1451 matches found
Http request which redirect to another hostname do not strip authorization header in @actions/http-client
Impact If consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect 302 and 3. the redirect url redirects to another domain or hostname The authorization header will get passed to the other domain. Note that since this library is for...
GHSA-9W6V-M7WP-JWG4 Http request which redirect to another hostname do not strip authorization header in @actions/http-client
Impact If consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect 302 and 3. the redirect url redirects to another domain or hostname The authorization header will get passed to the other domain. Note that since this library is for...
Information Exposure
Actions Http-Client can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: make an http request with an authorization header that request leads to a redirect 302 the redirect url redirects to...
python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...
python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...
python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...
CentOS 7 : python-virtualenv (RHSA-2020:0851)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0851 advisory. - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect...
python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...
python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 302 from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker coul...
python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect i.e., a redirect that differs in host, port, or scheme. This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext...
CVE-2020-10376
Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Basic" HTTP header...
GHSA-XWGQ-PCQX-HPMV URL Redirection to Untrusted Site (Open Redirect) in Ktor
In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location...
CVE-2013-1595
A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the RTSP service, which could let a remote malicious user execute arbitrary code or cause a Denial of Service...
NewStart CGSL CORE 5.05 / MAIN 5.05 : python-urllib3 Multiple Vulnerabilities (NS-SA-2019-0246)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python-urllib3 packages installed that are affected by multiple vulnerabilities: - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. CVE-2019-11236 ...
CVE-2013-0196
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser...
Cross site request forgery (csrf)
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser...
CVE-2013-0196
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser...
CVE-2013-0196
A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser...