CVSS: 9.1EPSS: 11%CPEs: 4EXPL: 4CVE-2015-5400 – Debian Security Advisory 3327-1
https://notcve.org/view.php?id=CVE-2015-5400
04 Aug 2015 — Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request. Vulnerabilidad en Squid en versiones anteriores a 3.5.6, no maneja adecuadamente las respuestas de pares del método CONNECT cuando se configura con cache_peer, lo que permite a atacantes remotos eludir las restricciones previstas y obtener acceso a un proxy backend a través de una sol... • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.9EPSS: 6%CPEs: 73EXPL: 0CVE-2015-3455 – squid: incorrect X509 server certificate validation (SQUID-2015:1)
https://notcve.org/view.php?id=CVE-2015-3455
06 May 2015 — Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate. Squid 3.2.x en versiones anteriores a 3.2.14, 3.3.x en versiones anteriores a 3.3.14, 3.4.x en versiones anteriores a 3.4.13 y 3.5.x en versiones anteriores a 3.5.4, cuando el primer cliente está configurado me... • http://advisories.mageia.org/MGASA-2015-0191.html • CWE-20: Improper Input Validation CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 4.7EPSS: 1%CPEs: 1EXPL: 0CVE-2015-0881
https://notcve.org/view.php?id=CVE-2015-0881
20 Feb 2015 — CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response. Una vulnerabilidad de inyección CRLF en Squid anterior a versión 3.1.1, permite a los atacantes remotos inyectar encabezados HTTP arbitrarios y conducir ataques de división de respuesta HTTP por medio de un encabezado diseñado en una respuesta. • http://jvn.jp/en/jp/JVN64455813/index.html •
CVSS: 7.5EPSS: 77%CPEs: 80EXPL: 0CVE-2014-7141 – Gentoo Linux Security Advisory 201411-11
https://notcve.org/view.php?id=CVE-2014-7141
26 Nov 2014 — The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet. El módulo pinger en Squid 3.x anterior a 3.4.8 permite a atacantes remotos obtener información sensible o causar una denegación de servicio (lectura fuera de rango y caída) a través de un tipo manipulado en un paquete (1) ICMP o (2) ICMP6. Due to incorrect state management, Squid before 3.3.12 is vulner... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-19: Data Processing Errors •
CVSS: 7.5EPSS: 64%CPEs: 83EXPL: 0CVE-2014-7142 – Gentoo Linux Security Advisory 201411-11
https://notcve.org/view.php?id=CVE-2014-7142
26 Nov 2014 — The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size. El módulo pinger en Squid 3.x anterior a 3.4.8 permite a atacantes remotos obtener información sensible o causar una denegación de servicio (caída) a través de un tamaño de paquete (1) ICMP o (2) ICMP6 manipulado. Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing cert... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 20%CPEs: 181EXPL: 0CVE-2014-6270 – Gentoo Linux Security Advisory 201607-01
https://notcve.org/view.php?id=CVE-2014-6270
12 Sep 2014 — Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow. Error de superación de límite (off-by-one) en la función snmpHandleUdp en snmp_core.cc en Squid 2.x y 3.x, cuando un puerto SNMP está configurado, permite a atacantes remotos causar una denegación de servicio (caída) o po... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 75%CPEs: 88EXPL: 0CVE-2014-3609 – squid: assertion failure in Range header processing (SQUID-2014:2)
https://notcve.org/view.php?id=CVE-2014-3609
28 Aug 2014 — HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values." HttpHdrRange.cc en Squid 3.x anterior a 3.3.12 y 3.4.x anterior a 3.4.6 permite a atacantes remotos causar una denegación de servicio (caída) a través de una solicitud con ' cabeceras de rango con valores de rango de bytes no identificables' manipuladas. A flaw was found in the way Squid handled malfor... • http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00025.html • CWE-20: Improper Input Validation CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 55%CPEs: 87EXPL: 0CVE-2014-0128 – squid: denial of service when using SSL-Bump
https://notcve.org/view.php?id=CVE-2014-0128
14 Apr 2014 — Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. Squid 3.1 anterior a 3.3.12 y 3.4 anterior a 3.4.4, cuando SSL-Bump está habilitado, permite a atacantes remotos causar una denegación de servicio (fallo de aserción) a través de una solicitud de rango manipulada, relacionado con gestión de estado. Due to incorrect state management, Squid before 3.3.12 is vu... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 37%CPEs: 32EXPL: 0CVE-2013-1839 – Gentoo Linux Security Advisory 201309-22
https://notcve.org/view.php?id=CVE-2013-1839
27 Sep 2013 — The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header. La función strHdrAcptLangGetItem en errorpage.cc de Squid 3.2.x (anteriores a 3.2.9) y 3.3.x (anteriores a 3.3.3) permite a un atacante remoto causar una denegación de servicio (bucle infinito y consumo de CPU) a través de un caracter "," en la cabecera Accept-Language. ... • http://archives.neohapsis.com/archives/bugtraq/2013-03/0025.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 76%CPEs: 42EXPL: 1CVE-2013-4123 – Squid 3.3.5 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2013-4123
16 Sep 2013 — client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header. client_side_request.cc en Squid 3.2.x anteriores a 3.2.13 y 3.3.x anteriores a 3.3.8 permite a un atacante remoto causar una denegación de servicio a través de un número de puerto manipulado en una cabecera HTTP Host. Multiple vulnerabilities have been found in Squid, possibly resulting in remote Denial of Service. Versions less than... • https://www.exploit-db.com/exploits/26886 • CWE-20: Improper Input Validation •