Italian

_dd_s

utag_main

nlbi_2918737

visid_incap_2918737

incap_ses_656_2918737

__cmpcvcx164745

__cmpcpcx164745

__cmpiuid

The domain name 'privati.vodafone.it' uses the Italian country-code top-level domain (.it) with subdomain 'privati'. The core label 'vodafone' covers 8 characters containing 4 vowels alongside four consonants. Tokenizing the label suggests one word: vodafone. Average segment length settles at eight characters. No strong language cues emerged from the frequency lists.

query

default-src * data: blob: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' https://vodafone.it https://*.vodafone.it;

8258f1e56252d7fdaaff88cfeb9674f3ac294dd054ea158868b60c32710ccf30

e6b5f6b59a7223d21638213f99c972f452df30a8def4bdf46a7346e5a163e02b

52a2b6922654aafd7c3701c17c13eaa2124a889e46a02a76bc4d858148346e9e

18dfaa99276f021f0d27bb1d1572aa8304cfa650796bf9eeb5424fe02e1a69d4

6ecc92dd87e74dd51ccca8af66d67af80de5fb5810a337b827e10bbf99534d19

17012fea5dcd07aec2b0600d4d28d7e963c5a732678151461035896e48b2e121

1b17aca05134b957a89f3ca09c91ab49863976728dbc40c3b0406f348791e804

c02c22671df6717830093c2a97f2dbc78c3302591d12aeb284655feaa9d700fd

04b5bc56d5d6e4283c471d2a0e45187f840963963b1ff756ff74286ac4d3820e

5bd947230132598028e429a735ccd2b8a9c583d2bfdd3a52c4f721180abc75d7

b0aebf58754dc042a39a7257a1c0d9708dc2599df94edc157b347bd48eb2c4ef

4ff612cba3687702ae661765bda19da87ec8d2f21ef8ec4c4c2ba0159505574a

96e7cc03e6300a902b95a7ab94cfeda109cf2c750e2adfc5554327a2f0432e3f

444ba213abd28bef5b8d92da740de512c4dd31f7ee408174506b5347edf3caa2

244c091765f2907458c1997e4d426f8f6b5b4417ec36ca4a17e3a7921d6d5fbf

4d48f407a57fc061338336f61a105532ea2f73a4843413ea7ffbb9b0f9c33804

c35e187c83362293cdf39d23a573abed910356d31faf3237ac6caacaa89bcb0a

46296344be1f896764edcb9f6a387dfc44fc5b5f3ab6920699271b59d8f91cb9

57ab6eee993d1a435f04f02c28e14350266820c59ea35abda7df5037ba4f7131

123fc971d63928446590dd24ee4fe1983a28e30e61fdb0f8f61c3ba8eeb69177

30613d55f58396239f9ee7d5cb0462d62a789b6af712624d0e05189cc969ceaa

c1c3f26154c0b3cc1db3829f67fbb919cf856beca353af34359042f643048e26

20670c4082c657e7714a26c1eb4f187caac32b3ff03408d98b948a6d239eba6d

00442b9133a786435e8bdfc04ed809a877ffc08435f95cba0ff7f185713c2c08

4c5cf0084ef384db263619a24cf5a65b41e977137d28d0f2cd73a71517696e7a

7a068387d437ff2322ab046eda0a6fa64e99f84d84edae9a6c3478a9d6451f04

a38b9e4d727f7c2665816408ac723804f23fe16743b7dc10aee9fd083c897e97

b187dfb120d59224cb5936a9286fefc038a4165330b5a8202aa428a520159db5

982ca36205bd8be0358306f2019578123ae181e87ba79636cf24308407b7efbe

086e1ece13b28c5223dccfb916bc168e2ca1b3ac5085b81ed232c82bb0bc5925

8589e3712c9a052ff3a9d7a7bcb0e54549d5fb76d496e0e166a2587f410ea8c2

e8c5f49163e825178c2a72c38df26838043c0b431825972f094fff7b48e1080f

8124da4c2f70abcb7effc138186fd0024cf6f33125a87db5c6d3c72c1e67b2e1

dfd3c13d5b1d0c0c6410e9899cc6240e8a3458cee996949a4cc0bbc05d4111f5

6957c478ce39b1b6b587e8d04661d31981dbfc8ed70bb83588e7ca6af55bea00

51cde03a0eca2af5ae0f7805df7abb27c3a161dc83337a91cab6ddac51488a14

6406a7d165f4c9a87d3ea7d31b60a994e50c353881f33c9c0a1e7e76f5388a0d

4e4cddf59bf3a4ae7b61638b701091f7701c31a8c135dccf57de18095c6f79ab

55590235d6ca18d19a63767a142eb9b349248e9c2db7c18fbc9778ea268f3c78

a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

5c69e258632cfdddb6d9e2d3e0ada3d24d3706c1aaf1afc222050340a245c6a2

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

A DoS vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

## Summary
When Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

## Impact
An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel. 

