CVE-2011-1499

LowCVSS 2.6/10Last modified Jun 16, 2026

Description

acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-16

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621493Issue Tracking, Patch
http://openwall.com/lists/oss-security/2011/04/07/9Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2011/04/08/3Mailing List, Third Party Advisory
http://secunia.com/advisories/44274
http://www.debian.org/security/2011/dsa-2222Third Party Advisory
https://banu.com/bugzilla/show_bug.cgi?id=90Broken Link
https://banu.com/cgit/tinyproxy/diff/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=694658Issue Tracking, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/67256
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621493Issue Tracking, Patch
http://openwall.com/lists/oss-security/2011/04/07/9Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2011/04/08/3Mailing List, Third Party Advisory
http://secunia.com/advisories/44274
http://www.debian.org/security/2011/dsa-2222Third Party Advisory
https://banu.com/bugzilla/show_bug.cgi?id=90Broken Link
https://banu.com/cgit/tinyproxy/diff/?id=e8426f6662dc467bd1d827100481b95d9a4a23e4Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=694658Issue Tracking, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/67256

Timeline

Published: Apr 29, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-15002.1PreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config/pithos.ini file in a user's home directory CVE-2011-15024.0Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary f CVE-2011-15033.5The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used CVE-2011-15043.5Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated us CVE-2011-150510.0Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.27 services for Lotus Domino has unknown impact and attack vectors, aka SPR E CVE-2011-15066.8The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-CVE-2011-15075.0Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Busine CVE-2011-15089.3Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-ass CVE-2011-15095.0The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of pass CVE-2011-15104.3Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to CVE-2011-15116.4Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to e CVE-2011-15129.3Heap-based buffer overflow in xlssr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute