CVE-2020-5899

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address ...

CVE-2020-5899

The CVE-2020-5899 issue affects NGINX Controller (3.0.0–3.4.0). The recovery/token used to change a user’s password is transmitted and stored in the database in plaintext, enabling an attacker with DB access or interception to request a password reset for another user and retrieve the recovery co...

CVE-2020-5900

CVE-2020-5900 affects NGINX Controller components across versions 1.0.1, 2.0.0–2.9.0, and 3.0.0–3.4.0, with insufficient CSRF protections on the user interface. The Red Hat and F5 advisories confirm the vulnerability allows an attacker to induce the victim to perform arbitrary actions in the web ...

CVE-2020-5900

In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery CSRF protections for the NGINX Controller user interface...

Directory Traversal

djangosendfile2 is vulnerable to directory traversal. The vulnerability exists as the nginx backend does not limit file paths to the SENDFILEROOT...

CVE-2020-11959

An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50...

Design/Logic Flaw

An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50...

CVE-2020-11959

An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50...

CVE-2020-11959

CVE-2020-11959 : The issue arises from an unsafe configuration of nginx in the Xiaomi router R3600 ROM prior to version 1.0.50, leading to information leakage. The vulnerability affects the router’s handling of its web services, with the root cause described as an unsafe configuration rather than...

Exploit for Improper Encoding or Escaping of Output in F5 Nginx

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID is not explicitly stated, but the repository contains various vulnerable environments and exploits for different vulnerabilities, including CVE-2016-9086, CVE-2017-1000353, CVE-2013-4547,...

The vulnerability of the Analytics, Visibility, and Reporting services of the NGINX Controller monitoring and management application platform allows a hacker to execute arbitrary code.

The vulnerability of the Analytics, Visibility, and Reporting services of the NGINX Controller monitoring and management platform is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

EulerOS 2.0 SP2 : nginx (EulerOS-SA-2020-1644)

According to the version of the nginx package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read...

Huawei EulerOS: Security Advisory for nginx (EulerOS-SA-2020-1644)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

vulhub

This is an open-source collection of pre-built vulnerable docker environments. It is not a PoC exploit for a specific CVE, but rather a toolkit for testing and learning about various vulnerabilities. The primary purpose of Vulhub is to provide a simple way to create and run vulnerable environment...

F5 NGINX Controller Authorization Issue Vulnerability (CNVD-2020-51553)

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. An authorization issue vulnerability exists in F5 NGINX Controller versions 3.0.0 through 3.4.0 in NGINX Controller...

F5 NGINX Controller Cross-Site Request Forgery Vulnerability

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A cross-site request forgery vulnerability exists in the NGINX Controller user interface in F5 NGINX Controller...

F5 NGINX Controller Cross-Site Scripting Vulnerability

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A cross-site scripting vulnerability exists in the NGINX Controller API in F5 NGINX Controller versions 3.3.0 throu...

Radancy: [www.werkenbijbakertilly.nl] Information Disclosure

the 50x status code server responded with an html page containing the nginx version. an update of the loadbalancer fixed the issue. Summary When the web server encountered a 502 GateWay error, I discovered a strange bug in which internal information was exposed. Description When web server 502...

vulhub

It is an offensive tool for web application security training. The target product/service or framework is a collection of vulnerable environments based on Docker-Compose, including Flask, Apache, Nginx, and others. The vulnerability class/vector is various, including SQL injection, cross-site...

nginx.2469901.n2.nabble.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1181869 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...