CVE-2018-11759

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...

CVE-2018-11759

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...

CVE-2018-11759: Improper Limitation of a Pathname to a Restricted Directory

The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was...

Shopify: Reverse Proxy misroute leading to steal X-Shopify-Access-Token header

Hello Shopify team! I found out that on /admin/api/graphql endpoint server fetches content of Host header value $HTTPHost + /admin/api/graphql. If my own host was sent to server, request comes from ██████████or ██████████ your google cloud cluster. Also I can grab all reverse proxy headers...

[SECURITY] Fedora 28 Update: haproxy-1.8.14-1.fc28

HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...

[SECURITY] Fedora 29 Update: haproxy-1.8.14-1.fc29

HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...

USN-3780-1: HAProxy vulnerability

It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service...

Containous Traefik API Disclosure

The vulnerability of the Containous Traefik reverse proxy server’s API is related to implementation errors in the API. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

FreeBSD : grafana -- LDAP and OAuth login vulnerability (1f8d5806-ac51-11e8-9cb6-10c37b4ac2ea)

Grafana Labs reports : On the 20th of August at 1800 CEST we were contacted about a potential security issue with the 'remember me' cookie Grafana sets upon login. The issue targeted users without a local Grafana password LDAP & OAuth users and enabled a potential attacker to generate a valid...

Chaturbate: Web cache deception attack - expose token information

Hello, I have found new Vulnerability in your website which called Web cache deception attack. It's found first time in Paypal. Web Cache Deception Attack Websites often tend to use web cache functionality to store files that are often retrieved, to reduce latency from the web server. Let's see a...

grafana -- LDAP and OAuth login vulnerability

Grafana Labs reports: On the 20th of August at 1800 CEST we were contacted about a potential security issue with the “remember me” cookie Grafana sets upon login. The issue targeted users without a local Grafana password LDAP & OAuth users and enabled a potential attacker to generate a valid cook...

CVE-2018-10512

A vulnerability in Trend Micro Control Manager versions 6.0 and 7.0 could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server DoS...

Design/Logic Flaw

A vulnerability in Trend Micro Control Manager versions 6.0 and 7.0 could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server DoS...

CVE-2018-10512

A vulnerability in Trend Micro Control Manager versions 6.0 and 7.0 could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server DoS...

CVE-2018-10512

A vulnerability in Trend Micro Control Manager versions 6.0 and 7.0 could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server DoS...

PT-2018-9934

Name of the Vulnerable Software and Affected Versions: Trend Micro Control Manager versions 6.0 through 7.0 Description: A vulnerability could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, potentially leading to a denial of server DoS. Recommendations: For...

CVE-2018-10512: Undefined Security Weakness

A vulnerability in Trend Micro Control Manager versions 6.0 and 7.0 could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, which may lead to a denial of server DoS...

[SECURITY] Fedora 28 Update: haproxy-1.8.12-2.fc28

HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...

Mesosphere Marathon Web UI Public WAN (Internet) / Public LAN Accessible

The script checks if the Mesosphere Marathon Web UI is accessible from a public WAN Internet / public LAN. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Security Bulletin: TLS padding vulnerability affects Tivoli Access Manager for e-business and IBM Security Access Manager for Web (CVE-2014-8730)

Summary IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web are affected by a TLS padding vulnerability, which could allow a remote attacker to obtain sensitive information. Vulnerability Details The following vulnerability affects both IBM Tivoli Access Manager for...