14807 matches found
Ubuntu 16.04 LTS / 18.04 LTS : Apache HTTP Server regression (USN-4113-2)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4113-2 advisory. USN-4113-1 fixed vulnerabilities in the Apache HTTP server. Unfortunately, that update introduced a regression when proxying balancer manager...
USN-4113-2 apache2 regression
USN-4113-1 fixed vulnerabilities in the Apache HTTP server. Unfortunately, that update introduced a regression when proxying balancer manager connections in some configurations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Stefan Eissing discovered...
USN-4113-2: Apache HTTP Server regression
USN-4113-1 fixed vulnerabilities in the Apache HTTP server. Unfortunately, that update introduced a regression when proxying balancer manager connections in some configurations. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Stefan Eissing discovered...
CVE-2019-5054
An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 WNR2000v5 with Firmware Version V1.0.0.70 HTTP server. An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference,...
Null pointer dereference
An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 WNR2000v5 with Firmware Version V1.0.0.70 HTTP server. An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference,...
CVE-2019-5054
The CVE is confirmed in NETGEAR N300 WNR2000v5 with firmware 1.0.0.70: an unauthenticated HTTP request containing an empty User-Agent to a page requiring authentication can trigger a null pointer dereference, crashing the HTTP server (DoS). TALOS-2019-0831 documents the flaw and notes firmware 1....
CVE-2019-5054
An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 WNR2000v5 with Firmware Version V1.0.0.70 HTTP server. An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference,...
Information Disclosure
Supervisor is vulnerable to unauthorized restart and information disclosure. It is possible because the inet HTTP server, which is not enabled by default, does not use authentication by default, allowing an unauthenticated user to access log files or restart a service if the inet HTTP server is...
CVE-2019-5054: NULL Pointer Dereference
An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 WNR2000v5 with Firmware Version V1.0.0.70 HTTP server. An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference,...
NETGEAR N300 Denial of Service Vulnerability
The NETGEAR N300 is a wireless router from NETGEAR. A security vulnerability exists in the session handling function in the HTTP server of the NETGEAR N300 WNR2000v5 using firmware version 1.0.0.70. An attacker can exploit the vulnerability to cause the HTTP service to crash with the help of an...
PT-2019-17440
Name of the Vulnerable Software and Affected Versions NETGEAR N300 WNR2000v5 version V1.0.0.70 Description A denial-of-service issue exists in the session handling functionality of the NETGEAR N300 HTTP server. This occurs when an HTTP request with an empty User-Agent string is sent to a page tha...
PYSEC-2019-126
DISPUTED In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inethttpserver, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. T...
PYSEC-2019-126
DISPUTED In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer responded that the affected component, inethttpserver, is not enabled by default but if the user enables it and does not set a password, Supervisor logs a warning message. T...
Apache: Multiple vulnerabilities
Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Multiple vulnerabilities have been discovered in Apache. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaroun...
Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities
Summary IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server. Vulnerability Details CVEID: CVE-2018-17199 DESCRIPTION: Apache HTTP Server could allow a remote attacker to bypass security restrictions, caused by checking the session expiry time before...
emacs, mercurial security update
CentOS Errata and Security Advisory CESA-2019:2276 An update for mercurial is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...
Ubuntu 16.04 LTS / 18.04 LTS : Apache HTTP Server vulnerabilities (USN-4113-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4113-1 advisory. Stefan Eissing discovered that the HTTP/2 implementation in Apache did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in some...
CentOS 7 : mercurial (CESA-2019:2276)
An update for mercurial is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
USN-4113-1: Apache HTTP Server vulnerabilities
Stefan Eissing discovered that the HTTP/2 implementation in Apache did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in some situations. A remote attacker could use this to cause a denial of service daemon crash. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.04...