ALPINE-CVE-2018-17082

The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the phphandler function in sapi/apache2handler/sapiapache2.c...

[SECURITY] Fedora 28 Update: mod_perl-2.0.10-11.fc28

Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Modperl links the Perl run-time library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a...

[SECURITY] Fedora 27 Update: mod_perl-2.0.10-9.fc27

Modperl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. Modperl links the Perl run-time library into the Apache web server and provides an object-oriented Perl interface for Apache's C language API. The end result is a...

[ASA-201807-12] apache: denial of service

Arch Linux Security Advisory ASA-201807-12 ========================================== Severity: Medium Date : 2018-07-20 CVE-ID : CVE-2018-1333 CVE-2018-8011 Package : apache Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-736 Summary ======= The package apache...

USN-3627-2 apache2 vulnerabilities

USN-3627-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for Ubuntu 18.04 LTS. Original advisory details: Alex Nichols and Jakob Hirsch discovered that the Apache HTTP Server modauthnzldap module incorrectly handled missing charset encoding headers. A...

Apache HTTP Server Remote Security Bypass Vulnerability

Apache HTTP Server is an open source web server from the Apache Software Foundation. A security bypass vulnerability exists in Apache httpd versions 2.2.0 through 2.4.29, which can be exploited by an attacker to bypass security restrictions and perform unauthorized operations via trailing newline...

CVE-2018-1233

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context ...

Cross site scripting

RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context ...

BSA-2018-556

Security Advisory ID : BSA-2018-556 Component : Apache HTTPD Revision : 2.0: Final The expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are...

BSA-2018-553

Security Advisory ID : BSA-2018-553 Component : Apache HTTPD Revision : 2.0: Final When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.33 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the...

DEBIAN-CVE-2018-1303

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of modcachesocache. The vulnerability is considere...

DEBIAN-CVE-2018-1301

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode both log and build level...

ALPINE-CVE-2017-15715

In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the...

UBUNTU-CVE-2018-1303

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of modcachesocache. The vulnerability is considere...

UBUNTU-CVE-2018-1302

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter...

UBUNTU-CVE-2018-1301

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode both log and build level...

App Layering: How to specify or disable SSL protocols and ciphers in the ELM

Modern security requirements often specify disabling certain SSL protocols or cipher families. The ELM uses an Apache web server daemon for accessing the Management Console UI. Citrix keeps the ELM deployment images up to date with modern requirements requiring TLS 1.2, disabling SSLv3, disabling...

b2evolution CMS 6.8.10 PHP Code Execution Vulnerability

Exploit for php platform in category web applications b2evolution CMS 6.6.0 - 6.8.10 PHP code execution Information =========== Name: b2evolution CMS 6.8.10 Software: b2evolution CMS Homepage: http://b2evolution.net/ Vulnerability: PHP code execution Prerequisites: publicly accessible /install...

b2evolution CMS 6.8.10 PHP Code Execution

b2evolution CMS 6.6.0 - 6.8.10 PHP code execution Information =========== Name: b2evolution CMS 6.8.10 Software: b2evolution CMS Homepage: http://b2evolution.net/ Vulnerability: PHP code execution Prerequisites: publicly accessible /install functionality CVE: CVE-2017-1000423 Credit: Anti RA$?is...

RSA Authentication Agent for Web for Apache 8.x < 8.0.1 Build 618 Filter Bypass

The version of RSA Authentication Agent for Web for Apache is 8.x prior to 8.0.1 Build 618. It is, therefore, potentially affected by an unspecified authentication bypass vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid105413; scriptversion"1.5";...