USN-5788-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description Hiroki Kurosawa discovered that curl incorrectly handled HSTS support when certain hostnames included IDN characters. A remote attacker could possibly use this issue to cause curl t...

USN-5788-1: curl vulnerabilities

Hiroki Kurosawa discovered that curl incorrectly handled HSTS support when certain hostnames included IDN characters. A remote attacker could possibly use this issue to cause curl to use unencrypted connections. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. CVE-2022-43551 It was...

CVE-2022-38756

A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies...

Design/Logic Flaw

A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies...

CVE-2022-38756 CVE-2022-38756 vulnerability in GW Web prior to 18.4.2

A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies...

CVE-2022-38756

Micro Focus GroupWise Web (versions prior to 18.4.2) is affected by CVE-2022-38756. The GW Web component makes a request to the Post Office Agent containing sensitive information in query parameters, which can be logged by intervening HTTP proxies. Connected sources corroborate exposure of sessio...

CVE-2022-38756 CVE-2022-38756 vulnerability in GW Web prior to 18.4.2

A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies...

GHSA-PGW7-WX7W-2W33 ProxyAgent vulnerable to MITM

Description Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually...

CVE-2022-24801

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing...

CVE-2022-24801 HTTP Request Smuggling in twisted.web

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing...

Gorsair - Hacks Its Way Into Remote Docker Containers That Expose Their APIs

Gorsair is a penetration testing tool for discovering and remotely accessing Docker APIs from vulnerable Docker containers. Once it has access to the docker daemon, you can use Gorsair to directly execute commands on remote containers. Exposing the docker API on the internet is a tremendous risk,...

WordPress-Brute-Force - Super Fast Login WordPress Brute Force

WordPress Brute Force Super Fast Login .---. .----------- / \ / ------ / / \ / ----- ////// ' / --- //// / // : ★★ : --- // / / / '-- // //..\ WpCrack Brute Froce Tool™ ====UU====UU========================== '//||\ '' usage: python WpCrack.py options optional arguments: -h, --help show this help...

Arbitrary Code Execution

cvs is vulnerable to arbitrary code execution. The vulnerability exists as a heap-based buffer overflow flaw was found in the way the CVS client handled responses from HTTP proxies. A malicious HTTP proxy could use this flaw to cause the CVS client to crash or, possibly, execute arbitrary code wi...

USN-4223-1: OpenJDK vulnerabilities

Jan Jancar, Petr Svenda, and Vladimir Sedlacek discovered that a side- channel vulnerability existed in the ECDSA implementation in OpenJDK. An Attacker could use this to expose sensitive information. CVE-2019-2894 It was discovered that the Socket implementation in OpenJDK did not properly...

FireProx - AWS API Gateway Management Tool For Creating On The Fly HTTP Pass-Through Proxies For Unique IP Rotation

Being able to hide or continually rotate the source IP address when making web calls can be difficult or expensive. A number of tools have existed for some time but they were either limited with the number of IP addresses, were expensive, or required deployment of lots of VPS's. FireProx leverage...

Telegram C# C2 - A Command and Control Tool for Telegram Bot Communication

Command and Control for C Writing Author: Leiothrix Telegram: @Leiothrix Twitter: @wh4am1 Team: QQ愛&Love Install Nuget download these package using System.IO; using Telegram.Bot; using Telegram.Bot.Args; using Telegram.Bot.Types.InputFiles; using AForge.Video; using AForge.Controls; using...

Authentication flaw

In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, proxy authentication incorrectly reported HTTP proxies received credentials securely. This issue was addressed through improved warnings...

Pybelt - The Hackers Tool Belt

Pybelt is an open source hackers tool belt complete with: A port scanner SQL injection scanner Dork checker Hash cracker Hash type verification tool Proxy finding tool XSS scanner It is capable of cracking hashes without prior knowledge of the algorithm, scanning ports on a given host, searching...

SUSE-RU-2015:0393-1 Recommended update for SUSE Manager Server 2.1

This collective update for SUSE Manager Server 2.1 provides the following new features: ISS: export/import information about cloned channels to support Service Pack migration on ISS slaves. FATE317789 New API calls: system.scheduleSPMigration, system.scheduleDistUpgrade. FATE314785, FATE314340...

Debian Security Advisory DSA 3101-1 (c-icap - security update)

Several vulnerabilities were found in c-icap, an ICAP server implementation, which could allow a remote attacker to cause c-icap to crash, or have other, unspecified impacts. OpenVAS Vulnerability Test $Id: deb3101.nasl 6735 2017-07-17 09:56:49Z teissa $ Auto-generated from advisory DSA 3101-1...