Squid < 3.5.17, 4.0.9 Multiple Vulnerabilities

Binary data 802013.prm...

The vulnerability of the Windows operating system allows a hacker to intercept network traffic or bypass the Enhanced Protected Mode (EPM) or application’s security mechanisms. As a result, unauthorized content can be displayed in the browser.

The vulnerability of the Windows operating system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to intercept network traffic or bypass the Enhanced Protected Mode EPM or application security mechanisms. As a result, unauthorized content can be...

HackerOne: Ability to monitor reports' submission in real time

Hey , I would like to report an issue with the server responses that allow anyone users to monitor and track the reports' submission and the platform activity . Description : The issue occurs on the endpoint '/reports/reportid.json' due to the difference between server responses for submitted...

[SECURITY] [DLA 588-1] mongodb security update

Package : mongodb Version : 2.0.6-1+deb7u1 CVE ID : CVE-2016-6494 Debian Bug : 832908, 833087 Two security related problems have been found in the mongodb package, related to logging. CVE-2016-6494 World-readable .dbshell history file TEMP-0833087-C5410D Bruteforcable challenge responses in...

The vulnerability of the Firefox browser, which allows a remote attacker to bypass certificate verification

The vulnerability of the Firefox browser in handling alternative HTTP services allows a malicious actor to bypass the X.509 certificate verification for SSL servers by modifying the server address in the uri-host header of the HTTP/2 response...

The vulnerability of the PowerDNS software allows a malicious actor to compromise the accessibility of protected information.

The vulnerability in commonstartup.cc of PowerDNS referred to as pdns allows malicious actors operating remotely to cause service failures packet loss by using specially crafted UDP DNS responses...

The vulnerability of Samba software allows a remote attacker to compromise the accessibility of protected information.

The vulnerability exists in the internal Samba DNS server due to the lack of checking the QR field in the header of the incoming DNS request before sending the response. Exploiting this vulnerability allows malicious actors to cause service failures excessive CPU usage and reduced bandwidth...

The vulnerability of the Oracle Fusion Middleware software platform allows a malicious actor to inject arbitrary data into the context of a vulnerable application.

The vulnerability of the Oracle Containers component for the J2EE software platform, Oracle Fusion Middleware, is related to an error that occurs due to insufficient checking of values in HTTP headers. Exploiting this vulnerability allows a malicious actor to generate a forged HTTP response and...

CVE-2016-2882

IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to obtain sensitive information by reading HTTP responses...

UBUNTU-CVE-2016-5301

The parsechunkheader function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service crash via a crafted 1 HTTP response or possibly a 2 UPnP broadcast...

USN-3009-1 dnsmasq vulnerability

Edwin Török discovered that Dnsmasq incorrectly handled certain CNAME responses. A remote attacker could use this issue to cause Dnsmasq to crash, resulting in a denial of service...

GLSA-201606-07 : dhcpcd: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201606-07 dhcpcd: Multiple vulnerabilities A heap overflow can be triggered via malformed DHCP responses in the printoption via dhcpenvoption1 due to incorrect option length values. These vulnerabilities could also allow remote...

Gratipay: set Pragma header

Data returned in web responses can be cached by user's browsers as well as by intermediate proxies. This directive instructs them not to retain the page content in order to prevent others from accessing sensitive content from these caches...

CVE-2016-3213

The Web Proxy Auto Discovery WPAD protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 9 through 11 has an improper fallback mechanis...

Amazon Linux AMI : squid (ALAS-2016-713)

A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. CVE-2016-4051 Buffer overflow and input validation flaws were found ...

Medium: squid

Issue Overview: A buffer overflow flaw was found in the way the Squid cachemgr.cgi utility processed remotely relayed Squid input. When the CGI interface utility is used, a remote attacker could possibly use this flaw to execute arbitrary code. CVE-2016-4051 Buffer overflow and input validation...

Microsoft Windows WPAD Proxy Discovery Elevation of Privilege (MS16-077; CVE-2016-3236)

An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to improper handling of certain proxy discovery scenarios using the Web Proxy Autodiscovery WPAD protocol method. A remote attacker can exploit this issue by sending specially crafted NBNS responses...

Ubuntu 14.04 LTS / 16.04 LTS : Squid vulnerabilities (USN-2995-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2995-1 advisory. Yuriy M. Kaminskiy discovered that the Squid pinger utility incorrectly handled certain ICMPv6 packets. A remote attacker could use this issu...

libtorrent Denial of Service Vulnerability

libtorrent is an open source C++ Bittorrent library developed by software developer Arvid Norberg, which provides high performance and good code style of the BT development kit, and supports crawling file pages directly through the network stack. A security vulnerability exists in the...

WAFW00F - Identifies and Fingerprints Web Application Firewall (WAF) Products

WAFW00F allows one to identify and fingerprint Web Application Firewall WAF products protecting a website. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions If that is not successful, it...