PT-2024-33265 · Unknown · Agent Dart

Name of the Vulnerable Software and Affected Versions: Agent Dart versions prior to 1.0.0-dev.29 Description: The issue is related to improper certificate verification in the lib/agent/certificate.dart file. Specifically, during delegation verification in the checkDelegation function, the caniste...

elinks: Improper delegation of client credentials during GSS negotiation

The httpnegotiatecreatecontext function in protocol/http/httpnegotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials...

Debian DSA-2271-1 : curl - improper delegation of client credentials

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. This is...