CVE-2024-3505

JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments...

CVE-2024-3505

JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments...

CVE-2024-3505 JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users

JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments...

CVE-2024-3505 JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users

JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments...

CVE-2024-3505: Exposure of Sensitive Information to an Unauthorized Actor

JFrog Artifactory Self-Hosted versions below 7.77.3, are vulnerable to sensitive information disclosure whereby a low-privileged authenticated user can read the proxy configuration. This does not affect JFrog cloud deployments...

Expired tokens can be renewed without validating the account password

Impact In versions of the proxy from 2022-09-05 onwards since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f, expired OAuth 2.0 client credentials grant CCG flow authorisation tokens could be renewed automatically without checking their validity against the original account configuration i.e., the...

GHSA-2WMJ-46RJ-QM2W ZITADEL Account Takeover via Malicious Host Header Injection

Impact ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicious site in the email, the secret code c...

CVE-2023-2816 Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the services corresponding to those...

httpd: HTTP request splitting with mod_rewrite and mod_proxy

A vulnerability was found in httpd. This security issue occurs when some modproxy configurations on Apache HTTP Server allow an HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern...

CLSA-2023-1679943745 Fix CVE(s): CVE-2023-25690

SECURITY UPDATE: proxy configuration may trigger HTTP request smuggling attack - debian/patches/CVE-2023-25690.patch: don't forward invalid query strings - CVE-2023-25690...

Rack has possible DoS Vulnerability in Multipart MIME parsing

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530. Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3 Impact The Multipart MIME parsing code in Rack...

Apache HTTP Server 环境问题漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable, and extensible via a simple API. An environmental issue vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.55 that stems from certain modproxy...

SUSE CVE-2011-2778

Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service memory corruption or possibly execute arbitrary code by 1 establishing a SOCKS connection to SocksPort or 2 leveraging a SOCKS proxy configuration...

Citrix Secure Private Access (SPA ) Connector Appliance not wokring with proxy configuration

Connector Appliance does not work with proxy configuration As soon as proxy config is added, connectivity check fails for all the URLs...

CVE-2022-23556: Attackers may spoof IP address when using proxy

Impact This vulnerability may allow attackers to spoof their IP address when your server is behind a reverse proxy. Patches Upgrade to v4.2.11 or later, and configure Config\App::$proxyIPs. Workarounds Do not use $request-getIPAddress. References -...

AlmaLinux 9 : buildah (ALSA-2022:8008)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8008 advisory. - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is...

CVE-2022-36774: Undefined Security Weakness

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575...

CVE-2022-36774

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575...

PT-2022-6210 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 21.0.0 through 21.0.2 Description: The issue is related to the configuration of IBM Robotic Process Automation, which is vulnerable to man-in-the-middle attacks through manipulation of the client proxy...

[Citrix Gateway VPN] Cannot access intranet applications in VPN over Proxy environment

When you connect Citrix Gateway VPN. You may observe VPN establishment is OK but cannot access internal applications/networks when the following conditions both match: Client has proxy configured and VPN connection goes through Proxy. Client PC has an interface IP in 169.254.0.0/16 subnet Usually...