OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

OpenClaw's fetchWithSsrFGuard... followed cross-origin redirects while preserving arbitrary caller-supplied headers except for a narrow denylist Authorization, Proxy-Authorization, Cookie, Cookie2. This allowed custom authorization headers such as X-Api-Key, Private-Token, and similar sensitive...

PT-2024-3307 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 20.4R3-S10 Junos OS versions 21.2 through 21.2R3-S7 Junos OS versions 21.3 through 21.3R2 Junos OS versions 21.4 through 21.4R2 Junos OS versions 22.1 through 22.1R1 Junos OS Evolved versions prior to 21.2R3-S8-EVO...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in the Matrix iOS SDK prior to version 0.23.19, which stems from matrix-ios-sdk implementing an overly lax key forwarding policy...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in the Matrix Javascript SDK prior to version 19.7.0, which stems from matrix-js-sdk implementing an overly lax key forwarding policy on the receiving end...

Matrix 安全漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A security vulnerability exists in versions of Matrix matrix-android-sdk2 prior to 1.5.1, which stems from the fact that its matrix-android-sdk2 implements an overly lax key-forwarding policy on the receiving end...

Description of the security update for Outlook 2016: October 13, 2020

Description of the security update for Outlook 2016: October 13, 2020 Summary This security update resolves a remote code execution vulnerability that exists in Microsoft Outlook if the software does not correctly handle objects in memory. It also resolves a denial of service vulnerability that...

openldap: forwarded bind failure messages cause success

chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicyforwardupdates aka authentication-failure forwarding is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a sla...