7179 matches found
CVE-2020-5895
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault SIGSEGV by writing malformed...
CVE-2020-5894
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
CVE-2020-5894
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
CVE-2020-5895
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault SIGSEGV by writing malformed...
CVE-2020-5894
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
Design/Logic Flaw
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault SIGSEGV by writing malformed...
Design/Logic Flaw
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
CVE-2020-5895
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault SIGSEGV by writing malformed...
CVE-2020-5895
CVE-2020-5895 affects NGINX Controller AVRD in versions 3.1.0–3.3.0, where AVRD sockets are world-readable and world-writable, allowing a local attacker to write arbitrary data and trigger a segmentation fault by sending malformed messages. Remediation: upgrade to 3.4.0 (per advisory) and/or depl...
CVE-2020-5895
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault SIGSEGV by writing malformed...
CVE-2020-5894
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out...
CVE-2020-5894
The CVE-2020-5894 issue affects NGINX Controller webserver versions 3.0.0–3.3.0. The root cause is that server-side session tokens are not invalidated after logout, enabling a remote attacker who has a valid token to reuse it until it expires. The official advisory indicates that upgrades to 3.4....
SUSE SLES15 Security Update : nginx (SUSE-SU-2020:1171-1)
This update for nginx fixes the following issues : nginx was updated to 1.16.1 jscECO-1401 Added TLS 1.3 support jscSLE-9295, bsc1150711 Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 jscSLE-11184, bsc1156202 Started nginx after network is online bsc1155690 CVE-2019-20372: Fixed an HTT...
Nginx Vulnerabilities Jul 2017 - Oct 2019
Summary Symantec SWG products using affected versions of Nginx may be susceptible to multiple Nginx vulnerabilities. A remote attacker can use crafted requests to obtain sensitive information or cause denial of service. An attacker can also obtain sensitive information or cause denial of service ...
Exploit for Out-of-bounds Write in Php
PoC CVE-2019-11043 A Python implementation of the CVE-2019-110...
nginx Installed (Linux/UNIX)
Binary data nginxnixinstalled.nbin...
SUSE-SU-2020:1171-1 Security update for nginx
This update for nginx fixes the following issues: nginx was updated to 1.16.1 jscECO-1401 - Added TLS 1.3 support jscSLE-9295, bsc1150711 - Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 jscSLE-11184, bsc1156202 - Started nginx after network is online bsc1155690 - CVE-2019-20372: Fixed...
CVE-2020-12443
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...
CVE-2020-12443
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...
Directory traversal
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...