traefik -- Denial of service in HTTP/2

The traefik project reports: Update of dependency to go go1.12.8 resolves potential HTTP/2 denial of service in traefik...

Information Disclosure

github.com/containous/traefik is vulnerable to information disclosure.The API allows remote authenticated users to discover password hashes in the JSON response by reading the Basic HTTP Authentication or Digest HTTP Authentication headers, or discover a key by reading the ClientTLS section...

CVE-2019-12452

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

Design/Logic Flaw

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

CVE-2019-12452

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

CVE-2019-12452

CVE-2019-12452 affects Containous Traefik 1.7.x (1.7.11 and earlier). When --api is enabled and publicly reachable with insufficient access control, remote authenticated users can read the JSON response of /api to discover password hashes from Basic/Digest HTTP Authentication and can read a Clien...

CVE-2019-12452

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

PT-2019-12799 · Containous +1 · Traefik +1

Name of the Vulnerable Software and Affected Versions: Containous Traefik versions 1.7.x through 1.7.11 Description: The issue allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading...

CVE-2019-12452: Insufficiently Protected Credentials

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...

FreeBSD : Containous Traefik -- exposes the configuration and secret (fe818607-b5ff-11e8-856b-485b3931c969)

MITRE reports : Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

The vulnerability of the API component of the Containous Traefik reverse proxy server allows attackers to disclose protected information.

The vulnerability of the Containous Traefik reverse proxy server’s API is related to implementation errors in the API. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Information Disclosure

github.com/containous/traefik is vulnerable to information disclosure. The configuration and secret is disclosed when authentication is missing and the --api is used. If the API is publicly accessible, an attacker will be able to exploit the vulnerability to obtain the configuration and secret...

CVE-2018-15598

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable...

Authentication flaw

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable...

CVE-2018-15598

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable...

CVE-2018-15598

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable...

CVE-2018-15598

Traefik 1.6.x before 1.6.6 exposes configuration and secrets when the API is enabled (--api) and the API port is publicly reachable if authentication is missing. Root cause is missing authentication on the API surface, leading to information disclosure. Impact is disclosure of sensitive configura...

CVE-2018-15598: Improper Authentication

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable...

Containous Traefik Information Disclosure Vulnerability

Containous Traefik is an open source reverse proxy and load balancing product from French company Containous. An information disclosure vulnerability exists in Containous Traefik version 1.6.x prior to 1.6.6. An attacker can exploit this vulnerability to obtain configuration and sensitive...

Containous Traefik -- exposes the configuration and secret

MITRE reports: Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable...