HTTPoxyScan

Escáner de Exploit HTTPoxy por 1N3 @CrowdShield https://crowdshield.com Última actualización: 20160720 ACERCA DE: Escáner PoC/Exploit para escanear archivos CGI comunes en una URL objetivo en busca de la vulnerabilidad HTTPoxy. Httpoxy es un conjunto de vulnerabilidades que afectan al código de...

CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...

CVE-2026-77348

Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...

CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...

CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...

MiracleLinux 4 : rh-php56-php-5.6.5-9.AXS4 (AXSA:2016-622:02)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-622:02 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in...

MiracleLinux 4 : php55-php-5.5.21-5.AXS4 (AXSA:2016-625:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-625:01 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in...

MiracleLinux 7 : rh-php56-php-5.6.5-9.el7 (AXSA:2016-623:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-623:03 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in...

MiracleLinux 4 : php54-php-5.4.40-4.AXS4 (AXSA:2016-620:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-620:01 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in...

MiracleLinux 7 : php-5.4.16-36.3.el7 (AXSA:2016-624:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-624:02 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in...

MiracleLinux 7 : php55-php-5.5.21-5.el7 (AXSA:2016-632:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-632:01 advisory. Security issues fixed with this release: CVE-2016-5385 PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore...

EUVD-2016-7217

Malware in sbrugna...

EUVD-2016-7216

Malware in sbrugna...

EUVD-2016-1054

Malware in sbrugna...

EUVD-2020-0227

Malware in sbrugna...

EUVD-2016-1053

Malware in sbrugna...

Erlang/OTP (Erlang OTP) Httpd CGI Scripts Environment Variable Pollution Vulnerability (Sep 2025, httpoxy) - Windows

Erlang/OTP Erlang OTP is prone to a Httpd CGI scripts environment variable pollution vulnerability in the inets component dubbed SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Erlang/OTP (Erlang OTP) Httpd CGI Scripts Environment Variable Pollution Vulnerability (Sep 2025, httpoxy) - Linux

Erlang/OTP Erlang OTP is prone to a Httpd CGI scripts environment variable pollution vulnerability in the inets component dubbed SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Linux Distros Unpatched Vulnerability : CVE-2016-1000109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted clie...

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

...