## Patches
The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so `content-length: 0` is added only when both `content-length` and `transfer-encoding` are absent, and `transfer-encoding` is no longer removed in that code path.

## Workarounds
If upgrade is not immediately possible:
- Block chunked `DELETE`/`OPTIONS` requests on rewritten routes at your edge/proxy.
- Enforce authentication/authorization on backend routes per our [security guidance](https://nextjs.org/docs/app/guides/data-security).

## Summary
The default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth.

## Impact
An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service.

## Patches
Fixed by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including eviction of least-recently-used entries when the limit is exceeded. Setting `maximumDiskCacheSize: 0` disables disk caching. 

## Workarounds
If upgrade is not immediately possible:
- Periodically clean `.next/cache/images`.
- Reduce variant cardinality (e.g., tighten values for `images.localPatterns`, `images.remotePatterns`, and `images.qualities`)

0973c1d64c88adc8e3c950410cb58b288f72118d5965b78049438deb8f2f9683

2f0c257ca4b5ea3ba08f2587ea8aeac534494cbaa1cea79be8f88e7825ce7bd8

07d6c35fbc253652b1beff0d73adc4e5266afac3d3311d94a81ad054650df4b1

54b34ccf9367c00b10d2faa8fea765c4ab48ab8cc396397dc05178a2ec099b4c

dab090af14b95aa7034f09e1746475afde49d411745a6b669a7b7245a00b2eda

77bcf9e15a7047ada41f11ac30407bebdb371bace5fc48c52a7f113b9c931cf5

msapplication-TileColor

theme-color

release-version

viewport

Scopri le nostre migliori offerte di telefonia mobile, Fibra, ADSL e FWA; i nuovi Smartphone e i vantaggi Vodafone per Privati e Aziende.

description

Offerte Telefonia Mobile, Fibra e ADSL, Smartphone | Vodafone

https://www.vodafone.it/portal/resources/media/Other/vfa/media/images/icone/ico_header_logo_red_04_12_19.png

twitter:title

twitter:description

twitter:image

twitter:url

next-head-count

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

vodafone.it

Abuse

Admin

Cloudflare-NOC

Cloudflare, Inc.

CLOUDFLARENET

{"props":{"pageProps":{"dehydratedState":{"mutations":[],"queries":[{"state":{"data":[],"dataUpdateCount":1,"dataUpdatedAt":1783956757993,"error":null,"errorUpdateCount":0,"errorUpdatedAt":0,"fetchFai


          window["adrum-start-time"] = new Date().getTime();
           (function(config){
            config.appKey = "EC-AAB-MFM";
            config.adrumExtUrlHttp = 'http://cdn.appdynamics.com';
            config.adrumExtUrlHttps = 'https://cdn.appdynamics.com';
            config.beaconUrlHttp = 'http://fra-col.eum-appdynamics.com';
            config.beaconUrlHttps = 'https://fra-col.eum-appdynamics.com';
            config.resTiming = '{"bufSize":200,"clearResTimingOnBeaconSend":true}';
            config.maxUrlLength = 1024;
            config.longStackTrace = false;
            config.spa = {"spa2":true};
          })
          (window["adrum-config"] || (window["adrum-config"] = {}));
        

window.utag_cfg_ovrd = window.utag_cfg_ovrd || {}; window.utag_cfg_ovrd.noview = true; window.utag_data = window.utag_data || {};

window.history.scrollRestoration = "manual"

Requests	IP Address	Location	AS Autonomous System
119	104.16.223.185Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
118	45.60.74.54Incapsula · WAF	United States	AS19551Incapsula Inc
237	2	-	-

Security Scan Report: privati.vodafone.it

Summary

AI Security Verdict

Safe Website

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies5

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History