1636 matches found
curl: curl: Unauthorized access due to improper HTTP proxy connection reuse
A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker...
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in http-proxy-middleware
Summary IBM DataPower Gateway has addressed multiple vulnerabilities in http-proxy-middleware in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0,...
TencentOS Server 2: freerdp (TSSA-2026:1042)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1042 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
CVE-2026-85124
A flaw was found in @fastify/http-proxy. This component, designed to proxy HTTP requests, does not correctly validate incoming request paths, specifically failing to account for backslash-based dot-segments. An unauthenticated network attacker can exploit this vulnerability to bypass the proxy's...
CVE-2026-85720
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...
USN-8780-1 libsoup2.4, libsoup3 vulnerabilities
It was discovered that libsoup incorrectly handled certain URLs when using an HTTP proxy. A remote attacker could possibly use this issue to inject arbitrary HTTP headers. CVE-2026-1467 It was discovered that libsoup did not remove proxy authentication credentials when following HTTP redirects. A...
USN-8780-1: libsoup vulnerabilities
It was discovered that libsoup incorrectly handled certain URLs when using an HTTP proxy. A remote attacker could possibly use this issue to inject arbitrary HTTP headers. CVE-2026-1467 It was discovered that libsoup did not remove proxy authentication credentials when following HTTP redirects. A...
PT-2026-94395
Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.16.0 AsyncHttpClient versions 3.0.0 through 3.0.11 Description When using an HTTP proxy to reach an HTTPS origin, the library may expose preemptive origin credentials. This occurs because...
CVE-2026-85720: Cleartext Transmission of Sensitive Information
The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, a request using an HTTP proxy to reach an HTTPS origin can expose preemptive origin credentials because NettyRequestFactory and...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109811)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109811 advisory. FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This...
(0Day) Microsoft Windows HTTP Proxy Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware
Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents...
EUVD-2026-78166
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
CVE-2026-91143
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...
Server-Side Request Forgery (SSRF)
NLTK is vulnerable to a Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the destination when an HTTP proxy is configured, which allows an attacker to provide a validated public URL that the proxy redirects to an internal service, potentially exposing internal...