Jupyter Server 代码问题漏洞

Jupyter Server is a Jupyter community application used to provide back-end services for Jupyter web applications. A security vulnerability exists in the Jupyter Server Proxy that originates from allowing authenticated clients to bypass security checks by proxying requests to other hosts...

Code injection

A unintended proxy or intermediary 'confused deputy' in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests...

CVE-2021-36191

A url redirection to untrusted site 'open redirect' in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers...

squid: incorrect memory management in HTTP Range header

An incorrect memory management flaw was found in Squid, where it is vulnerable to a denial of service attack against all clients using the proxy. The highest threat from this vulnerability is to system availability...

CVE-2021-22959

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an attacker can use this flaw to inject...

envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies

An authorization bypass vulnerability was found in envoyproxy/envoy. When a URI path-based authorization policy is specified, envoy incorrectly evaluates the HTTP request which contains a URI fragment. This flaw allows an attacker to bypass the authorization policy and access downstream services...

Akaunting 授权问题漏洞

Akaunting is an application from Akaunting that provides all the tools you need to manage your money online. An authorization issue vulnerability exists in Akaunting versions 2.1.12 and earlier. An attacker can proxy a password reset request through a running instance of Akaunting if the attacker...

CVE-2021-29954

Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulnerability affects Hubs Cloud mozillareality/reticulum/1.0.1/20210428201255...

Denial Of Service (DoS)

squid is vulnerable to denial of service DoS. The vulnerability exists through an improper input validation, affecting all clients using the proxy...

Abhinavsingh Proxy.py Authorization Issues Vulnerability

Abhinavsingh Proxy.py is a Python-based proxy server for network monitoring, control and application development, testing, and debugging by Abhinavsingh Personal Developer. A security vulnerability exists in Abhinavsingh Proxy.py version 2.3.1 and earlier versions of AuthPlugin that allows...

PT-2021-4081 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.7 and later Description: The issue is related to incorrect authorization in the Dependency Proxy component of GitLab, allowing a remote attacker to potentially impact data integrity. Under certain circumstances, the...

The vulnerability of the NDP Proxy component in the JunOS operating system allows a hacker to trigger a maintenance failure.

The vulnerability of the NDP Proxy component in the JunOS operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

@acanto/october-scripts (=3.2.2), @acanto/workflow (=5.1.0) +1213 more potentially affected by unknown CVE via http-proxy (>=0.10.0 <=1.18.0)

http-proxy NPM version =0.10.0, =2018.7.11-0, =0.0.1, =0.156.0, =2.6.6, =4.0.0, =3.0.1, =0.0.1, =1.12.2-next.3, =1.0.0, =1.0.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6X33-PW7P-HMPQ...

CVE-2020-13223

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2...

ZNC Code Issue Vulnerability

ZNC is a set of IRC proxies that allow users to log in to IRC servers from their workstations. A code issue vulnerability exists in ZNC 1.8.0 and later fixed in version 1.8.1-rc1. An attacker can exploit this vulnerability to cause the application to crash when echo-message is not enabled and no...

CVE-2020-11077

CVE-2020-11077 affects the Puma RubyGem HTTP server. It describes an HTTP request/response smuggling scenario where a proxy with persistent connections and HTTP pipelining can cause the proxy to deliver a second response to the wrong client, due to how Puma parses the first request and its body. ...

GHSA-PC5P-H8PF-MVWP Machine-In-The-Middle in https-proxy-agent

Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept...

CVE-2019-12520

An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...

UBUNTU-CVE-2020-1934

In Apache HTTP Server 2.4.0 to 2.4.41, modproxyftp may use uninitialized memory when proxying to a malicious FTP server...

Request smuggling is possible when both chunked TE and content length specified

Impact Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator. Patches https://github.com/ktorio/ktor/pull/1547 Workarounds None except migrating to a better proxy. References...