CVE-2026-101898

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

CVE-2026-101906

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

cve-2026-20896-gitea-poc

CVE-2026-20896 Gitea Docker 認証バイパスチェッカー 認可されたレッドチーム / ペンテスト運用のみ。 このリポジトリには、CVE-2026-20896 用の最小限のチェッカーが含まれています。これは、リバースプロキシ認証が有効な場合に、公式 Gitea Docker イメージ（1.26.2 までを含む）における認証バイパスです。 CVE-2026-20896 とは 影響を受ける Gitea Docker イメージには、以下の app.ini テンプレートが同梱されていました： REVERSEPROXYTRUSTEDPROXIES = 管理者が以下を有効にした場...

CVE-2026-78122-POC

CVE-2026-78122 — 개념 증명 Tecnativadocker-socket-proxy ≤ 0.5.0 — 불충분한 접근 제어 세분화CWE-1220 CVSS 4.0: 8.3 높음 — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N 공격 벡터는 인접AdjacentAV:A입니다. 공격자는 프록시에 로컬/인접 네트워크로 도달할 수 있어야 합니다. 이것이 바로 라우팅 가능한 인터페이스에서 프록시를 격리하는 것이 완화 조치의 일부인 이유입니다...

CVE-2026-43499

CVE-2026-43499 — Linux Kernel Futex PI 사용 후 해제 버그 removewaiter in kernel/locking/rtmutex.c는 slowlock 경로에서 사용되지만 futexrequeue에서 호출될 때 rtmutexstartproxylock의 프록시 잠금 롤백에도 사용됩니다. 프록시 잠금의 경우 waiter::task는 current가 아니지만 removewaiter는 잘못해서 current에 대해 동작합니다. 이로 인해 세 가지 문제가 발생합니다: 1. rbtree에서 제거가...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

CVE-2026-101898

The Axios promise-based HTTP client for the browser and Node.js is vulnerable in versions 1.13.0 through 1.20.0 . The HTTP/2 adapter fails to consistently apply configured proxy settings or caller-supplied DNS lookup policies during request setup. Specifically, an HTTPS request using httpVersion:...

CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy...

GO-2026-6517 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

kcp front-proxy does not strip inbound X-Remote- identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp...

CVE-2024-38473

Apache HTTP Server modproxy 인코딩 문제 PoC Proof of Concept 이 저장소는 Apache HTTP Server 2.4.59 및 이전 버전의 modproxy 모듈에서 발생하는 인코딩 문제를 시연하기 위한 PoCProof of Concept 스크립트를 포함하고 있습니다. 이 취약점은 잘못된 인코딩이 포함된 요청 URL이 백엔드 서비스로 전송되도록 하여, 조작된 요청을 통해 인증을 우회할 가능성이 있습니다. Table of Contents 취약점 설명 설정 및 사용법 중요 고려사항 완화 방법 취약...

Vite-CVE-2025-30208-Scanner

Vite CVE-2025-30208 の脆弱性を検出する自動化ツール。バッチスキャンと結果保存に対応しています。 機能特性 ✅ カラー端末出力 ✅ バッチターゲットスキャン（ファイルインポート対応） ✅ マルチスレッド同時検出（スレッド数調整可能） ✅ 自動で脆弱性結果を保存（タイムスタンプ付き） ✅ プロキシサーバ対応 ✅ カスタム検出パス ✅ ランダムリクエストヘッダー使用 インストールと使用方法 1. リポジトリをクローン： git clone https://github.com/marino-admin/Vite-CVE-2025-30208-Scanner.git cd...

curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker...

libcurl: libcurl: Information disclosure due to failure to clear proxy authentication credentials

A flaw was found in curl. When libcurl is instructed to clear proxy authentication credentials, it fails to do so, leaving the old credentials available. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting i...

curl: Information disclosure due to uncleared proxy authentication state

A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...

Important: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

bifrost

Bifrost 고성능 HTTP/HTTPS/SOCKS5 프록시 서버 Language: 中文 | English · Documentation site Bifrost는 Rust로 작성된 고성능, AI 친화적 프록시 서버로, Whistle에서 영감을 받았습니다. 요청 가로채기, 규칙 수정, TLS 가로채기, 스크립트 확장, 트래픽 조회, 요청 재생 및 Web UI 관리 기능을 제공합니다. 빠른 시작 CLI를 설치하며, macOS와 Windows에서는 데스크톱 App도 함께 자동 설치됩니다: 방법 1: 스크립트로 설치 macOS /...

Confluence-RCE

Использование: python3 mian.py Обнаружение Выполнение команд Обратная оболочка Reverse Shell Поддержка прокси socks5 и http Только для общения и обучения...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in http-proxy-middleware

Summary IBM DataPower Gateway has addressed multiple vulnerabilities in http-proxy-middleware in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0,...

CVE-2023-36802

CVE-2023-36802 CVE-2023-36802 ITW случай Объяснение Использование примитива перезаписи PreviousMode https://cwresearch.tistory.com/entry/Microsoft-Streaming-Service-Proxy-Elevation-of-Privilege-Vulnerability-CVE-2023-36802 Благодарности chompie Google Project 0...