PT-2022-5377

Name of the Vulnerable Software and Affected Versions curl versions 7.77.0 through 7.85.0 Description The issue is related to a double free in curl when using an HTTP proxy for a transfer with a non-HTTPS URL. If curl is told to use an HTTP proxy, it sets up the connection by issuing a CONNECT...

curl -- multiple vulnerabilities

Daniel Stenberg reports: CVE-2022-32221: POST following PUT confusion When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT...

curl: CVE-2022-42915: HTTP proxy double-free

This is a finding that Trail of Bits found in their ongoing curl security audit. Reported at a status meeting today. Summary: curl frees memory twice in some cleanup function related to HTTP proxies. It as simple as curl -x http://localhost:80 dict://127.0.0.1 Using valgrind on the current git...

PT-2022-37296

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack buffer overflow, which occurs during the ntlm phase 3 and establish http proxy passthru functions in the fuzz proxy.c file...

openvpn:fuzz_proxy: Stack-buffer-overflow in ntlm_phase_3

Detailed Report: https://oss-fuzz.com/testcase?key=4992598211690496 Project: openvpn Fuzzing Engine: honggfuzz Fuzz Target: fuzzproxy Job Type: honggfuzzasanopenvpn Platform Id: linux Crash Type: Stack-buffer-overflow WRITE 1 Crash Address: 0x7ffdcacfc3e0 Crash State: ntlmphase3...

Exploit for Argument Injection in Atlassian Bitbucket

CVE-2022-36804-PoC Multithreaded exploit script for CVE-2022-3...

MAL-2022-3698 Malicious code in http-proxy-iddlemare (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2f358bcd3dc9d017b753a0661664f92444c3b40db7af4e0a10fe7e9b0cb12d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache Traffic Server Input Validation Error Vulnerability (CNVD-2023-03926)

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. Apache Traffic Server versions 8.0.0 through 9.1.2 are vulnerable to an input validation error, which could be exploited by an attacker to send invalid headers...

Apache Traffic Server Input Validation Error Vulnerability (CNVD-2023-03924)

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. Apache Traffic Server is vulnerable to an input validation error, which could be exploited by attackers to request secure resources...

Apache Traffic Server Input Validation Error Vulnerability (CNVD-2023-03923)

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. Apache Traffic Server is vulnerable to an input validation error, which could be exploited by attackers to smuggle requests...

Unintended Proxy or Intermediary

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Unintended Proxy or Intermediary. Go Vulnerability Report: An input validation flaw in the CGI components allows the HTTPPROXY environment variable to be set by the incoming Pro...

GO-2022-0761 Improper input validation in net/http and net/http/cgi

An input validation flaw in the CGI components allows the HTTPPROXY environment variable to be set by the incoming Proxy header, which changes where Go by default proxies all outbound HTTP requests. This environment variable is also used to set the outgoing proxy, enabling an attacker to insert a...

WS-2022-0181

When the "built-in HTTP proxy downloader middleware" https://docs.scrapy.org/en/2.6/topics/downloader-middleware.htmlmodule-scrapy.downloadermiddlewares.httpproxy processes a request with "proxy" metadata, and that "proxy" metadata includes proxy credentials, the built-in HTTP proxy downloader...

[SECURITY] Fedora 36 Update: golang-github-google-martian-3.1.0-10.fc36

Martian Proxy is a programmable HTTP proxy designed to be used for testing. Martian is a great tool to use if you want to: - Verify that all or some subset of requests are secure - Mock external services at the network layer - Inject headers, modify cookies or perform other mutations of HTTP...

Scrapy before 2.6.2 and 1.8.3 vulnerable to one proxy sending credentials to another

Impact When the built-in HTTP proxy downloader middleware processes a request with proxy metadata, and that proxy metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the Proxy-Authentication header, but only if that header is not already set. There are...

[SECURITY] Fedora 35 Update: golang-github-google-martian-3.1.0-9.fc35

Martian Proxy is a programmable HTTP proxy designed to be used for testing. Martian is a great tool to use if you want to: - Verify that all or some subset of requests are secure - Mock external services at the network layer - Inject headers, modify cookies or perform other mutations of HTTP...

CVE-2022-32210

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via...

CVE-2022-32290

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...

CVE-2022-32290

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...

Design/Logic Flaw

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...