CVE-2022-31090: Exposure of Sensitive Information to an Unauthorized Actor

Guzzle, an extensible PHP HTTP client. Authorization headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the CURLOPTHTTPAUTH option to specify an Authorization header. On making a request which responds with a redirect to a URI wi...

SUSE SLES12 Security Update : python-requests (SUSE-SU-2022:1819-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1819-1 advisory. - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-ht...

SUSE-SU-2022:1819-1 Security update for python-requests

This update for python-requests fixes the following issues: - CVE-2018-18074: Fixed to prevent the package to send an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect. bsc1111622...

GHSA-VCMM-PPQX-95CH Logstash Logs Sensitive Information

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information...

SUSE SLES15 Security Update : python-requests (SUSE-SU-2022:1448-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1448-1 advisory. - CVE-2018-18074: Fixed sending an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect bsc1111622...

SUSE-SU-2022:1448-1 Security update for python-requests

This update for python-requests fixes the following issues: - CVE-2018-18074: Fixed sending an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect bsc1111622...

[SECURITY] [DLA 2950-1] python-scrapy security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2950-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 16, 2022 https://wiki.debian.org/LTS -...

Cisco Small Business RV Series Authentication Bypass / Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco Small Business RV Series Authentication Bypass and Command Injection', 'Description' = %q This module exploits an authentication bypass...

Cisco Small Business RV Series Authentication Bypass and Command Injection

This module exploits an authentication bypass CVE-2021-1472 and command injection CVE-2021-1473 in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the...

EulerOS Virtualization 3.0.2.2 : python-requests (EulerOS-SA-2020-2201)

According to the version of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostna...

Huawei EulerOS: Security Advisory for python-requests (EulerOS-SA-2020-1753)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : python-requests (EulerOS-SA-2020-1633)

According to the version of the python-requests package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-htt...

PT-2020-5200

Name of the Vulnerable Software and Affected Versions CmtViewer affected versions not specified Description The issue is related to the lack of protection for transmitted data in the CmtViewer application's basic HTTP authorization method. This could allow a remote attacker to gain access to the...

CVE-2020-12624

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

PT-2020-13172

Name of the Vulnerable Software and Affected Versions The League application versions prior to 2020-05-02 Description The issue allows remote attackers to hijack sessions because the application sends a bearer token in an HTTP Authorization header to an arbitrary web site hosting an external imag...

CVE-2020-12624: Incomplete Cleanup

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

Access Restriction Bypass

The Apache HTTP Server is vulnerable to Access Restriction Bypass. A second flaw was found in the Apache modproxyftp module. In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header,...

GHSA-XWGQ-PCQX-HPMV URL Redirection to Untrusted Site (Open Redirect) in Ktor

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location...

URL Redirection to Untrusted Site (Open Redirect) in Ktor

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location...

Huawei EulerOS: Security Advisory for python-requests (EulerOS-SA-2020-1043)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...