Overview 96 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 8 public PoC · 14 EPSS ≥ 0.5
96matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
8public PoC8.3%
14EPSS ≥ 0.514.6%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
3
3.1%
Not applicable
93
96.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
96
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 17 / year
19991
Not applicable1
Medium1
not blocked1
Working exploit published1
20000
20011
Not applicable1
Medium1
not blocked1
No public exploit1
20023
Not applicable3
Medium3
not blocked3
No public exploit3
20030
20044
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
200517
Not applicable17
Medium17
not blocked17
Forecast only3
No public exploit14
20060
20074
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20082
Not applicable2
Medium2
not blocked2
No public exploit2
20097
Not applicable7
Medium7
not blocked7
Working exploit published1
Forecast only1
No public exploit5
20104
Not applicable4
Medium4
not blocked4
Forecast only1
No public exploit3
20112
Not applicable2
Medium2
not blocked2
No public exploit2
20124
Not applicable4
Medium4
not blocked4
No public exploit4
20132
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20145
Not applicable5
Medium5
not blocked5
Forecast only2
No public exploit3
20153
Not applicable3
Medium3
not blocked3
No public exploit3
20161
Not applicable1
Medium1
not blocked1
No public exploit1
20171
Not applicable1
Medium1
not blocked1
No public exploit1
20183
Not applicable3
Medium3
not blocked3
Proof of concept only1
No public exploit2
20194
Not applicable4
Medium4
not blocked4
Forecast only1
No public exploit3
20206
Not applicable6
Medium6
not blocked6
No public exploit6
20217
Outside Waratek scope3
Not applicable4
Medium7
not blocked7
Forecast only3
No public exploit4
20222
Not applicable2
Medium2
not blocked2
No public exploit2
20237
Not applicable7
Medium7
not blocked7
Working exploit published1
Proof of concept only4
No public exploit2
20242
Not applicable2
Medium2
not blocked2
Proof of concept only1
No public exploit1
20251
Not applicable1
Medium1
not blocked1
No public exploit1
20263
Not applicable3
Medium3
not blocked3
Proof of concept only1
No public exploit2
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-50012 | Medium | 2026-07-16 | Not applicable | No public exploit | Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6. |
| CVE-2026-47729 | Medium | 2026-07-16 | Not applicable | Proof of concept only | Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6. |
| CVE-2026-33515 | Medium | 2026-03-26 | Not applicable | No public exploit | Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch. |
| CVE-2025-59362 | Medium | 2025-09-26 | Not applicable | No public exploit | Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c. |
| CVE-2024-37894 | Medium | 2024-06-25 | Not applicable | No public exploit | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack. |
| CVE-2024-23638 | Medium | 2024-01-24 | Not applicable | Proof of concept only | Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`. |
| CVE-2023-46857 | Medium | 2023-12-07 | Not applicable | No public exploit | Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for exploitation. |
| CVE-2023-46744 | Medium | 2023-11-07 | Not applicable | Proof of concept only | Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability enables privilege escalation of authenticated users. The SVG element filtering mechanism intended to stop XSS attacks through uploaded SVG images, is insufficient resulting to stored XSS attacks. Squidex allows the CMS contributors to be granted the permission of uploading an SVG asset. When the asset is uploaded, a filtering mechanism is performed to validate that the SVG does not contain malicious code. The validation logic consists of traversing the HTML nodes in the DOM. In order for the validation to succeed, 2 conditions must be met: 1. No HTML tags included in a "blacklist" called "InvalidSvgElements" are present. This list only contains the element "script". and 2. No attributes of HTML tags begin with "on" (i.e. onerror, onclick) (line 65). If either of the 2 conditions is not satisfied, validation fails and the file/asset is not uploaded. However it is possible to bypass the above filtering mechanism and execute arbitrary JavaScript code by introducing other HTML elements such as an <iframe> element with a "src" attribute containing a "javascript:" value. Authenticated adversaries with the "assets.create" permission, can leverage this vulnerability to upload a malicious SVG as an asset, targeting any registered user that will attempt to open/view the asset through the Squidex CMS. |
| CVE-2023-46252 | Medium | 2023-11-07 | Not applicable | No public exploit | Squidex is an open source headless CMS and content management hub. Affected versions are missing origin verification in a postMessage handler which introduces a Cross-Site Scripting (XSS) vulnerability. The editor-sdk.js file defines three different class-like functions, which employ a global message event listener: SquidexSidebar, SquidexWidget, and SquidexFormField. The registered event listener takes some action based on the type of the received message. For example, when the SquidexFormField receives a message with the type valueChanged, the value property is updated. The SquidexFormField class is for example used in the editor-editorjs.html file, which can be accessed via the public wwwroot folder. It uses the onValueChanged method to register a callback function, which passes the value provided from the message event to the editor.render. Passing an attacker-controlled value to this function introduces a Cross-Site Scripting (XSS) vulnerability. |
| CVE-2023-3580 | Medium | 2023-07-10 | Not applicable | Proof of concept only | Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0. |
| CVE-2023-24278 | Medium | 2023-03-18 | Not applicable | Working exploit published | Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability. |
| CVE-2023-0643 | Medium | 2023-02-02 | Not applicable | Proof of concept only | Improper Handling of Additional Special Element in GitHub repository squidex/squidex prior to 7.4.0. |
| CVE-2023-0642 | Medium | 2023-02-02 | Not applicable | Proof of concept only | Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0. |
| CVE-2022-41317 | Medium | 2022-12-25 | Not applicable | No public exploit | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7. |
| CVE-2021-46784 | Medium | 2022-07-17 | Not applicable | No public exploit | In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. |
| CVE-2021-31807 | Medium | 2021-06-08 | Outside Waratek scope | No public exploit | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent. |
| CVE-2021-33620 | Medium | 2021-05-28 | Not applicable | Forecast only | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server. |
| CVE-2021-31808 | Medium | 2021-05-27 | Outside Waratek scope | No public exploit | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this. |
| CVE-2021-31806 | Medium | 2021-05-27 | Outside Waratek scope | Forecast only | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing. |
| CVE-2021-28662 | Medium | 2021-05-27 | Not applicable | Forecast only | An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic. |
| CVE-2021-28652 | Medium | 2021-05-27 | Not applicable | No public exploit | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege. |
| CVE-2021-28116 | Medium | 2021-03-09 | Not applicable | No public exploit | Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody. |
| CVE-2020-15811 | Medium | 2020-09-02 | Not applicable | No public exploit | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches. |
| CVE-2020-15810 | Medium | 2020-09-02 | Not applicable | No public exploit | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream. |
| CVE-2020-14059 | Medium | 2020-06-30 | Not applicable | No public exploit | An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list. |
| CVE-2019-12522 | Medium | 2020-04-15 | Not applicable | No public exploit | An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root. |
| CVE-2019-12521 | Medium | 2020-04-15 | Not applicable | No public exploit | An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing. |
| CVE-2019-18860 | Medium | 2020-03-20 | Not applicable | No public exploit | Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. |
| CVE-2019-18678 | Medium | 2019-11-26 | Not applicable | No public exploit | An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon. |
| CVE-2019-18677 | Medium | 2019-11-26 | Not applicable | No public exploit | An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to. |
| CVE-2019-12529 | Medium | 2019-07-11 | Not applicable | No public exploit | An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. |
| CVE-2019-13345 | Medium | 2019-07-05 | Not applicable | Forecast only | The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. |
| CVE-2018-19132 | Medium | 2018-11-09 | Not applicable | No public exploit | Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet. |
| CVE-2018-19131 | Medium | 2018-11-09 | Not applicable | Proof of concept only | Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors. |
| CVE-2018-1172 | Medium | 2018-05-16 | Not applicable | No public exploit | This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088. |
| CVE-2015-8936 | Medium | 2017-02-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script or HTML via a blocked site link. |
| CVE-2016-2390 | Medium | 2016-04-19 | Not applicable | No public exploit | The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message. |
| CVE-2014-9749 | Medium | 2015-11-06 | Not applicable | No public exploit | Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability." |
| CVE-2015-5400 | Medium | 2015-09-28 | Not applicable | No public exploit | Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request. |
| CVE-2015-0881 | Medium | 2015-02-20 | Not applicable | No public exploit | CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response. |
| CVE-2014-7142 | Medium | 2014-11-26 | Not applicable | No public exploit | The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size. |
| CVE-2014-7141 | Medium | 2014-11-26 | Not applicable | Forecast only | The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet. |
| CVE-2014-6270 | Medium | 2014-09-12 | Not applicable | No public exploit | Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow. |
| CVE-2014-3609 | Medium | 2014-09-11 | Not applicable | Forecast only | HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values." |
| CVE-2014-0128 | Medium | 2014-04-14 | Not applicable | No public exploit | Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management. |
| CVE-2013-4123 | Medium | 2013-09-16 | Not applicable | Working exploit published | client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header. |
| CVE-2013-0189 | Medium | 2013-02-08 | Not applicable | No public exploit | cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison. |
