PT-2021-4081 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.7 and later Description: The issue is related to incorrect authorization in the Dependency Proxy component of GitLab, allowing a remote attacker to potentially impact data integrity. Under certain circumstances, the...

The vulnerability of the NDP Proxy component in the JunOS operating system allows a hacker to trigger a maintenance failure.

The vulnerability of the NDP Proxy component in the JunOS operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

@acanto/october-scripts (=3.2.2), @acanto/workflow (=5.1.0) +1213 more potentially affected by unknown CVE via http-proxy (>=0.10.0 <=1.18.0)

http-proxy NPM version =0.10.0, =2018.7.11-0, =0.0.1, =0.156.0, =2.6.6, =4.0.0, =3.0.1, =0.0.1, =1.12.2-next.3, =1.0.0, =1.0.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-6X33-PW7P-HMPQ...

CVE-2020-13223

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2...

ZNC Code Issue Vulnerability

ZNC is a set of IRC proxies that allow users to log in to IRC servers from their workstations. A code issue vulnerability exists in ZNC 1.8.0 and later fixed in version 1.8.1-rc1. An attacker can exploit this vulnerability to cause the application to crash when echo-message is not enabled and no...

CVE-2020-11077

CVE-2020-11077 affects the Puma RubyGem HTTP server. It describes an HTTP request/response smuggling scenario where a proxy with persistent connections and HTTP pipelining can cause the proxy to deliver a second response to the wrong client, due to how Puma parses the first request and its body. ...

GHSA-PC5P-H8PF-MVWP Machine-In-The-Middle in https-proxy-agent

Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept...

CVE-2019-12520

An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...

UBUNTU-CVE-2020-1934

In Apache HTTP Server 2.4.0 to 2.4.41, modproxyftp may use uninitialized memory when proxying to a malicious FTP server...

Request smuggling is possible when both chunked TE and content length specified

Impact Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator. Patches https://github.com/ktorio/ktor/pull/1547 Workarounds None except migrating to a better proxy. References...

ELOG Unintended Proxy Vulnerability

ELOG is a web application written in C for creating personal and general purpose logs. An unintended proxy vulnerability exists in ELOG 3.1.4-57bea22 and earlier versions, which can be exploited by an unauthenticated, remote attacker by sending a specially crafted HTTP POST request that uses ELOG...

AZL-36963 CVE-2016-1000104 affecting package mod_fcgid 2.3.9-21

A security Bypass vulnerability exists in the FcgidPassHeader Proxy in modfcgid through 2016-07-07...

CVE-2019-1884

A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input validation mechanisms for...

The vulnerability of the Cisco Wide Area Application Services Software’s proxy server is related to authentication errors when requesting connections to the HTTPS proxy server. This vulnerability allows a hacker to use the WAAS Central Manager as an HTTPS proxy server.

The vulnerability of the Cisco Wide Area Application Services Software’s proxy server is related to authentication errors when requesting connections to the HTTPS proxy server. Exploiting this vulnerability allows a malicious actor to use the WAAS Central Manager as an HTTPS proxy server by sendi...

CVE-2019-1876

A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services WAAS Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could...

Cisco Wide Area Application Services (WAAS) HTTPS Proxy Authentication Bypass Vulnerability

Cisco Wide Area Application Services WAAS is a comprehensive WAN optimization solution that improves the performance of applications running in WAN environments, delivers video to branch offices and locally hosts branch office IT services. An authentication bypass vulnerability exists in the HTTP...

CVE-2018-18506

CVE-2018-18506 is a PAC-related issue where a PAC file can cause localhost requests to be proxied. Connected documents confirm Thunderbird is affected and publicly patched: Thunderbird 60.6.1 fixes were released across AL2 (ALAS2-2019-1195), CentOS/RHEL advisories (RHSA-2019:0680/0681), and Debia...

python-kdcproxy denial of service vulnerability

python-kdcproxy is a WSGI module. A security vulnerability exists in python-kdcproxy versions prior to 0.3.2. A remote attacker can exploit this vulnerability by sending a specially crafted POST request to cause a denial of service...

The vulnerability of the Squid proxy server, related to accessing beyond the allocated buffer memory, allows attackers to cause a service failure.

The vulnerability of the Squid proxy server is related to an error that causes data to exceed the allocated memory buffer when processing ESI responses or loading certificates from intermediate certification centers. Exploiting this vulnerability can allow a malicious actor to cause service...

proxy request handling in kube-apiserver can leave vulnerable TCP connections

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.8, critical With a specially crafted request, users that are authorized to establish a connection through the Kubernetes API server to a backend server can then send arbitrary requests over the same connection directly to that backend, authenticated...