VAR-200903-0335
Vulnerability from variot - Updated: 2025-04-10 22:15Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header. Proxy servers running in interception mode ("transparent" proxies) that make connection decisions based on HTTP header values may be used by an attacker to relay connections. Ziproxy Is used to determine the remote endpoint when transparent blocking mode is enabled. Ziproxy is prone to a security bypass vulnerability.
SOLUTION: As a workaround, the vendor recommends to "configure Guardian to block their internal web servers without passwords using hostname and IPaddress". ----------------------------------------------------------------------
Did you know? Our assessment and impact rating along with detailed information such as exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list?
Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/
Click here to trial our solutions: http://secunia.com/advisories/try_vi/
TITLE: Ziproxy HTTP "Host:" Header Security Bypass
SECUNIA ADVISORY ID: SA34018
VERIFY ADVISORY: http://secunia.com/advisories/34018/
DESCRIPTION: A security issue has been reported in Ziproxy, which can be exploited by malicious people to bypass certain security restrictions.
The security issue is caused due to the application relying on HTTP "Host:" headers when acting as transparent proxy. This can be exploited to e.g.
Successful exploitation requires that the attacker can forge the HTTP "Host:" header (e.g. via active content).
The security issue is reported in version 2.6.0. Other versions may also be affected.
SOLUTION: The vendor recommends to use a proxy server with better security capabilities between clients and Ziproxy. Use a firewall to restrict access to untrusted websites.
PROVIDED AND/OR DISCOVERED BY: US-CERT credits Robert Auger, PayPal Information Risk Management team.
ORIGINAL ADVISORY: US-CERT VU#435052: http://www.kb.cert.org/vuls/id/435052
http://www.kb.cert.org/vuls/id/MAPG-7N9GN8
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
SOLUTION: The vendor has published workarounds. See the vendor's advisory for additional information
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200903-0335",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ziproxy",
"scope": "eq",
"trust": 2.4,
"vendor": "ziproxy",
"version": "2.6.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "apple computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "astaro",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "blue coat",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "internet initiative",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "qbik new zealand",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "smoothwall",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "squid",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ziproxy",
"version": null
},
{
"model": "ziproxy",
"scope": "eq",
"trust": 0.3,
"vendor": "ziproxy",
"version": "2.6"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#435052"
},
{
"db": "BID",
"id": "79570"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
},
{
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:ziproxy:ziproxy",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Robert Auger from the PayPal Information Risk Management team",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
}
],
"trust": 0.6
},
"cve": "CVE-2009-0804",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "CVE-2009-0804",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2009-0804",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#435052",
"trust": 0.8,
"value": "3.54"
},
{
"author": "NVD",
"id": "CVE-2009-0804",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200903-070",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#435052"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
},
{
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header. Proxy servers running in interception mode (\"transparent\" proxies) that make connection decisions based on HTTP header values may be used by an attacker to relay connections. Ziproxy Is used to determine the remote endpoint when transparent blocking mode is enabled. Ziproxy is prone to a security bypass vulnerability. \n\nSOLUTION:\nAs a workaround, the vendor recommends to \"configure Guardian to\nblock their internal web servers without passwords using hostname and\nIPaddress\". ----------------------------------------------------------------------\n\nDid you know? Our assessment and impact rating along with detailed\ninformation such as exploit code availability, or if an updated patch\nis released by the vendor, is not part of this mailing-list?\n \nClick here to learn more about our commercial solutions:\nhttp://secunia.com/advisories/business_solutions/\n \nClick here to trial our solutions:\nhttp://secunia.com/advisories/try_vi/\n\n----------------------------------------------------------------------\n\nTITLE:\nZiproxy HTTP \"Host:\" Header Security Bypass\n\nSECUNIA ADVISORY ID:\nSA34018\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/34018/\n\nDESCRIPTION:\nA security issue has been reported in Ziproxy, which can be exploited\nby malicious people to bypass certain security restrictions. \n\nThe security issue is caused due to the application relying on HTTP\n\"Host:\" headers when acting as transparent proxy. This can be\nexploited to e.g. \n\nSuccessful exploitation requires that the attacker can forge the HTTP\n\"Host:\" header (e.g. via active content). \n\nThe security issue is reported in version 2.6.0. Other versions may\nalso be affected. \n\nSOLUTION:\nThe vendor recommends to use a proxy server with better security\ncapabilities between clients and Ziproxy. Use a firewall to restrict\naccess to untrusted websites. \n\nPROVIDED AND/OR DISCOVERED BY:\nUS-CERT credits Robert Auger, PayPal Information Risk Management\nteam. \n\nORIGINAL ADVISORY:\nUS-CERT VU#435052:\nhttp://www.kb.cert.org/vuls/id/435052\n\nhttp://www.kb.cert.org/vuls/id/MAPG-7N9GN8\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nSOLUTION:\nThe vendor has published workarounds. See the vendor\u0027s advisory for\nadditional information",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-0804"
