GHSA-32X6-QVW6-MXJ4 Forwarding of confidentials headers to third parties in fluture-node

Impact Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to...

CVE-2022-24719

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

PYSEC-2022-43051

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

PYSEC-2022-43051

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

PYSEC-2022-43052

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

Design/Logic Flaw

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

PYSEC-2022-43052

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2022-24719 Unauthorized forwarding of confidential headers in fluture-node

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2022-24719 Unauthorized forwarding of confidential headers in fluture-node

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2022-24719 Unauthorized forwarding of confidential headers in fluture-node

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2022-24719

CVE-2022-24719 affects Fluture-Node. The vulnerability arises when using followRedirects or followRedirectsWith with redirection strategies in fluture-node 4.0.0/4.0.1, where confidential headers (Authorization, Cookie) can be exposed in a redirected request to a third‑party or HTTP origin. The i...

PT-2022-16827 · Unknown · Fluture-Node

Name of the Vulnerable Software and Affected Versions: Fluture-Node versions 4.0.0 through 4.0.1 Description: Using followRedirects or followRedirectsWith with any of the redirection strategies built into Fluture-Node, paired with a request that includes confidential headers such as Authorization...

WordPress Add Expires Headers & Optimized Minify plugin < 2.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Add Expires Headers & Optimized Minify plugin versions 2.5. Solution Update the WordPress Add Expires Headers & Optimized Minify plugin to the latest available version at least 2.5...

WebHMI 4.1.1 Remote Code Execution Exploit

Exploit Title: WebHMI 4.1.1 - Remote Code Execution RCE Authenticated Exploit Author: Antonio Cuomo arkantolo Vendor Homepage: https://webhmi.com.ua/en/ Version: WebHMI 4.1.1.7662 Tested on: WebHMI-4.1.1.7662 !/usr/bin/python import sys import re import argparse import requests import time import...

CVE-2022-0451

The CVE-2022-0451 issue affects the Dart SDK (dart:io) where HTTPClient may include Authorization headers during cross-origin redirects. By default, HttpClient handles redirects, and headers that are set on the initial request could be sent to a redirect target if the redirect goes to an attacker...

CVE-2022-0451 Auth bypass in Dark SDK

Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with...

GO-2021-0241 Attacker can drop certain headers in net/http/httputil

ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director...

Missing Authorization

Overview std/net/http/httputil is a Go standard library package std/net/http/httputil Affected versions of this package are vulnerable to Missing Authorization. Go Vulnerability Report: ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the...

FreeBSD : py-twisted -- cookie and authorization headers are leaked when following cross-origin redirects (24049967-88ec-11ec-88f5-901b0e934d69)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 24049967-88ec-11ec-88f5-901b0e934d69 advisory. - Twisted developers report: Cookie and Authorization headers are leaked when following cross-origin...

Showmax: Cross-origin resource sharing

A misconfiguration on recent deployment caused CORS headers not to be set on the https://stories.showmax.com service. While no customer data could be exposed via this channel, it's a good practice to set CORS headers if possible. Please note that CORS is actually out-of-scope of our program since...