CVE-2018-11469

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve information disclosure via an unauthenticated remote request, related to the proto_http.c check_request_for_cacheability function.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-11475.4In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and uploadCVE-2018-114708.8iScripts eSwap v2.4 has SQL injection via the "search.php" 'Told' parameter in the User Panel.CVE-2018-114715.4Cockpit 0.5.5 has XSS via a collection, form, or region.CVE-2018-114726.1Monstra CMS 3.0.4 has Reflected XSS during Login (i.e., the login parameter to admin/index.php).CVE-2018-114736.1Monstra CMS 3.0.4 has XSS in the registration Form (i.e., the login parameter to users/registration).CVE-2018-114748.0Monstra CMS 3.0.4 has a Session Management Issue in the Administrations Tab. A password change at admin/index.php?id=users&action=edit&user_CVE-2018-114758.0Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is oCVE-2018-114768.8An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured wiCVE-2018-114776.5An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application andCVE-2018-114788.8An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information frCVE-2018-114797.8The VPN component in Windscribe 1.81 uses the OpenVPN client for connections. Also, it creates a WindScribeService.exe system process that eCVE-2018-11486.5In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker cou