Security

The Caddy web server has a vulnerability in its local admin API that allows malicious websites to replace the entire server configuration when users visit those sites.

A bug in the Caddy web server allows bypassing host-based access controls when more than 100 hostnames are configured by changing the case of letters in the Host header.

The Caddy web server has a flaw in path matching that allows attackers to bypass access controls by changing the case of URLs containing percent-encoded characters.

A bug in the Caddy web server causes mTLS client certificate authentication to silently fail when CA certificate files are missing or corrupted, accepting any system-trusted certificate instead of only the intended private CA certificates.

A vulnerability in the Caddy web server allows attackers to bypass path-based security protections by using backslashes in URLs that are not properly sanitized.

A bug in the Caddy web server allows attackers to read environment variables and file contents through specially crafted HTTP header values when using the vars_regexp feature.

A bug in Caddy's forward_auth feature allows attackers to manipulate identity headers and gain elevated privileges when the authentication service doesn't return certain headers.

Caddy's remote admin access control uses simple prefix matching for path authorization, allowing clients authorized for '/pki/ca/prod' to also access similar paths like '/pki/ca/prod-backup', bypassing intended authorization policies.

An authorization bug in Caddy's admin API allows clients to access different array elements than permitted, because authorization uses string prefix matching while path traversal parses numeric array indices.

A security vulnerability in the Caddy web server allows attackers to read environment variables and files from the server through manipulated HTTP headers, potentially exposing secrets like API keys or passwords.

A flaw in Caddy's FastCGI component incorrectly treats files without .php extensions as PHP scripts when the path contains certain Unicode characters, potentially allowing code execution through uploaded files.

Traefik proxy has a vulnerability in path-based request routing. Attackers can use URLs containing '/../' to bypass security middleware and access unauthorized backend services.

A security vulnerability was discovered in the oauth2/jws library of Traefik version 2.11.22, presenting a high security risk.

A vulnerability in the Go programming language allows HTTP request smuggling through improper handling of chunked data, which attackers can exploit to manipulate requests and bypass security controls in Traefik proxies.

Traefik proxy has a vulnerability in path-based routing that allows attackers to access protected backend services and bypass security middleware through URL-encoded path traversal attacks.

A security flaw in Traefik's WASM plugin installation allows attackers to overwrite arbitrary system files through malicious ZIP archives, potentially enabling code execution.

Traefik, a web proxy, has a path processing vulnerability that allows attackers to bypass security middleware by using URL-encoded characters in request paths, potentially gaining access to protected areas.

Traefik's NGINX provider inverts the meaning of a security setting, disabling TLS certificate verification when administrators believe it's enabled, allowing man-in-the-middle attacks on HTTPS connections.

Traefik web server has a vulnerability in automatic TLS certificate generation where attackers can permanently block system resources through incomplete connections and cause a denial-of-service attack.

A vulnerability in Traefik software affects the management of HTTP/3 connections and is rated as high severity, with no workarounds available.

A vulnerability in Traefik allows attackers to send a specific Postgres request and then stall, keeping connections open indefinitely, which leads to a denial of service attack.

Traefik proxy has a vulnerability in HTTP header processing that allows attackers to remove important identity headers like X-Real-IP through case manipulation, potentially leading to authentication and authorization bypasses in downstream services.

A flaw in Traefik allows attackers to keep TCP connections open indefinitely by sending incomplete TLS data and then stopping, which can exhaust system resources and degrade availability of all services.

Traefik proxy reads authentication server responses into memory without size limits, allowing a malicious authentication server to cause memory exhaustion and crash the service through oversized responses.

A vulnerability in Traefik's Kubernetes Gateway Provider allows attackers with write access to HTTPRoute resources to inject malicious rules through unvalidated header or query parameter values, enabling them to redirect traffic from other hostnames to their own servers.

A security vulnerability in Traefik, a web proxy and load balancer, allows attackers to compromise the system or disrupt the service.

Traefik's BasicAuth middleware has a timing vulnerability that allows attackers to enumerate valid usernames because response times differ significantly between existing and non-existing users.

