CVE-2009-3896

CVE-2009-3896 affects nginx and its parsing path: the ngx_http_process_request_headers() function in ngx_http_parse.c can dereference a NULL pointer when handling long URIs, leading to denial of service via worker crash. The cited public sources (e.g., GLSA 201203-22) document multiple nginx vuln...

CVE-2009-3898

The CVE-2009-3898 issue affects nginx (Engine X) in the WebDAV module (src/http/modules/ngx_http_dav_module.c). A directory traversal flaw via the Destination header in COPY or MOVE can allow remote authenticated users to create or overwrite arbitrary files. Affected versions are nginx before 0.7...

CVE-2009-3898: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in src/http/modules/ngxhttpdavmodule.c in nginx aka Engine X before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. dot dot in the Destination HTTP header for the WebDAV 1 COPY or 2 MOVE method...

nginx 0.7.61 WebDAV directory traversal

No description provided by source. Bug Title: nginx webdav copy/move method directory traversal Program: nginx Version: nginx/0.7.61 - other versions may also be affected Website: http://sysoev.ru/nginx/ Severity: Low Date discovered: 23 September 2009 The webdav component has to be enabled and t...