8999 matches found
CVE-2024-39935
jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user with certificate management privileges via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5...
CVE-2024-39935
jc21 NGINX Proxy Manager versions prior to 2.11.3 are vulnerable to an OS command injection vulnerability in the backend/internal/certificate.js component. The issue arises because the application fails to neutralize special elements in the OS commands when processing untrusted input from the DNS...
CVE-2024-39935: Improper Neutralization of Special Elements used in an OS Command
jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user with certificate management privileges via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5...
CVE-2024-39935
jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user with certificate management privileges via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5...
Nginx Proxy Manager Security Vulnerability
Nginx Proxy Manager is a Docker container for Nginx Proxy Manager open source. It is used to manage Nginx proxy hosts through a simple and powerful interface. A security vulnerability exists in Nginx Proxy Manager versions prior to 2.11.3, which stems from a vulnerability that allows authenticate...
CVE-2024-39935
jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user with certificate management privileges via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5...
ROS-20240702-07
A vulnerability in the HTTP/3 QUIC module ngxhttpv3module of NGINX Plus and NGINX OSS web servers is related to writing outside of buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker acting remotely, cause a denial of service by using specially crafted HTTP/3...
unit:fuzz_json: Use-of-uninitialized-value in nxt_inet_addr
Project: https://github.com/nginx/unit.git Detailed Report: https://oss-fuzz.com/testcase?key=6031931821588480 Project: unit Fuzzing Engine: libFuzzer Fuzz Target: fuzzjson Job Type: libfuzzermsanunit Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: nxtinetadd...
PT-2024-6493
Name of the Vulnerable Software and Affected Versions NginxProxyManager version 2.11.3 Description A command injection issue exists in the requestLetsEncryptSsl function of NginxProxyManager. This allows a remote attacker to execute arbitrary commands by adding a specially crafted Let's Encrypt...
PT-2024-6554 · Unknown · Nginx Proxy Manager
Name of the Vulnerable Software and Affected Versions: NginxProxyManager version 2.11.3 Description: A command injection vulnerability in the requestLetsEncryptSslWithDnsChallenge function allows an attacker to achieve remote code execution via the "Add Let's Encrypt Certificate" feature. This...
GO-2024-2428 Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...
GO-2024-2481 Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive report...
GO-2024-2480 Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF in github.com/0xJacky/Nginx-UI
Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
Updated python-aiohttp packages fix security vulnerability
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server e.g. nginx for serving static files. Users following th...
Critical Photon OS Security Update - PHSA-2024-5.0-0302
Updates of 'go' packages of Photon OS have been released...
Moderate Photon OS Security Update - PHSA-2024-4.0-0638
Updates of 'nginx', 'libssh2' packages of Photon OS have been released...
Security Bulletin: Vulnerabilities in Linux components affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
Summary Vulnerabilities in libssh, nginx and nghttp2 affect IBM Storage Virtualize products and could cause denial of service and bypassing of authentication. CVE-2023-44487, CVE-2023-1667, CVE-2023-2283. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a...
OPENSUSE-SU-2024:12433-1 nginx-1.23.2-1.1 on GA media
These are all security issues fixed in the nginx-1.23.2-1.1 package on the GA media of openSUSE Tumbleweed...