12176 matches found
httpd: mod_auth_digest: access control bypass due to race condition
A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions...
httpd: URL normalization inconsistency
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...
Moderate: Red Hat Security Advisory: mercurial security update
An update for mercurial is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
CVE-2016-10786
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys SEC-186...
Design/Logic Flaw
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys SEC-186...
CVE-2016-10786
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys SEC-186...
CVE-2017-18429
In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...
CVE-2017-18428
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing SEC-290...
CVE-2017-18424
In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt SEC-274...
Code injection
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing SEC-290...
CVE-2017-18429
In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...
CVE-2017-18429
CVE-2017-18429 affects cPanel before 66.0.2. The issue is that Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). Several connected sources corroborate the same description, without detailing root cause, exploited vectors, or remediation steps in the pr...
CVE-2017-18428
CVE-2017-18428 affects cPanel prior to 66.0.2. During log processing, Apache HTTP Server domlogs become temporarily world-readable, exposing potentially sensitive log information. This is caused by the log handling behavior described in SEC-290. The vulnerability is a local issue with information...
CVE-2017-18428
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing SEC-290...
CVE-2017-18424
CVE-2017-18424 affects cPanel prior to 66.0.2. When the Apache HTTP Server configuration is rebuilt, the configuration file can become world-readable, exposing potentially sensitive configuration data. Root cause described as an issue in the rebuild process (SEC-274). Red Hat/CNVD/CVE records con...
CVE-2017-18424
In cPanel before 66.0.2, the Apache HTTP Server configuration file is changed to world-readable when rebuilt SEC-274...
Design/Logic Flaw
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename SEC-296...
CVE-2017-18412
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename SEC-296...
CVE-2017-18412
CVE-2017-18412 affects cPanel before 67.9999.103, where mishandling during an account rename allows Apache HTTP Server log files to become world-readable (information disclosure). Root cause: improper access control on log files. Impact is limited to partial confidentiality breach as described; n...