549 matches found
PT-2026-30319
Name of the Vulnerable Software and Affected Versions pyLoad versions 0.5.0b3.dev96 and earlier Description pyLoad, a Python-based download manager, has an issue in the parse urls API function located in src/pyload/core/api/ init .py. This function retrieves URLs server-side using get urlurl pycu...
Experts Detect Pakistan-Linked Cyber Campaigns Aimed at Indian Government Entities
Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft. The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025. "While...
MiracleLinux 8 : squid:4 (AXSA:2024-7404:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7404:01 advisory. squid: Denial of Service in SSL Certificate validation CVE-2023-46724 squid: NULL pointer dereference in the gopher protocol code CVE-2023-46728...
MiracleLinux 9 : squid-5.5-6.el9_3.5 (AXSA:2024-7340:01)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-7340:01 advisory. squid: Denial of Service in SSL Certificate validation CVE-2023-46724 squid: NULL pointer dereference in the gopher protocol code CVE-2023-46728...
MiracleLinux 8 : squid:4 (AXSA:2022-3793:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3793:01 advisory. squid: DoS when processing gopher server responses CVE-2021-46784 Tenable has extracted the preceding description block directly from the MiracleLinux securi...
MiracleLinux 7 : squid-3.5.20-17.el7.10 (AXSA:2024-7673:03)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7673:03 advisory. squid: denial of service in HTTP header parser CVE-2024-25617 squid: denial of service in HTTP request parsing CVE-2023-50269 squid: Buffer over-rea...
MiracleLinux 7 : squid-3.5.20-17.el7.7 (AXSA:2022-3510:01)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3510:01 advisory. squid: DoS when processing gopher server responses CVE-2021-46784 Tenable has extracted the preceding description block directly from the MiracleLinux securi...
MiracleLinux 9 : squid-5.2-1.el9.1 (AXSA:2022-4015:03)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2022-4015:03 advisory. squid: DoS when processing gopher server responses CVE-2021-46784 Tenable has extracted the preceding description block directly from the MiracleLinux securi...
curl: Gopher Protocol Command Injection (SSRF Smuggling)
Summary The curl Gopher protocol handler is vulnerable to command injection through URL-encoded CRLF sequences in the path. This allows an attacker to "smuggle" additional Gopher selectors or arbitrary commands into a single Gopher request. By using %0d%0a in the URL, an attacker can break the...
CVE-1999-0124
Vulnerabilities in UMN gopher and gopher+ versions 1.12 and 2.0x allow an intruder to read any files that can be accessed by the gopher daemon...
CVE-1999-0640
The Gopher service is running...
curl: CRLF Injection in Gopher Protocol (`lib/gopher.c`)
Control characters slip through during URL handling in curl’s Gopher setup. Though null bytes get blocked by the REJECTZERO setting, returns and line feeds remain permitted. A specially built address using percent-encoded breaks - like %0D%0A - opens room for command insertion. Because of how...
curl: Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command Injection
Summary: I have discovered that the Gopher protocol implementation in curl fails to properly sanitize newline characters %0d%0 in the selector path. This allows an attacker to inject arbitrary TCP commands when curl connects to a target server via gopher://. This vulnerability enables Protocol...
Oracle Linux 7 : squid (ELSA-2025-19167)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-19167 advisory. - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - Fixes CVE-2025-54574, add URN access disabling config options Orabug: 38350105 ...
squid security update
7:3.5.20-17.0.9.13 - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - authentication credential leakage in error handling Orabug: 38587551 7:3.5.20-17.0.7.13 - Fixes CVE-2025-54574, add URN access disabling config options Orabug: 38350105 7:3.5.20-17.0.5.13 - Fixed cv...
Siemens SIMATIC S7-1500 Double Free (CVE-2022-42915)
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTPS URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request HTTP...
Malicious code in incredible_gopher_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9e68c3b7c17f19f77d4594d269e7cf854b5270942a32bac51b985c5afcd814 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-134276 Malicious code in incredible_gopher_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9e68c3b7c17f19f77d4594d269e7cf854b5270942a32bac51b985c5afcd814 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
