7025 matches found
CVE-2021-23021
CVE-2021-23021 affects NGINX Controller 3.x prior to 3.7.0. The vulnerability arises from the agent configuration file /etc/controller-agent/agent.conf being world-readable (644), enabling local attackers to access sensitive data (e.g., API keys). Remediation per multiple sources: upgrade to NGIN...
CVE-2021-23021
The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644...
CVE-2021-23018
Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster...
CVE-2021-23018
Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster...
Design/Logic Flaw
Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster...
CVE-2021-23019
The CVE-2021-23019 entry applies to NGINX Controller, affecting versions 2.0.0 through 2.9.0 and 3.x before 3.15.0. The root cause is exposure of the Administrator password in the systemd.txt file included in the NGINX support package. This credential exposure is the stated impact. Mitigation pro...
CVE-2021-23019
The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package...
CVE-2021-23018
Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster...
CVE-2021-23018
The CVE-2021-23018 issue affects NGINX Controller 3.x deployments where intra-cluster communication does not use TLS, leaving cleartext traffic between services inside the cluster. Affected versions are 3.x prior to 3.4.0. Root cause is unencrypted intra-cluster channels, enabling potential read/...
Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
The plugin allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution. The issue is being actively exploited, and no patch is available. Further details will be made available once pathed. The Custom Product Designer plugin for WordPress offers the ability for...
Debian DLA-2670-1 : nginx security update
Luis Merino, Markus Vervier and Eric Sesterhenn discovered an off-by-one in Nginx, a high-performance web and reverse proxy server, which could result in denial of service and potentially the execution of arbitrary code. For Debian 9 stretch, this problem has been fixed in version 1.10.3-1+deb9u6...
The vulnerability of the ngx_resolver_copy() function in the nginx server allows a hacker to execute arbitrary code or cause a service failure.
The vulnerability of the ngxresolvercopy function in the nginx server is related to a single-byte offset error during the writing of the point symbol '.', 0x2E beyond the buffer limit. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure by sending...
Debian DSA-4921-1 : nginx - security update
Luis Merino, Markus Vervier and Eric Sesterhenn discovered an off-by-one in Nginx, a high-performance web and reverse proxy server, which could result in denial of service and potentially the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...
SUSE SLES15 Security Update : nginx (SUSE-SU-2021:1815-1)
This update for nginx fixes the following issues : CVE-2021-23017: nginx DNS resolver off-by-one heap write bsc1186126 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format...
Nginx 控制器 安全漏洞
F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller that stems from the fact that intra-cluster communication do...
SUSE SLES15 Security Update : nginx (SUSE-SU-2021:1814-1)
This update for nginx fixes the following issues : CVE-2021-23017: nginx DNS resolver off-by-one heap write bsc1186126 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format...
PT-2021-7435 · Nginx · Nginx Controller
Name of the Vulnerable Software and Affected Versions: NGINX Controller versions 2.0.0 through 2.9.0 NGINX Controller versions 3.x before 3.15.0 Description: The issue is related to insufficient protection of registration data, which may allow an attacker to disclose protected information...
SUSE SLES15 Security Update : nginx (SUSE-SU-2021:1792-1)
This update for nginx fixes the following issues : CVE-2021-23017: nginx DNS resolver off-by-one heap write bsc1186126 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format...