CGA-96R9-45C4-HFGV

Bulletin has no description...

CGA-5MFW-76R4-566X

Bulletin has no description...

CGA-7247-P392-CX98

Bulletin has no description...

CGA-965J-WRPM-8299

Bulletin has no description...

CGA-QJ36-Q35W-M496

Bulletin has no description...

CGA-H6QR-RF23-C8RV

Bulletin has no description...

CGA-HQ6X-2CW7-5VP8

Bulletin has no description...

CGA-MRWV-6XG9-PP4J

Bulletin has no description...

CGA-4H9M-RQFF-5M8C

Bulletin has no description...

CGA-P93J-7XF7-JQQ8

Bulletin has no description...

Traefik: ForwardAuth identity spoofing via dot-form header alias

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...

GHSA-RF44-J88R-HH8C Traefik: ForwardAuth identity spoofing via dot-form header alias

Summary There is a medium severity vulnerability in Traefik's handling of request headers whose name aliases another header name. Go canonicalizes header names on dashes only, so X-Auth-User, XAuthUser and X.Auth.User are three distinct headers to Traefik, while backends that derive variable name...

GHSA-7GHQ-V6JF-G56C Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

GHSA-V3P8-WHQ6-R5JG Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization when traversing ancestor tags across element boundaries. When an application renders untrusted user input within raw-text tags , , , comments, or text nodes inside a that is nested...

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Summary An XSS vulnerability exists in @angular/platform-server during server-side rendering SSR HTML serialization when traversing ancestor tags across element boundaries. When an application renders untrusted user input within raw-text tags , , , comments, or text nodes inside a that is nested...

GHSA-F6MR-PJWC-34M4 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery SSRF, potentially leaking sensitive server-side credentials. Technical Description When applications validate incoming URLs using t...

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Summary A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery SSRF, potentially leaking sensitive server-side credentials. Technical Description When applications validate incoming URLs using t...

GHSA-P297-FM68-3Q8C Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP...

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

A security bypass vulnerability was discovered in @angular/common when Server-Side Rendering SSR and hydration are enabled in applications using a hierarchical HttpClient configuration with withRequestsMadeViaParent. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP...