org.asynchttpclient:async-http-client-extras-rxjava vulnerabilities (TuxCare)
16 vulnerabilities.
-
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS 6.8 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel 5.9 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source 3.7 Low -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host 9.4 Critical -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk 6.9 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext 8.7 High -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins 7.4 High -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) 6.8 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled 7.5 High -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request 5.9 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service 7.5 High -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target 6.8 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore 4.0 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare async-http-client: Cookie header not stripped on cross-origin redirect 7.4 High -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects 6.8 Medium -
org.asynchttpclient:async-http-client-extras-rxjavaTuxCare AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s 9.2 Critical