98 matches found
Low: httpd24
Issue Overview: modlua.c in the modlua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended...
Oracle Secure Global Desktop Multiple Vulnerabilities (January 2015 CPU) (POODLE)
The remote host has a version of Oracle Secure Global Desktop that is version 4.63, 4.71, 5.0 or 5.1. It is, therefore, affected by multiple vulnerabilities in the following components : - Apache HTTP Server - Client - Gateway JARP module - Gateway Reverse Proxy - OpenSSL - Print Servlet only in...
openSUSE Security Update : apache2 (openSUSE-SU-2014:1726-1)
Apache2 was updated to fix bugs and security issues. Security issues fixed: CVE-2013-5704: Added a change to fix a flaw in the way modheaders handled chunked requests. Adds 'MergeTrailers' directive to restore legacy behavior bnc871310, CVE-2014-8109: Fixes handling of the Require line when a...
Amazon Linux AMI : httpd (ALAS-2014-414)
The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states 'this is not a security issue in httpd as such.' C Tenable Networ...
Low: httpd
Issue Overview: The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."...
Mandriva Linux Security Advisory : apache (MDVSA-2014:174)
A vulnerability has been found and corrected in apache ASF HTTPD : The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass RequestHeader unset directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states...
CVE-2014-5704
The CVE-2014-5704 entry applies to the DISH Anywhere app (com.sm.SlingGuide.Dish) for Android, version 3.5.10. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and access sensitive information via a crafte...
Apache 2.2.x < 2.2.28 Multiple Vulnerabilities
According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.28. It is, therefore, affected by the following vulnerabilities : - A flaw exists within the 'modheaders' module which allows a remote attacker to inject arbitrary headers. This is done by placing a...
CVE-2013-5704
The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."...
BELL-CVE-2013-5704 CVE-2013-5704 does not affect BellSoft software
Bulletin has no description...
CVE-2013-5704
CVE-2013-5704 concerns the Apache HTTP Server mod_headers trailer-header bypass vulnerability. The issue arises when a client places headers in the trailer portion of a chunked request, potentially bypassing RequestHeader unset directives and allowing header manipulation after header processing. ...
CVE-2013-5704
The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."...
CVE-2012-5704
CVE-2012-5704 affects the Drupal Hotblocks module (6.x-1.x) prior to 6.x-1.8. The flaw allows remote authenticated users with the "administer hotblocks" permission to trigger a DoS by configuring a hotblock that references itself, causing an infinite loop/time‑out. The impact is a site denial of ...
SA-CONTRIB-2012-126 - Hotblocks - Cross Site Scripting (XSS) and Denial of Service (DoS)
The Hotblocks module provides an enhanced GUI for administering blocks and block content that is intended to be simpler and more controllable for less privileged users than the default block administration tools. Cross Site Scripting XSS The module doesn't sufficiently sanitize the user input for...
CVE-2008-5704
src/unittest.c in gpsdrive aka gpsdrive-scripts 2.10pre4 might allow local users to overwrite arbitrary files via a symlink attack on the /tmp/gpsdrive-unit-test/proc temporary file, a different vector than CVE-2008-4959 and CVE-2008-5380...
SuSE 10 Security Update : the OpenLDAP client (ZYPP Patch Number 5704)
The last security update for openldap2-client introduced a problem in libldap that could cause LDAP clients to prematurely truncate search results. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...
CVE-2007-5704
CVE-2007-5704 concerns the CodeWidgets.com Online Event Registration Template, where the (1) Email Address and (2) Password fields in login.asp and admin_login.asp are vulnerable to SQL injection. The underlying issue permits remote attackers to craft input that may result in arbitrary SQL execut...