| CVE-2012-5643 | Medium | 2012-12-20 | Not applicable | No public exploit | Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials. |
| CVE-2012-4667 | Medium | 2012-08-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in SquidClamav 5.x before 5.8 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) virus, (3) source, or (4) user parameter to (a) clwarn.cgi, (b) clwarn.cgi.de_DE, (c) clwarn.cgi.en_EN, (d) clwarn.cgi.fr_FR, (e) clwarn.cgi.pt_BR, or (f) clwarn.cgi.ru_RU in cgi-bin/. |
| CVE-2012-3501 | Medium | 2012-08-25 | Not applicable | No public exploit | The squidclamav_check_preview_handler function in squidclamav.c in SquidClamav 5.x before 5.8 and 6.x before 6.7 passes an unescaped URL to a system command call, which allows remote attackers to cause a denial of service (daemon crash) via a URL with certain characters, as demonstrated using %0D or %0A. |
| CVE-2012-2213 | Medium | 2012-04-28 | Not applicable | No public exploit | Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br |
| CVE-2011-4096 | Medium | 2011-11-17 | Not applicable | No public exploit | The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record. |
| CVE-2011-3205 | Medium | 2011-09-06 | Not applicable | No public exploit | Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression. |
| CVE-2010-2951 | Medium | 2010-10-12 | Not applicable | No public exploit | dns_internal.cc in Squid 3.1.6, when IPv6 DNS resolution is not enabled, accesses an invalid socket during an IPv4 TCP DNS query, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via vectors that trigger an IPv4 DNS response with the TC bit set. |
| CVE-2010-3072 | Medium | 2010-09-20 | Not applicable | Forecast only | The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request. |
| CVE-2010-0639 | Medium | 2010-02-15 | Not applicable | No public exploit | The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port. |
| CVE-2010-0308 | Medium | 2010-02-03 | Not applicable | No public exploit | lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header. |
| CVE-2009-3826 | Medium | 2009-10-28 | Not applicable | No public exploit | Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL, related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information about the originally requested URL. |
| CVE-2009-3700 | Medium | 2009-10-28 | Not applicable | No public exploit | Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blocking functionality) via a long URL with many / (slash) characters, related to "emergency mode." |
| CVE-2009-2855 | Medium | 2009-08-18 | Not applicable | No public exploit | The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function. |
| CVE-2009-2622 | Medium | 2009-07-28 | Not applicable | Forecast only | Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc. |
| CVE-2009-2621 | Medium | 2009-07-28 | Not applicable | No public exploit | Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a) HttpMsg.cc and (b) client_side.cc. |
| CVE-2009-0801 | Medium | 2009-03-04 | Not applicable | No public exploit | Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header. |
| CVE-2009-0478 | Medium | 2009-02-08 | Not applicable | Working exploit published | Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c. |
| CVE-2008-1612 | Medium | 2008-04-01 | Not applicable | No public exploit | The arrayShrink function (lib/Array.c) in Squid 2.6.STABLE17 allows attackers to cause a denial of service (process exit) via unknown vectors that cause an array to shrink to 0 entries, which triggers an assert error. NOTE: this issue is due to an incorrect fix for CVE-2007-6239. |
| CVE-2008-1168 | Medium | 2008-03-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-6239 | Medium | 2007-12-04 | Not applicable | No public exploit | The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects. |
| CVE-2007-1560 | Medium | 2007-03-21 | Not applicable | No public exploit | The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error. |
| CVE-2007-0248 | Medium | 2007-01-16 | Not applicable | No public exploit | The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop. |
| CVE-2007-0247 | Medium | 2007-01-16 | Not applicable | Working exploit published | squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory listing responses, possibly related to the (1) ftpListingFinish and (2) ftpHtmlifyListEntry functions. |
| CVE-2005-3322 | Medium | 2005-10-27 | Not applicable | No public exploit | Unspecified vulnerability in Squid on SUSE Linux 9.0 allows remote attackers to cause a denial of service (crash) via HTTPs (SSL). |
| CVE-2005-3258 | Medium | 2005-10-20 | Not applicable | No public exploit | The rfc1738_do_escape function in ftp.c for Squid 2.5 STABLE11 and earlier allows remote FTP servers to cause a denial of service (segmentation fault) via certain "odd" responses. |
| CVE-2005-2917 | Medium | 2005-09-30 | Not applicable | No public exploit | Squid 2.5.STABLE10 and earlier, while performing NTLM authentication, does not properly handle certain request sequences, which allows attackers to cause a denial of service (daemon restart). |
| CVE-2005-2796 | Medium | 2005-09-07 | Not applicable | No public exploit | The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (segmentation fault) via certain crafted requests. |
| CVE-2005-2794 | Medium | 2005-09-07 | Not applicable | No public exploit | store.c in Squid 2.5.STABLE10 and earlier allows remote attackers to cause a denial of service (crash) via certain aborted requests that trigger an assert error related to STORE_PENDING. |
