PT-2024-2610 · Apache · Apache Pulsar

Name of the Vulnerable Software and Affected Versions: Apache Pulsar versions 2.6.0 through 2.10.5 Apache Pulsar versions 2.11.0 through 2.11.2 Apache Pulsar versions 3.0.0 through 3.0.1 Apache Pulsar version 3.1.0 Description: The issue is related to an improper authentication vulnerability in t...

PT-2024-2415 · Artica · Artica Proxy

Name of the Vulnerable Software and Affected Versions: Artica-Proxy affected versions not specified Description: The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. ...

Trend Micro uiAirSupport Security Vulnerability

Trend Micro uiAirSupport is a Trend Micro support tool for Trend Micro customers who subscribe to our Premium Services. A security vulnerability exists in Trend Micro uiAirSupport 6.0.2092 and prior versions, which stems from vulnerability to a DLL hijacking/proxy vulnerability that could be...

CVE-2024-0308 Inis Proxy.php server-side request forgery

A vulnerability was found in Inis up to 2.0.1. It has been rated as critical. This issue affects some unknown processing of the file app/api/controller/default/Proxy.php. The manipulation of the argument purl leads to server-side request forgery. The attack may be initiated remotely. The exploit...

CVE-2023-49782 Cross-Site-Scripting vulnerability in error message passing in richdocumentscode

Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online - Built-in CODE Server app can be vulnerable to attack via proxy.php. The bug was fixed in Collabora Online - Built-in CODE Server richdocumentscode release 23.5.601...

CVE-2023-48314 Unescaped passing of the request URL in Collabora Online

Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in CODE Server app can be vulnerable to attack via proxy.php. This vulnerability has been fixed in Collabora Online - Built-in CODE Server richdocumentscode...

The vulnerability of the Squid proxy server is related to improper conversion between numerical types and uncontrolled resource consumption, allowing attackers to cause service failures.

The vulnerability of the Squid proxy server is related to the issue of sending FTP URL addresses in HTTP requests, or creating FTP URL addresses from input data of the FTP Native. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the proxy server of the Zscaler Client Connector allows attackers to circumvent security restrictions and gain increased privileges.

The vulnerability of the Zscaler Client Connector software proxy relates to the unlimited download of dangerous files. Exploiting this vulnerability can allow a hacker to bypass security restrictions and enhance their privileges by sending specially crafted requests...

The vulnerability of the CSI Proxy component of the Kubernetes cluster management software allows a hacker to increase their privileges.

The vulnerability of the CSI Proxy component, a software tool for managing virtual machine clusters in Kubernetes, is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability that originates from a messy proxy in the setMetadata module of MediaSessionRecord.java, which can be exploited by an attacker to obtain sensitive...

The vulnerability of the Envoy proxy server, related to insufficient validation of input data, allows attackers to bypass authentication procedures and gain unauthorized access to protected information.

The vulnerability of the Envoy proxy server is related to insufficient validation of input data during the processing of the x-envoy-original-path header. Exploiting this vulnerability allows a malicious actor to bypass authentication using a JSON Web Token JWT and gain unauthorized access to...

DEBIAN-CVE-2023-25950

HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service DoS condition...

K30525503: BIG-IP APM Edge Client proxy vulnerability CVE-2022-23032

Security Advisory Description When proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS rebinding attack. CVE-2022-23032 Impact DNS rebinding allows external attackers to bypass the same-origin...

SUSE CVE-2010-0408

The approxyajprequest function in modproxyajp.c in modproxyajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service backend server outage via a crafted request,...

SUSE CVE-2011-3061

Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate...

SUSE CVE-2018-6560

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon...

Apache ShardingSphere 安全漏洞

Apache ShardingSphere is an open source distributed database middleware solution from the Apache Foundation. A security vulnerability exists in Apache ShardingSphere-Proxy versions prior to 5.3.0, which stems from the fact that when using MySQL as a database backend, the database session is not...

Proxmox pve-http-server 代码问题漏洞

pve-http-server is an open source virtualization environment library from Proxmox. A security vulnerability exists in Proxmox pve-http-server, which stems from an SSRF vulnerability when proxying HTTP requests between pvepmgproxy and pvepmgdaemon, where an attacker with an unprivileged account ca...

CVE-2022-33681 Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM

Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from the Pulsar Java Client to the Pulsar Broker/Proxy and connections from the Pulsar Proxy to the Pulsar Broker are vulnerable. Authentication...

CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All...