httpd: cookie exposure due to error responses

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request aka 400 error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a 1 long or 2 malformed header in...

Moderate: Red Hat Security Advisory: php security update

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Design/Logic Flaw

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request aka 400 error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a 1 long or 2 malformed header in...

DEBIAN-CVE-2012-0053

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request aka 400 error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a 1 long or 2 malformed header in...

DEBIAN-CVE-2012-0031

scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service daemon crash during shutdown or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free...

PT-2011-1265

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 1.x through 2.x before 2.2.15 Description The issue allows remote attackers to cause a denial of service, resulting in a daemon outage, via partial HTTP requests. This is related to the lack of the mod reqtimeout...

DEBIAN-CVE-2011-4317

The modproxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of 1 RewriteRule and 2 ProxyPassMatch pattern matches for configuration of a reverse proxy, which...

PT-2011-4554 · Apache +3 · Apache Http Server +3

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.0.x through 2.0.64 Apache HTTP Server versions 2.2.x before 2.2.18 Description: The issue arises from the mod proxy module's improper interaction with RewriteRule and ProxyPassMatch pattern matches when configure...

DEBIAN-CVE-2011-4415

The appregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the modsetenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service memory consumption or NULL...

Apache Server 2.3.14 Denial of Service (DDOS) Vulnerability exploit

Apache Server 2.3.14 Denial of Service DDOS Vulnerability exploit Latest version of Apache Server 2.3.14 fails.The Egyptian Hacker and Exploit writer "Xen0n " discovered this Vulnerability and Develop an perl exploit for DDOS Vulnerability. The Exploit is available on Inj3ct0r's Website...

Apache Server 2.3.14 Denial of Service (DDOS) Vulnerability exploit

Apache Server 2.3.14 Denial of Service DDOS Vulnerability exploit Latest version of Apache Server 2.3.14 fails.The Egyptian Hacker and Exploit writer "Xen0n" discovered this Vulnerability and Develop an perl exploit for DDOS Vulnerability. The Exploit is available on Inj3ct0r's Website...

Apache Server Denial of Service exploit (DDOS)

Exploit for windows platform in category dos / poc !/usr/bin/perl -w Exploit Title: Apache Server Denial of Service exploit DDOS Date: 22/10/2011 Author: Xen0n Software Link: http://www.apache.org/dyn/closer.cgi Version: 2.3.14 and older Tested on: CentOs feel free to contact us email protected u...

DEBIAN-CVE-2011-3348

The modproxyajp module in the Apache HTTP Server before 2.2.21, when used with modproxybalancer in certain configurations, allows remote attackers to cause a denial of service temporary "error state" in the backend server via a malformed HTTP request...

httpd: multiple ranges DoS

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service memory and CPU consumption via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different...

DEBIAN-CVE-2011-2688

SQL injection vulnerability in mysql/mysql-auth.pl in the modauthnzexternal module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field...

ZDI-11-238: Oracle Secure Backup validate_login Command Injection Remote Code Execution Vulnerability

ZDI-11-238: Oracle Secure Backup validatelogin Command Injection Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-238 July 21, 2011 -- CVE ID: CVE-2011-2261 -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P -- Affected Vendors: Oracle -- Affected Products: Oracle Secu...

Enable X-FRAME-Options header to implement clickjacking protection

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-25143. panel TLDR: Add X-FRAME-Options: SAMEORIGIN to all HTTPS pages server config, and test that nothing breaks. --- Description: Current...

Oracle Secure Backup validate_login Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Secure Backup. Authentication is not required to exploit this vulnerability. The specific flaw exists within the validatelogin function defined within /apache/htdocts/php/common.php. The...

Openslaed 1.2 Remote Shell Upload

?php / Vendor: www.slaed.net Download : http://www.slaed.net/uploads/files/public/openslaed.zip exploited by ..: eidelweiss Affected: Version 1.2 Other or lowers version may also be affected Greetz: yogyacarderlink Team, devilzc0de Team, Nofia Fitri unyu², whitehat, petimati, psycothicgirl, viska...

Open Slaed CMS v1.2 Remote Arbitrary File Upload Exploit

Exploit for php platform in category web applications ?php / Vendor: www.slaed.net Download : http://www.slaed.net/uploads/files/public/openslaed.zip exploited by ..: eidelweiss Affected: Version 1.2 Other or lowers version may also be affected Greetz: yogyacarderlink Team, devilzc0de Team, Nofia...