cve-2021-42013

Apache 2.4.50 - 路径遍历或远程代码执行 CVE-2021-42013.py 是一个 Python 脚本，可帮助发现 Apache 2.4.50 中的路径遍历或远程代码执行漏洞。我们提供了一个存在漏洞的 Docker 实例，供您动手实践 CVE-2021-42013。 如果启用了 CGI-BIN，我们可以执行远程代码执行，但无法进行路径遍历，因此为了检测路径遍历漏洞，已在 httpd.conf 的 Alias 部分下添加了“icons”目录。 httpd.conf 中的易受攻击配置 root@kitploit: 1. 启用 CGI-BIN 2. 在 Alias...

CVE-2021-40086

An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page that can only be viewed by an administrator. While hidden from direct view, checking the page source would...

CVE-2018-19052

The CVE-2018-19052 issue affects lighttpd’s mod_alias_physical_handler (mod_alias.c): when a configured alias lacks a trailing '/' but the target path has one, there is potential directory traversal to the parent of the alias target. Public advisories confirm this vulnerability across multiple di...

PT-2018-3498

Name of the Vulnerable Software and Affected Versions: lighttpd versions prior to 1.4.50 Description: An issue was discovered in mod alias physical handler in mod alias.c, allowing potential ../ path traversal of a single directory above an alias target. This occurs with a specific mod alias...