DEBIAN-CVE-2021-28652

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short que...

squid: improper input validation may allow a trusted client to perform HTTP request smuggling

A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling. This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid. The highest threat from this...

squid: improper input validation may allow a trusted client to perform HTTP request smuggling

A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling. This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid. The highest threat from this...

squid: improper input validation may allow a trusted client to perform HTTP request smuggling

A flaw was found in squid. Due to improper validation while parsing the request URI, squid is vulnerable to HTTP request smuggling. This issue could allow a trusted client to perform an HTTP request smuggling attack and access services otherwise forbidden by squid. The highest threat from this...

Squid 2.x < 4.14 / 5.x < 5.0.5 (SQUID-2020:11)

According to its banner, the version of Squid running on the remote host is 2.x prior to 4.14 or 5.x prior to 5.0.5. It is, therefore, affected by an HTTP request smuggling vulnerability due to improper input validation. This occurs for certain uriwhitespace in configuration settings. This proble...

ALPINE-CVE-2020-25097

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uriwhitespace configuration settings...

CVE-2020-25097

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uriwhitespace configuration settings...

HackerOne: Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation

Summary: Hacker can bypass minimum bounty amount restrictions in invitation preferences due to trusted client-side input to UpdateInvitationPreferencesMutation GraphQL operation Description: The new "Bounty Preferences" feature at https://hackerone.com/settings/preferences allows the hacker to se...

CVE-2020-24574

The client aka GalaxyClientService.exe in GOG GALAXY through 2.0.41 as of 12:58 AM Eastern, 9/26/21 allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into...

CVE-2020-24574

The client aka GalaxyClientService.exe in GOG GALAXY through 2.0.41 as of 12:58 AM Eastern, 9/26/21 allows local privilege escalation from any authenticated user to SYSTEM by instructing the Windows service to execute arbitrary commands. This occurs because the attacker can inject a DLL into...

FreeBSD -- Deadlock in the NFS server

Problem Description: The kernel holds a lock over the source directory vnode while trying to convert the target directory file handle to a vnode, which needs to be returned with the lock held, too. This order may be in violation of normal lock order, which in conjunction with other threads that...

squid -- Denial of Service vulnerability in DNS handling

Squid security advisory 2010:1 reports: Due to incorrect data validation Squid is vulnerable to a denial of service attack when processing specially crafted DNS packets. This problem allows any trusted client or external server who can determine the squid receiving port to perform a short-term...

squid -- several remote denial of service vulnerabilities

Squid security advisory 2009:2 reports: Due to incorrect buffer limits and related bound checks Squid is vulnerable to a denial of service attack when processing specially crafted requests or responses. Due to incorrect data validation Squid is vulnerable to a denial of service attack when...

Fedora Core 2 : httpd-2.0.50-2.1 (2004-204)

This update includes the latest stable release of Apache httpd 2.0, including security fixes for a remotely triggerable memory leak CVE-2004-0493, and a buffer overflow in modssl which can be triggered only by a trusted client certificate with a long subject DN field CVE-2004-0488. Note that...