open source DSL for quickly creating web applications in Ruby with minimal effort A security vulnerability exists in Sinatra. An attacker exploiting this vulnerability can trigger an open redirection attack by inserting an arbitrary address in the header...
Consul L7 Intentions Vulnerable To Headers Bypass
Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using Headers in L7 traffic intentions could bypass HTTP header based access rules. This vulnerability, identified as CVE-2024-10006, is fixed in Consul Community Edition 1.20.1 and Consul Enterprise 1.20.1,...
BIT-ENVOY-2024-7207
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to...
SUSE CVE-2024-45410
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modif...
CVE-2024-7207
Rejected reason: Duplicate of CVE-2024-45806...
CVE-2024-7207
CVE-2024-7207 is rejected as a duplicate and does not represent an active vulnerability entry.
PT-2024-38168 · Envoy · Envoy
Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: A flaw was found in Envoy, allowing modification or manipulation of headers from external clients when pass-through routes are used for the ingress gateway. This issue could enable a maliciou...
Envoy 安全漏洞
Envoy is an Enphase open source gateway program for connecting smart home devices. A security vulnerability exists in versions prior to Envoy 1.32.0 that stems from allowing an external client to manipulate the Envoy header, which can lead to unauthorized access or other malicious operations with...
puppet-foreman: An authentication bypass vulnerability exists in Foreman
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing...
PT-2024-26529 · Typecho · Typecho
Name of the Vulnerable Software and Affected Versions: Typecho version 1.3.0 Description: The issue allows attackers to falsify their IP addresses by specifying an arbitrary IP as the value of X-Forwarded-For or Client-Ip headers while performing HTTP requests. This is a Client IP Spoofing issue...
CVE-2024-40324
A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation...
CVE-2024-40324
A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation...
CVE-2024-40324
A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation...
E-Staff 安全漏洞
E-Staff is a reliable recruiting tool from the Russian company E-Staff for modern integrated solutions for recruiting in servers or in the cloud, with a wide range of integration features with any systems and services. A security vulnerability exists in E-Staff version 5.1. An attacker exploiting...
CVE-2024-40324
CVE-2024-40324: A CRLF injection vulnerability in E-Staff v5.1 allows CR/LF characters in input fields, enabling HTTP response splitting and header manipulation. Affected: E-Staff 5.1. Underlying issue: CRLF injection in input handling. Impact per sources is header-related and could influence res...
PT-2024-28806 · E-Staff · E-Staff
Name of the Vulnerable Software and Affected Versions: E-Staff version 5.1 Description: A CRLF injection issue allows attackers to insert Carriage Return CR and Line Feed LF characters into input fields, leading to HTTP response splitting and header manipulation. Recommendations: For E-Staff...
