7206 matches found
PT-2026-113746
Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A flaw exists in the reverse proxy feature of BusyBox httpd. When the proxy is configured to forward requests matching a URL prefix to a backend server, it only rewrites the path for the firs...
CLSA-2026-1791914243 httpd: Fix of 6 CVEs
CVE-2026-42356: do not run the target of a CGI internal redirect with the handler derived from the CGI request's trusted content type - CVE-2026-63686: fix modxml2enc NULL pointer dereference when a charset conversion partially succeeds and then fails - CVE-2026-63718: fix modproxyuwsgi response...
DEBIAN-CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
AZL-108318 CVE-2026-88834 affecting package busybox 1.36.1-27
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
EUVD-2026-98899
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
CVE-2026-88834 Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
CVE-2026-88834
A flaw in BusyBox's httpd web server allows for a user existence oracle when configured with system password authentication. In certain build configurations, an attacker can distinguish between existing and non-existing usernames by observing authentication failure behaviors. The impact is limite...
CVE-2026-88834 Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
CVE-2026-88834
A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...
EG Secure Solutions SiteGuard Server Edition for Apache httpd: Command injection vulnerability
EG Secure Solutions SiteGuard Server Edition for Apache httpd has a command injection vulnerability. This vulnerability stems from OS command injection, and it may allow attackers to execute arbitrary OS commands with root or SYSTEM privileges on the system where the affected product is running...
Security update 5.2.1 for Multi-Linux Manager Server, Proxy and Retail Branch Server
Description: This update fixes the following issues: proxy-httpd-image: Version 5.2.10 Image rebuilt to the newest version with updated dependencies for SUSE Multi-Linux Manager 5.2.1 proxy-salt-broker-image: Version 5.2.9 Image rebuilt to the newest version with updated dependencies for SUSE...
CLSA-2026-1791889844 httpd: Fix of 11 CVEs
CVE-2026-63718: modproxyuwsgi: drop hop-by-hop headers from the backend response - CVE-2026-73636: modauthdigest: accept a one-time nonce only once, also when the client entry was garbage collected - CVE-2026-73637: modauthdigest: don't use a client entry outside the client lock - CVE-2026-48005:...
CLSA-2026-1791883129 httpd: Fix of CVE-2026-42356
CVE-2026-42356: fix execution of the target of a local redirect from a CGI script as a CGI script...
CLSA-2026-1791881377 httpd: Fix of CVE-2026-42356
CVE-2026-42356: do not propagate the trusted content-type flag to the target of an internal redirect from a CGI, so it is not run with the wrong handler...