},
{
"db": "CERT/CC",
"id": "VU#435052"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"db": "BID",
"id": "79570"
},
{
"db": "PACKETSTORM",
"id": "75119"
},
{
"db": "PACKETSTORM",
"id": "75100"
},
{
"db": "PACKETSTORM",
"id": "75126"
},
{
"db": "PACKETSTORM",
"id": "75099"
},
{
"db": "PACKETSTORM",
"id": "75373"
}
],
"trust": 3.06
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#435052",
"trust": 4.0
},
{
"db": "NVD",
"id": "CVE-2009-0804",
"trust": 2.7
},
{
"db": "BID",
"id": "33858",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2009-005863",
"trust": 0.8
},
{
"db": "CERT/CC",
"id": "US-CERT",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200903-070",
"trust": 0.6
},
{
"db": "BID",
"id": "79570",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "34014",
"trust": 0.2
},
{
"db": "SECUNIA",
"id": "34020",
"trust": 0.2
},
{
"db": "SECUNIA",
"id": "34018",
"trust": 0.2
},
{
"db": "SECUNIA",
"id": "34019",
"trust": 0.2
},
{
"db": "SECUNIA",
"id": "34064",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "75119",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "75100",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "75126",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "75099",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "75373",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#435052"
},
{
"db": "BID",
"id": "79570"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"db": "PACKETSTORM",
"id": "75119"
},
{
"db": "PACKETSTORM",
"id": "75100"
},
{
"db": "PACKETSTORM",
"id": "75126"
},
{
"db": "PACKETSTORM",
"id": "75099"
},
{
"db": "PACKETSTORM",
"id": "75373"
},
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
},
{
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"id": "VAR-200903-0335",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.19642857
},
"last_update_date": "2025-04-10T22:15:55.273000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Ziproxy",
"trust": 0.8,
"url": "http://ziproxy.sourceforge.net/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "http://www.kb.cert.org/vuls/id/435052"
},
{
"trust": 2.0,
"url": "http://www.kb.cert.org/vuls/id/mapg-7n9gn8"
},
{
"trust": 1.9,
"url": "http://www.securityfocus.com/bid/33858"
},
{
"trust": 0.8,
"url": "http://www.thesecuritypractice.com/the_security_practice/transparentproxyabuse.pdf"
},
{
"trust": 0.8,
"url": "http://www.ietf.org/rfc/rfc2616.txt"
},
{
"trust": 0.8,
"url": "http://www.webappsec.org/lists/websecurity/archive/2008-06/msg00073.html"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/reading_room/securing_browser/"
},
{
"trust": 0.8,
"url": "http://kb.adobe.com/selfservice/viewcontent.do?externalid=tn_14213"
},
{
"trust": 0.8,
"url": "http://www.w3.org/protocols/rfc2616/rfc2616-sec9.html"
},
{
"trust": 0.8,
"url": "http://www.owasp.org/index.php/testing_for_http_methods_and_xst_(owasp-cm-008)#black_box_testing_and_example"
},
{
"trust": 0.8,
"url": "http://en.wikipedia.org/w/index.php?title=list_of_tcp_and_udp_port_numbers\u0026oldid=266934839"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-0804"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-0804"
},
{
"trust": 0.5,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.5,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.5,
"url": "http://secunia.com/advisories/try_vi/"
},
{
"trust": 0.5,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.5,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34014/"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/mapg-7m6sm7"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34020/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34018/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34019/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34064/"
},
{
"trust": 0.1,
"url": "https://hypersonic.bluecoat.com/support/securityadvisories/proxysg_in_transparent_deployments"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#435052"
},
{
"db": "BID",
"id": "79570"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"db": "PACKETSTORM",
"id": "75119"
},
{
"db": "PACKETSTORM",
"id": "75100"
},
{
"db": "PACKETSTORM",
"id": "75126"
},
{
"db": "PACKETSTORM",
"id": "75099"
},
{
"db": "PACKETSTORM",
"id": "75373"
},
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
},
{
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#435052"
},
{
"db": "BID",
"id": "79570"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"db": "PACKETSTORM",
"id": "75119"
},
{
"db": "PACKETSTORM",
"id": "75100"
},
{
"db": "PACKETSTORM",
"id": "75126"
},
{
"db": "PACKETSTORM",
"id": "75099"
},
{
"db": "PACKETSTORM",
"id": "75373"
},
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
},
{
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-02-23T00:00:00",
"db": "CERT/CC",
"id": "VU#435052"
},
{
"date": "2009-03-04T00:00:00",
"db": "BID",
"id": "79570"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"date": "2009-02-23T14:11:04",
"db": "PACKETSTORM",
"id": "75119"
},
{
"date": "2009-02-23T12:27:14",
"db": "PACKETSTORM",
"id": "75100"
},
{
"date": "2009-02-24T15:54:02",
"db": "PACKETSTORM",
"id": "75126"
},
{
"date": "2009-02-23T12:27:11",
"db": "PACKETSTORM",
"id": "75099"
},
{
"date": "2009-03-04T15:05:53",
"db": "PACKETSTORM",
"id": "75373"
},
{
"date": "2009-03-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200903-070"
},
{
"date": "2009-03-04T16:30:00.250000",
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-09-28T00:00:00",
"db": "CERT/CC",
"id": "VU#435052"
},
{
"date": "2009-03-04T00:00:00",
"db": "BID",
"id": "79570"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-005863"
},
{
"date": "2009-06-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200903-070"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2009-0804"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Intercepting proxy servers may incorrectly rely on HTTP headers to make connections",
"sources": [
{
"db": "CERT/CC",
"id": "VU#435052"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200903-070"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…