November 14, 2017—KB4048953 (OS Build 14393.1884)

None None...

██████: Remote Code Execution on Proxy Service (as root)

The proxy service used to provide researchers with access to certain programs on ██████ allows access to AWS's Metadata API. This Metadata API in turn is configured to expose temporary AWS access credentials for the AWS EC2 Run Command role. When this role is assumed by an AWS client e.g. the CLI...

CVE-2017-14117

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...

Code injection

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...

Juniper Networks Junos OS Multiple BIND Vulnerabilities (JSA10785)

Junos OS is prone to multiple denial of service vulnerabilities in ISC BIND named. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Google Chrome PAC Feature Information Disclosure Vulnerability

Google Chrome is a web browsing tool developed by Google. An information disclosure vulnerability exists in Google Chrome prior to version 52.0.2743.82, where the PAC function net/proxy/proxyservice.cc does not ensure that URL information is restricted to a certain scheme, host, and port. A remot...

CVE-2016-5134

Removed by vendor...

CVE-2016-5134

net/proxy/proxyservice.cc in the Proxy Auto-Config PAC feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to...

CVE-2015-7793

Corega CG-WLBARAGM devices provide an open proxy service, which allows remote attackers to trigger outbound network traffic via unspecified vectors...

Design/Logic Flaw

The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.51 allows remote attackers to cause a denial of service SIP proxy service restart via a crafted HTTP request, aka Bug ID CSCuw31632...

CVE-2015-6310

The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.51 allows remote attackers to cause a denial of service SIP proxy service restart via a crafted HTTP request, aka Bug ID CSCuw31632...

Tor Cloud Shut Down Amid Lack of Support

The Tor Project has shuttered its cloud proxy service citing security vulnerabilities, usability bugs and a lack of resources. Tor offers its users the capacity to surf the Web anonymously, bouncing traffic through a series of relay servers so that no observer at any point can tell where that...

iOS, OS X Library AFNetwork Patches MiTM Vulnerability

Until yesterday, a popular networking library for iOS and OS X used in apps such as Pinterest and Simple was susceptible to SSL man-in-the-middle MiTM attacks. The developer behind the framework AFNetworking on Thursday pushed a fix for the issue, a logic flaw. The flaw had lingered in the wild f...

PostMaster 3.16/3.17 Proxy Service Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9055/info PostMaster has been reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization that is performed by the proxy service on user-supplied data. An...

Factlink: Proxy service crash DoS

Sending certain URLs to the proxy appears to crash the service, leading to a 502 Bad Gateway from nginx, presumably until the service is restarted. The following sequence sent in a short period appears to cause the crash it could just be the javascript:confirm request, as the last request receive...

[SECURITY] Fedora 18 Update: haproxy-1.4.24-1.fc18

HA-Proxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread the load among several servers while assuring server persistence through the use of HTTP cookies - switch t...

Russian Web proxy with backdoors, Distributing malware

Antivirus company Symantec has detected a malicious campaign in which hackers managed to deceive thousands of people allegedly signed by a paid proxy service. They expose that hundreds of thousands of users signing up for a cheap and supposedly legitimate proxy service have ended up downloading...

Stack overflow

Stack-based buffer overflow in the HTTP proxy service in Alcatel-Lucent OmniVista 4760 server before R5.1.06.03.cPatch3 allows remote attackers to execute arbitrary code or cause a denial of service service crash via a long request...

Symantec Gateway Products DNS Cache Poisoning (CVE-2005-0817)

The Symantec Firewall has a DNS proxy service, DNSD.exe, that acts as a proxy and cache server for the DNS requests generated by internal systems. When the DNS proxy receives a DNS response from a DNS server, the information in the Authoritative and Additional Record will be saved in the DNS cach...

Goole WAP Open Proxy Vulnerability

SVRT-08-08 Google Wap Proxy Vulnerability can be exploited by Hackers to attack Internet Users 1. General Information On 15 December 2008, SVRT-BKIS, from BKIS Center, has found a vulnerability in the Wap Proxy service of Google, which allows hackers to cheat Internet users. With this flaw, users...