CVSS: 6.1EPSS: 85%CPEs: 2EXPL: 1CVE-2019-13345 – squid: XSS via user_name or auth parameter in cachemgr.cgi
https://notcve.org/view.php?id=CVE-2019-13345
05 Jul 2019 — The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. El modulo web del archivo cachemgr.cgi de Squid hasta versión 4.7, presenta un problema de tipo XSS por medio del parámetro user_name o auth. It was discovered that Squid incorrectly handled certain SNMP packets. A remote attacker could possibly use this issue to cause memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00067.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19131
https://notcve.org/view.php?id=CVE-2018-19131
09 Nov 2018 — Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. Squid en versiones anteriores a la 4.4 tiene Cross-Site Scripting (XSS) mediante un certificado X.509 manipulado durante la generación de la página de error HTTP(S) para los errores de certificado. • https://github.com/JonathanWilbur/CVE-2018-19131 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 1%CPEs: 2EXPL: 0CVE-2018-19132 – Ubuntu Security Notice USN-4059-1
https://notcve.org/view.php?id=CVE-2018-19132
09 Nov 2018 — Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet. Squid en versiones anteriores a la 4.4, cuando está habilitado SNMP, permite una denegación de servicio (fuga de memoria) mediante un paquete SNMP. It was discovered that Squid incorrectly handled certain SNMP packets. A remote attacker could possibly use this issue to cause memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. • http://www.squid-cache.org/Advisories/SQUID-2018_5.txt • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.5EPSS: 3%CPEs: 7EXPL: 0CVE-2018-1000027 – squid: Incorrect pointer handling in HTTP processing and certificate download can lead to denial of service
https://notcve.org/view.php?id=CVE-2018-1000027
05 Feb 2018 — The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later. Squid Software Foundation Squid HTTP Caching Proxy, en ... • http://www.squid-cache.org/Advisories/SQUID-2018_2.txt • CWE-117: Improper Output Neutralization for Logs CWE-476: NULL Pointer Dereference •
CVSS: 8.6EPSS: 46%CPEs: 15EXPL: 0CVE-2016-4553 – squid: Cache poisoning issue in HTTP Request handling
https://notcve.org/view.php?id=CVE-2016-4553
10 May 2016 — client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. client_side.cc en Squid en versiones anteriores a 3.5.18 y 4.x en versiones anteriores a 4.0.10 no ignora correctamente la cabecera Host cuando se proporciona una URI absoluta, lo que permite a atacantes remotos llevar a cabo ataques de envenenamiento de caché a través de una petición HTTP. An... • http://bugs.squid-cache.org/show_bug.cgi?id=4501 • CWE-20: Improper Input Validation CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 8.6EPSS: 0%CPEs: 7EXPL: 0CVE-2016-4554 – squid: Header Smuggling issue in HTTP Request processing
https://notcve.org/view.php?id=CVE-2016-4554
10 May 2016 — mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue. mime_header.cc en Squid en versiones anteriores a 3.5.18 permite a atacantes remotos eludir restricciones destinadas al mismo origen y posiblemente llevar a cabo ataques de envenenamiento de caché a través de una cabecera HTTP Host manipulada, también conocido como un problema "contrabando de pet... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 8.8EPSS: 4%CPEs: 154EXPL: 0CVE-2016-4051 – squid: buffer overflow in cachemgr.cgi
https://notcve.org/view.php?id=CVE-2016-4051
25 Apr 2016 — Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. Desbordamiento de buffer en cachemgr.cgi en Squid 2.x, 3.x en versiones anteriores a 3.5.17 y 4.x en versiones anteriores a 4.0.9 podría permitir a atacantes remotos provocar una denegación de servicio o ejecutar código arbitrario sembrando informes manager con datos manipulados. A buffer overfl... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 5.9EPSS: 65%CPEs: 3EXPL: 0CVE-2016-2390
https://notcve.org/view.php?id=CVE-2016-2390
19 Apr 2016 — The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message. El método FwdState::connectedToPeer en FwdState.cc en Squid en versiones anteriores a 3.5.14 y 4.0.x en versiones anteriores a 4.0.6 no maneja correctamente los errores de apretones de manos SSL cuando se construye c... • http://bugs.squid-cache.org/show_bug.cgi?id=4437 • CWE-20: Improper Input Validation •
CVSS: 8.2EPSS: 1%CPEs: 12EXPL: 0CVE-2016-3947 – Gentoo Linux Security Advisory 201607-01
https://notcve.org/view.php?id=CVE-2016-3947
07 Apr 2016 — Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet. Desbordamiento de buffer basado en memoria dinámica en la función Icmp6::Recv en icmp/Icmp6.cc en la utilidad pinger en Squid en versiones anteriores a 3.5.16 y 4.x en versiones anteriores a 4.0.8 permite a s... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 2%CPEs: 4EXPL: 4CVE-2015-5400 – Debian Security Advisory 3327-1
https://notcve.org/view.php?id=CVE-2015-5400
04 Aug 2015 — Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request. Vulnerabilidad en Squid en versiones anteriores a 3.5.6, no maneja adecuadamente las respuestas de pares del método CONNECT cuando se configura con cache_peer, lo que permite a atacantes remotos eludir las restricciones previstas y obtener acceso a un proxy backend a través de una sol... • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html • CWE-264: Permissions, Privileges, and Access Controls •