Apache Httpd < 2.4.33 : Possible write of after free on HTTP/2 stream shutdown

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.33 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerabilty hard to trigger in usual configurations, the reporter...

Apache Httpd < 2.4.33 : Possible out of bound read in mod_cache_socache

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.33 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of modcachesocache...

PT-2018-17282

Name of the Vulnerable Software and Affected Versions: AsusWRT versions prior to 3.0.0.4.384 10007 Description: An issue was discovered where the handle request function in router/httpd/httpd.c continues processing of POST requests even if authentication fails. Recommendations: For versions prior...

CVE-2018-6000: Missing Authorization

An issue was discovered in AsusWRT before 3.0.0.4.38410007. The dovpnuploadpost function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon or enable infosvr command mode,...

CVE-2018-5999: Undefined Security Weakness

An issue was discovered in AsusWRT before 3.0.0.4.38410007. In the handlerequest function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails...

CVE-2017-15112

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

CVE-2017-15111

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

Code injection

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

CVE-2017-15111

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

CVE-2017-15112: Exposure of Sensitive Information to an Unauthorized Actor

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

CVE-2017-15111: Insecure Temporary File

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

PT-2018-5769

Name of the Vulnerable Software and Affected Versions: keycloak-httpd-client-install versions prior to 0.8 Description: The issue allows users to insecurely pass passwords through the command line, potentially leaking them via command history and process information to other local users...

CVE-2017-15111

CVE-2017-15111 affects keycloak-httpd-client-install prior to version 0.8. It insecurely creates a temporary file in /tmp, enabling a local attacker to exploit a symbolic link to overwrite other files. This vulnerability is discussed in multiple advisories (RHSA-2019:2137, ALAS2-2019-1324, CES A-...

CVE-2017-15112

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

CVE-2017-15112

The CVE-2017-15112 issue affects keycloak-httpd-client-install, prior to version 0.8. The vulnerability is due to unsafe handling of the admin password on the command line, allowing the password to be exposed via shell history and process info to other local users. This mirrors the related CVE-20...

CVE-2017-15111

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link...

Fedora Update for keycloak-httpd-client-install FEDORA-2018-2299cfb708

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 27 : keycloak-httpd-client-install (2018-2299cfb708)

Security fix for CVE-2017-15111, CVE-2017-15112 Two minor security issues were discovered and were assigned CVE's. CVE-2017-15112 concerns the ability to pass a password on the command line where it could be exposed. That option has been deprecated. See the man page for multiple ways to pass the...

[SECURITY] Fedora 27 Update: keycloak-httpd-client-install-0.8-1.fc27

Keycloak is a federated Identity Provider IdP. Apache HTTPD supports a variety of authentication modules which can be configured to utilize a Keycloak IdP to perform authentication. This package contains libraries and tools which can automate and simplify configuring an Apache HTTPD authenticatio...

CVE-2018-5721

Stack-based buffer overflow in the ejupdatevariables function in router/httpd/web.c on ASUS routers when using software from https://github.com/RMerl/asuswrt-merlin allows web authenticated attackers to execute code via a request that updates a setting. In ejupdatevariables, the length of the...