6911 matches found
Improper Input Validation Leads to Privilege Escalation and Denial of Service
Description Improper input validation allows an attacker to privilege escalation and can make crash nginx server. There is no input validation in the v-add-web-domain-redirectL82, and "v-redirect-custom" input on the "Edit Web Domain" page, inputs are written directly to the...
Internet Bug Bounty: Off-by-slash vulnerability in nodejs.org and iojs.org
Original Report: https://hackerone.com/reports/1631350 The reason for submitting this report is written in the comment of the original report. ---- Summary: Configuration files for Nginx in nodejs/build repository have multiple off-by-slash misconfigurations. Because nodejs.org and iojs.org are...
Roxy-WI Remote Command Execution Exploit
This Metasploit module exploits an unauthenticated command injection vulnerability in Roxy-WI versions prior to 6.1.1.0. Successful exploitation results in remote code execution under the context of the web server user. Roxy-WI is an interface for managing HAProxy, Nginx and Keepalived servers...
Roxy-WI Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Roxy-WI Prior to 6.1.1.0 Unauthenticated Command Injection RCE', 'Description' = %q This module exploits an unauthenticated command injection...
HTTP Request Smuggling
libhttp-daemon-per is vulnerable to HTTP request smuggling. The vulnerability exists because most Perl based applications are served on top of Nginx or Apache, not on the HTTP::Daemon which allows an attacker to gain privileged access to APIs or poison intermediate caches...
Vulnerability of the njs_value_own_enumerate() function (src/njs_value.c) in the njs interpreter of the nginx server, allowing a hacker to execute arbitrary code
The vulnerability of the njsvalueownenumerate function src/njsvalue.c in the njs interpreter of the nginx server is related to the execution of an operation outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Vulnerability of the njs_djb_hash() function (src/njs_djb_hash.c) in the njs interpreter of the nginx server, allowing a hacker to execute arbitrary code
The vulnerability of the njsdjbhash function src/njsdjbhash.c in the njs interpreter of the nginx server is related to the execution of an operation outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Vulnerability of the njs_value_property() function (njs_value.c) in the njs interpreter of the nginx server, allowing a hacker to execute arbitrary code
The vulnerability of the njsvalueproperty function njsvalue.c in the njs interpreter of the nginx server is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Vulnerability of the njs_utf8_next() function (src/njs_utf8.h) in the njs interpreter of the nginx server, allowing a attacker to execute arbitrary code
The vulnerability of the njsutf8next function src/njsutf8.h in the njs interpreter of the nginx server is related to the execution of an operation outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Vulnerability of the njs_scope_value() function (njs_scope.h) in the njs interpreter of the nginx server, allowing a hacker to execute arbitrary code
The vulnerability of the njsscopevalue function njsscope.h in the njs interpreter of the nginx server is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Vulnerability of the njs_value_to_number() function (src/njs_value_conversion.h) in the njs interpreter of the nginx server, allowing a hacker to execute arbitrary code
The vulnerability of the njsvaluetonumber function src/njsvalueconversion.h in the njs interpreter of the nginx server is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the njs_vmcode_interpreter function (src/njs_vmcode.c) in the njs interpreter of the nginx server allows a hacker to cause a service failure.
The vulnerability of the njsvmcodeinterpreter function src/njsvmcode.c in the njs interpreter of the nginx server involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
CVE-2022-34032
Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njsvalueownenumerate at src/njsvalue.c...
CVE-2022-34032
Nginx NJS v0.7.5 was discovered to contain a segmentation violation in the function njsvalueownenumerate at src/njsvalue.c...
CVE-2022-34030
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsdjbhash at src/njsdjbhash.c...
CVE-2022-34027
Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njsvalueproperty at njsvalue.c...
CVE-2022-34027
Nginx NJS v0.7.4 was discovered to contain a segmentation violation via njsvalueproperty at njsvalue.c...
CVE-2022-34031
Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsvaluetonumber at src/njsvalueconversion.h...