47 matches found
CVE-2026-42008
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without...
CVE-2026-12547
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
Origin Validation Error
Overview Affected versions of this package are vulnerable to Origin Validation Error in the processing of HTTP request headers, specifically X-ProxyHost and X-Forwarded-Host. An attacker can manipulate the construction of qualified URLs for redirection or data references by supplying crafted valu...
EUVD-2026-38216
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
CVE-2026-54665 Apache NiFi: Missing Validation for Proxy Host Headers
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
CVE-2026-54665
Apache NiFi (versions 0.0.1–2.9.0) is affected by an input-validation flaw where URL redirection/data references can be influenced by non-standard host headers. NiFi 1.6.0 added a proxy-host header validation mechanism, but validation was not applied to alternative headers (X-ProxyHost, X-Forward...
CVE-2026-54665 Apache NiFi: Missing Validation for Proxy Host Headers
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...
CVE-2026-42271 LiteLLM: Authenticated command execution via MCP stdio test endpoints
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration i...
CVE-2018-25313
SysGauge 4.5.18 contains a buffer overflow vulnerability in the proxy configuration handler that allows local attackers to cause a denial of service by supplying an oversized string. Attackers can inject a large payload through the Proxy Server Host Name field in the Options menu to crash the...
CVE-2018-25313 SysGauge 4.5.18 Local Denial of Service via Proxy Configuration
SysGauge 4.5.18 contains a buffer overflow vulnerability in the proxy configuration handler that allows local attackers to cause a denial of service by supplying an oversized string. Attackers can inject a large payload through the Proxy Server Host Name field in the Options menu to crash the...
PT-2026-35996
SysGauge 4.5.18 contains a buffer overflow vulnerability in the proxy configuration handler that allows local attackers to cause a denial of service by supplying an oversized string. Attackers can inject a large payload through the Proxy Server Host Name field in the Options menu to crash the...
Flexense SysGauge 安全漏洞
Flexense SysGauge is a system analysis tool developed by Flexense Corporation, designed for real-time monitoring of system performance and resource usage. Version 4.5.18 of Flexense SysGauge contains a security vulnerability. This vulnerability stems from a buffer overflow in the proxy...
Prime95 安全漏洞
Prime95 is a device stress testing software developed by Prime95 Corporation. Version 29.4b8 of Prime95 contains a security vulnerability. This vulnerability stems from a local buffer overflow, which could allow attackers to execute arbitrary code by exploiting the structured exception handling...
CVE-2019-25327
Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the PrimeNet user ID and proxy host fields to trigger a bind shell on port 3110...
PT-2026-7926
Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the PrimeNet user ID and proxy host fields to trigger a bind shell on port 3110...
ROS-20251203-11
Vulnerability of parse.ParseUnverified function of golang-jwt web token library of Go programming language is related to uncontrolled resource consumption. Go programming language is related to uncontrolled resource consumption. Exploitation of the vulnerability allows an attacker acting remotely...
EUVD-2002-0066
Malware in sbrugna...