| CVE-2005-1519 | Medium | 2005-05-11 | Not applicable | No public exploit | Squid 2.5 STABLE9 and earlier, when the DNS client port is unfiltered and the environment does not prevent IP spoofing, allows remote attackers to spoof DNS lookups. |
| CVE-2005-0813 | Medium | 2005-05-02 | Not applicable | No public exploit | Buffer overflow in Initial Redirect (ir) Squid Proxy Plug-In 0.1 and 0.2 may allow attackers to cause a denial of service and execute arbitrary code via unknown vectors. |
| CVE-2005-0446 | Medium | 2005-05-02 | Not applicable | No public exploit | Squid 2.5.STABLE8 and earlier allows remote attackers to cause a denial of service (crash) via certain DNS responses regarding (1) Fully Qualified Domain Names (FQDN) in fqdncache.c or (2) IP addresses in ipcache.c, which trigger an assertion failure. |
| CVE-2005-0241 | Medium | 2005-05-02 | Not applicable | Forecast only | The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size. |
| CVE-2005-0718 | Medium | 2005-04-14 | Not applicable | No public exploit | Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (segmentation fault) by aborting the connection during a (1) PUT or (2) POST request, which causes Squid to access previously freed memory. |
| CVE-2005-0175 | Medium | 2005-02-07 | Not applicable | No public exploit | Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache via an HTTP response splitting attack. |
| CVE-2005-0174 | Medium | 2005-02-07 | Not applicable | Forecast only | Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters. |
| CVE-2004-0918 | Medium | 2005-01-27 | Not applicable | No public exploit | The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error. |
| CVE-2005-0096 | Medium | 2005-01-25 | Not applicable | No public exploit | Memory leak in the NTLM fakeauth_auth helper for Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (memory consumption). |
| CVE-2005-0095 | Medium | 2005-01-15 | Not applicable | Forecast only | The WCCP message parsing code in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via malformed WCCP messages with source addresses that are spoofed to reference Squid's home router and invalid WCCP_I_SEE_YOU cache numbers. |
| CVE-2005-0094 | Medium | 2005-01-15 | Not applicable | No public exploit | Buffer overflow in the gopherToHTML function in the Gopher reply parser for Squid 2.5.STABLE7 and earlier allows remote malicious Gopher servers to cause a denial of service (crash) via crafted responses. |
| CVE-2005-0097 | Medium | 2005-01-11 | Not applicable | No public exploit | The NTLM component in Squid 2.5.STABLE7 and earlier allows remote attackers to cause a denial of service (crash) via a malformed NTLM type 3 message that triggers a NULL dereference. |
| CVE-2004-2654 | Medium | 2004-12-31 | Not applicable | No public exploit | The clientAbortBody function in client_side.c in Squid Web Proxy Cache before 2.6 STABLE6 allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors that trigger a null dereference. NOTE: in a followup advisory, a researcher claimed that the issue was a buffer overflow that was not fixed in STABLE6. However, the vendor's bug report clearly shows that the researcher later retracted this claim, because the tested product was actually STABLE5. |
| CVE-2004-2480 | Medium | 2004-12-31 | Not applicable | Working exploit published | Squid Web Proxy Cache 2.3.STABLE5 allows remote attackers to bypass security controls and access arbitrary websites via "@@" sequences in a URL within Internet Explorer. |
| CVE-2004-2479 | Medium | 2004-12-31 | Not applicable | No public exploit | Squid Web Proxy Cache 2.5 might allow remote attackers to obtain sensitive information via URLs containing invalid hostnames that cause DNS operations to fail, which results in references to previously used error messages. |
| CVE-2004-0832 | Medium | 2004-11-03 | Not applicable | No public exploit | The (1) ntlm_fetch_string and (2) ntlm_get_string functions in Squid 2.5.6 and earlier, with NTLM authentication enabled, allow remote attackers to cause a denial of service (application crash) via an NTLMSSP packet that causes a negative value to be passed to memcpy. |
| CVE-2002-2414 | Medium | 2002-12-31 | Not applicable | No public exploit | Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority (CA) certificate from a site and establishing a subsequent HTTPS connection, which allows remote attackers to cause a denial of service (crash). |
| CVE-2002-2175 | Medium | 2002-12-31 | Not applicable | No public exploit | phpSquidPass before 0.2 uses an incomplete regular expression to find a matching username in its database, which allows remote authenticated attackers to effectively delete other usernames via a short username that matches the end of the targeted username. |
| CVE-2002-0715 | Medium | 2002-07-26 | Not applicable | No public exploit | Vulnerability in Squid before 2.4.STABLE6 related to proxy authentication credentials may allow remote web sites to obtain the user's proxy login and password. |
| CVE-2001-0843 | Medium | 2001-12-06 | Not applicable | No public exploit | Squid proxy server 2.4 and earlier allows remote attackers to cause a denial of service (crash) via a mkdir-only FTP PUT request. |
| CVE-1999-1481 | Medium | 1999-12-31 | Not applicable | Working exploit published | Squid 2.2.STABLE5 and below, when using external authentication, allows attackers to bypass access controls via a newline in the user/password pair. |