SUSE CVE-2023-35945

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon receiving RSTSTREAM immediately followed by the GOAWAY frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the GOAWA...

CVE-2024-2877 Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2024-2877, was fixed in Vault Enterpris...

koajs cors security breach

koajs cors is a cross-origin resource share for koa. A security vulnerability exists in koajs cors prior to version 5.0.0, which stems from the fact that if an allowed source is not provided, it will return an Access-Control-Allow-Origin header containing the source value in the request, which...

USN-6473-2 python-pip vulnerabilities

USN-6473-1 fixed vulnerabilities in urllib3. This update provides the corresponding updates for the urllib3 module bundled into pip. Original advisory details: It was discovered that urllib3 didn't strip HTTP Authorization header on cross-origin redirects. A remote attacker could possibly use thi...

RHEL 8 : python27:2.7 (RHSA-2023:7042)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7042 advisory. Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types...

Philips EncoreAnywhere Information Disclosure Vulnerability

Philips EncoreAnywhere is a complete solution for collecting and sharing patient adherence data via the Web from Philips Netherlands. An information disclosure vulnerability exists in Philips EncoreAnywhere versions 2.36.3.3 and earlier, which stems from an HTTP header containing data that an...

Rocky Linux 8 : nginx:1.14 (RLSA-2019:2799)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:2799 advisory. - Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of...

SUSE-SU-2023:4352-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2023-45803: Fix a request body leak that could occur when receiving a 303 HTTP response bsc1216377. - CVE-2018-25091: Fixed a potential leak of the Authorization header during a cross-origin redirect bsc1216275. - CVE-2023-43804:...

UBUNTU-CVE-2023-5722

Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerability affects Firefox 119...

Node.js 18.x < 18.18.2 / 20.x < 20.8.1 Multiple Vulnerabilities (Friday October 13 2023 Security Releases).

The version of Node.js installed on the remote host is prior to 18.18.2, 20.8.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Friday October 13 2023 Security Releases advisory. - Undici did not always clear Cookie headers on cross-origin redirects. By design, cookie...

Medium: tomcat

Issue Overview: While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent...

python-requests security update

2.20.0-3 - Fix Unintended leak of Proxy-Authorization header CVE-2023-32681...

SUSE-SU-2023:3094-1 Security update for python-requests

This update for python-requests fixes the following issues: - CVE-2023-32681: fixed unintended leak of Proxy-Authorization header bsc1211674...

SUSE-SU-2023:2865-1 Security update for python-requests

This update for python-requests fixes the following issues: - CVE-2023-32681: Fixed unintended leak of Proxy-Authorization header bsc1211674...

SUSE-SU-2023:2638-1 Security update for python-requests

This update for python-requests fixes the following issues: - CVE-2023-32681: Fixed unintended leak of Proxy-Authorization header bsc1211674...

CVE-2023-31413

Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging is enabled...

PT-2023-17144 · Gitlab · Gitlab Dast Api Scanner

Name of the Vulnerable Software and Affected Versions: GitLab DAST API scanner versions 1.6.50 through 2.10.x Description: An issue has been discovered in the GitLab DAST API scanner where Authorization headers were leaked in vulnerability report evidence. Recommendations: For versions 1.6.50...

CVE-2023-0326

An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence...

K02591030: HTTP/2 vulnerabilities CVE-2019-9511, CVE-2019-9513, CVE-2019-9516, and CVE-2019-9517

Security Advisory Description CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They...

SUSE CVE-2020-13943

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it was possible that a subsequent request made on that connection could...