Количество 7
Количество 7
CVE-2024-28849
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-28849
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-28849
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-28849
Proxy-Authorization header kept across hosts in follow-redirects
CVE-2024-28849
follow-redirects is an open source, drop-in replacement for Node's `ht ...
GHSA-cxjh-pqwp-8mfp
follow-redirects' Proxy-Authorization header kept across hosts
BDU:2024-02610
Уязвимость модуля Node.js follow-redirects, связанная с недостаточной защитой служебных данных, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2024-28849 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
 | CVE-2024-28849 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
 | CVE-2024-28849 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability. | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
 | CVE-2024-28849 Proxy-Authorization header kept across hosts in follow-redirects | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
| CVE-2024-28849 follow-redirects is an open source, drop-in replacement for Node's `ht ... | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
| GHSA-cxjh-pqwp-8mfp follow-redirects' Proxy-Authorization header kept across hosts | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
 | BDU:2024-02610 Уязвимость модуля Node.js follow-redirects, связанная с недостаточной защитой служебных данных, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации | CVSS3: 6.5 | 1% Низкий | почти 2 года назад |
Уязвимостей на страницу