Node.js third-party modules: [static-resource-server] Path Traversal allows to read content of arbitrary file on the server

Module module name: static-resource-server version: 1.7.2 npm page: https://www.npmjs.com/package/static-resource-server Module Description A tiny http server that provides local static resource access Module Stats Replace stats below with numbers from npm’s module page: 0 downloads in the last d...

SUSE-SU-2018:3582-1 Security update for apache2

This update for apache2 fixes the following issues: Security issues fixed: - CVE-2018-11763: In Apache HTTP Server by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2...

Security Bulletin: Multiple vulnerabilities GSKit bundled with IBM HTTP Server

Summary There are multiple vulnerabilities in the GSKit component that is included in the IBM HTTP Server used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a side-channel...

Multiple Tenda products httpd buffer overflow vulnerability (CNVD-2019-01886)

Tenda AC7 and others are wireless router products from Tenda in China. httpd is one of the HTTP server components. A buffer overflow vulnerability exists in httpd in several Tenda products, which can be exploited by an attacker to disclose sensitive information or hijack program control flow...

RouterOS HTTP Server DoS

The vulnerability of the HTTP-server of the RouterOS operating system for MikroTik relates to buffer overflows in memory during recursive processing of JSON requests. Exploiting this vulnerability allows a malicious actor to cause a malfunction of the HTTP-server by using a specially crafted...

Multiple Tenda products httpd buffer overflow vulnerability (CNVD-2019-01888)

Tenda AC7 and others are wireless router products from Tenda in China. httpd is one of the HTTP server components. A buffer overflow vulnerability exists in httpd in several Tenda products, which can be exploited by an attacker to cause a denial of service overwriting the return value of a functi...

Multiple Tenda products httpd buffer overflow vulnerability (CNVD-2019-01885)

Tenda AC7 and others are wireless router products from Tenda in China. httpd is one of the HTTP server components. A buffer overflow vulnerability exists in httpd in several Tenda products, which can be exploited by an attacker to cause a denial of service overwrite the return address of a functi...

org.eclipse.rdf4j:rdf4j-assembly (1.0), org.eclipse.rdf4j:rdf4j-console (1.0) +13 more potentially affected by CVE-2018-1000644 via org.eclipse.rdf4j:rdf4j-runtime (1.0)

org.eclipse.rdf4j:rdf4j-runtime MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.rdf4j:rdf4j-runtime and may be impacted: - org.eclipse.rdf4j:rdf4j-assembly 1.0 - org.eclipse.rdf4j:rdf4j-console 1.0 -...

org.eclipse.rdf4j:rdf4j-assembly (1.0m1), org.eclipse.rdf4j:rdf4j-console (1.0m1) +13 more potentially affected by CVE-2018-1000644 via org.eclipse.rdf4j:rdf4j-runtime (1.0m1)

org.eclipse.rdf4j:rdf4j-runtime MAVEN version 1.0m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.rdf4j:rdf4j-runtime and may be impacted: - org.eclipse.rdf4j:rdf4j-assembly 1.0m1 - org.eclipse.rdf4j:rdf4j-console 1.0m1 -...

org.eclipse.rdf4j:rdf4j-assembly (1.0m2), org.eclipse.rdf4j:rdf4j-console (1.0m2) +13 more potentially affected by CVE-2018-1000644 via org.eclipse.rdf4j:rdf4j-runtime (1.0m2)

org.eclipse.rdf4j:rdf4j-runtime MAVEN version 1.0m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.rdf4j:rdf4j-runtime and may be impacted: - org.eclipse.rdf4j:rdf4j-assembly 1.0m2 - org.eclipse.rdf4j:rdf4j-console 1.0m2 -...

PT-2018-2716

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.37 and prior Description The issue is related to errors in resource management in the mod http2 module of the Apache HTTP Server, which can lead to uncontrolled resource consumption. An attacker can exploit this...

Fedora 27 : libgit2 (2018-7d993184f6)

Update to 0.26.7 CVE-2018-17456 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Cisco Prime Infrastructure Arbitrary File Upload Vulnerability

Cisco Prime Infrastructure PI is a set of Cisco Prime LAN Management Solution LMS and Cisco Prime Network Control System NCS technologies for wireless management. solution. An arbitrary file upload vulnerability exists in the HTTP web server of Cisco Prime Infrastructure PI versions 3.2 through...

PT-2018-2717

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.37 and prior Description The issue is related to the mod session module in Apache HTTP Server, where the session expiry time is checked before decoding the session. This causes the session expiry time to be...

Apache Httpd < 2.4.38 : mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsessioncookie sessions since the expiry time is loaded when the session is decoded...

Microsoft Excel .SLK Payload Delivery

This module generates a download and execute Powershell command to be placed in an .SLK Excel spreadsheet. When executed, it will retrieve a payload via HTTP from a web server. When the file is opened, the user will be prompted to "Enable Content." Once this is pressed, the payload will execute...

Amazon Linux AMI : mod_perl / mod24_perl (ALAS-2018-1085)

modperl allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users...

Apache HTTP Server DoS

The vulnerability of the Apache HTTP Server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to cause service interruptions by exhausting the number of simultaneous connections through continuous sending of Maximum Size SETTINGS type fram...

Malicious Git HTTP Server For CVE-2018-17456

This module exploits CVE-2018-17456, which affects Git versions 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, and 2.19.1 and lower. When a submodule url which starts with a dash e.g "-u./payload" is passed as an argument to git clone, the file "payload" inside the repository is executed. This module...

Ubuntu 18.04 LTS : Apache HTTP Server vulnerabilities (USN-3783-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3783-1 advisory. Robert Swiecki discovered that the Apache HTTP Server HTTP/2 module incorrectly destroyed certain streams. A remote attacker could possibly use this issu...