The internet is broken right now.

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.

Other

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.

Other Network gear Pfsense

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.

Other Network gear Pfsense

Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 11 23h2

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows Server 2012

Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.

Other OS & kernel Microsoft Windows 10 1607

Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows Server 2019

Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.

Other OS & kernel Microsoft Windows 10 1607

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

Other Web app

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Other Microsoft 365 Apps

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 11 24h2

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Other Server Microsoft Sharepoint Server

Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.

Other OS & kernel Microsoft Windows 10 1607

Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information over a network.

Other OS & kernel Microsoft Windows 10 1607

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

Other OS & kernel Microsoft Windows 10 1607

Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Other Server Microsoft Sharepoint Server

Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS.

Other Web app

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

Other

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.

Other Library

Incorrect implementation of authentication algorithm in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

Other OS & kernel Microsoft Windows 11 23h2

Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.

Other OS & kernel Microsoft Windows Server 2022

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

Other

Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.

Other OS & kernel Microsoft Windows 10 1607

Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.

Other OS & kernel Microsoft Windows 11 24h2

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Other

Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.

Other

Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network.

Other OS & kernel Microsoft Windows 10 1607

Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network.

Other OS & kernel Microsoft Windows 10 1607

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

Other

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Other Microsoft asp.net Core

Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 21h2

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 11 24h2

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 1607

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 1607

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 1607

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 1607

Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 1607

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while the routing that dispatches the request to the endpoint did not apply the same rule. The two comparisons therefore disagreed for any path whose case differed from the configured value. An external caller could alter the case of a character in a path segment so that the security constraint no longer recognised the path as protected, while the request still dispatched to the same endpoint. The result is that the constraint is skipped and the protected route is reached without satisfying it. No credential, prior access or special configuration is required beyond being able to send a request to the consumer. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The constraint now matches the request path with the same case rules the dispatch uses, so the two can no longer disagree. For deployments that cannot upgrade immediately, place the authorization decision in front of the Camel consumer, for example in a reverse proxy that normalises the request path before forwarding.

Other Web app Apache Camel

Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.

Other OS & kernel Microsoft Windows 10 1607

Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.

Other OS & kernel Microsoft Windows 10 1607

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

Other

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Other

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.

Other Library

Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 1607

Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.

Other OS & kernel Microsoft Windows 10 1607