Traefik has a TLS processing vulnerability where fragmented ClientHello packets can bypass SNI detection, allowing attackers to skip mutual TLS authentication and access protected services that should require client certificates.

Traefik's Kubernetes providers have a vulnerability where attackers can manipulate routing rules through special characters in hostnames or headers, potentially gaining unauthorized access to other services in multi-tenant environments.

A flaw in Traefik's authentication middleware allows authenticated attackers to impersonate other users when header names are configured in non-canonical form. Backend systems receive both the manipulated and genuine headers, typically reading the forged value first.

Traefik proxy software has a security vulnerability through a flawed gRPC-Go library where attackers can bypass authorization rules by sending HTTP/2 requests with malformed paths missing the required leading slash.

A vulnerability in Traefik's StripPrefixRegex middleware allows attackers to bypass authentication by using URL-encoded dots in paths, making protected content accessible without credentials.

A vulnerability in Traefik's ForwardAuth middleware allows attackers to bypass authentication controls by manipulating the X-Forwarded-Prefix header when Traefik is deployed behind a trusted proxy.

Traefik's authentication middleware has a vulnerability where attackers can bypass authentication by using spoofed headers with underscores instead of dashes, as only standard header names are sanitized.

Traefik's BasicAuth middleware has a timing vulnerability that allows attackers to discover valid usernames by measuring response times, as faulty code causes authentication to fail much faster for non-existent users than for existing ones.

Traefik's error pages middleware inadvertently forwards sensitive authentication data like Authorization headers and cookies to separate error page services, even though these were only intended for the original backend service.

Traefik's Kubernetes provider incorrectly bypasses namespace isolation when using Chain middleware, allowing attackers with CRD permissions in one namespace to access middleware objects from other namespaces.

A vulnerability in Traefik's Kubernetes Gateway API provider allows users with HTTPRoute permissions to gain unauthorized access to the REST configuration interface and manipulate Traefik's configuration, bypassing intended security settings that should prevent such access.

A vulnerability in Traefik's HTTP/3 implementation allows attackers to bypass client certificate authentication when wildcard hostnames or different letter casing are used, enabling access to protected backends without required certificates.

A security vulnerability in Traefik allows attackers to bypass client certificate authentication when wildcard routers are configured with stricter TLS settings by exploiting another permissive SNI connection on the same endpoint.

A vulnerability in Traefik's StripPrefix middleware allows attackers to bypass authentication by using paths containing '..' that get normalized to protected backend paths after the prefix is stripped.

A critical security vulnerability in Grafana allows attackers to access and delete dashboard snapshots without authentication by using specific URL paths.

A vulnerability in Grafana allows attackers to execute malicious JavaScript code through specially crafted URLs when users are unauthenticated and visit certain pages.

A vulnerability in Grafana allowed organization administrators to manage user roles in other organizations where they had no authority. This only affected installations with the fine-grained access control beta feature enabled and multiple organizations present.

Grafana versions 8.0.0-beta1 through 8.3.0 contain a path traversal vulnerability that allows attackers to access local server files through specific plugin URLs.

Grafana applications between versions 5.0.0 and 8.3.1 contain a security vulnerability that allows authenticated users to read certain markdown files through directory traversal attacks.

Grafana contains a security vulnerability that allows authenticated users to read arbitrary CSV files through directory traversal, but only when the TestData DB data source is enabled.

A flaw in Grafana allows API token holders to access data they shouldn't have permission for by forwarding the OAuth identity of the most recently logged-in user.

Grafana versions up to 8.3.4 contain a Cross-Site Scripting vulnerability where attackers can inject malicious HTML code through compromised data sources or plugins. Authenticated users could be tricked into executing malicious code through specially crafted links.

Grafana dashboards are vulnerable to Cross-Site Request Forgery attacks where attackers can trick authenticated users into granting them high privileges. All versions from 3.0-beta1 onwards are affected, allowing privilege escalation by deceiving administrators.