101 matches found
CVE-2026-15970
A flaw was found in Consul. When a service proxy is configured with a custom public listener, an authenticated user within the mesh network can bypass Layer 7 L7 authorization intentions. This allows the user to access HTTP paths that should be blocked, potentially leading to unauthorized...
CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
DEBIAN-CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
UBUNTU-CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
CVE-2026-15970
Summary: CVE-2026-15970 affects Consul Community Edition 1.20.1–2.0.2 and Consul Enterprise; an L7 intention authorization bypass occurs when a service proxy uses a custom public listener, allowing an authenticated mesh workload to access HTTP paths blocked by a path-based deny intention. Impact ...
CVE-2026-17107
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...
CVE-2026-17107 Cluster-proxy: cluster-proxy: impersonation header injection in service-proxy grants cluster-admin on every managed cluster
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...
CVE-2026-17107
The CVE describes a flaw in the cluster-proxy service-proxy component used by Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without removing caller-supplied values, and the spoke ...
EUVD-2026-48728
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...
PT-2026-64408
Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes RHACM affected versions not specified multicluster-engine MCE affected versions not specified Description A flaw exists in the cluster-proxy service-proxy component. The service-proxy appends...
GO-2026-5616 S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy
S3-Proxy has Security Issues in its Resource Path Matching Implementation in github.com/oxyno-zeta/s3-proxy...
Authentication Bypass
s3-proxy is vulnerable to Authentication Bypass. The vulnerability is due to inconsistent URL path interpretation between the authentication middleware and bucket handler, which allows an attacker to bypass access controls and perform unauthorized operations on protected S3 objects...
CVE-2023-45660
Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0...
CVE-2025-66631
CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer NDCS and is vulnerable to remote code execution during deserialization...
OpenVPN 安全漏洞
OpenVPN is a software package for creating encrypted tunnels for Virtual Private Networks VPNs from US-based OpenVPN, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...
CVE-2025-59514 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
...
CVE-2025-59514 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
...
KLA90057 Multiple vulnerabilities in Microsoft Products (ESU)
Multiple vulnerabilities were found in Microsoft Products Extended Security Update. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, bypass security restrictions, execute arbitrary code, read local files, cause denial of service. Below is a...