CVE-2019-11837

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxtutf8next in nxt/nxtutf8.h and njsstringoffset in njs/njsstring.c...

Code injection

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxtutf8next in nxt/nxtutf8.h and njsstringoffset in njs/njsstring.c...

Heap overflow

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njsarrayprototypesplice in njs/njsarray.c, because of njsarrayexpand size mishandling...

CVE-2019-11839

CVE-2019-11839 affects the NGINX NJS component (njs up to 0.3.1). The vulnerability is a heap-based buffer overflow in Array.prototype.push after a resize, caused by mishandling the size in njs_array_expand (njs/njs_array.c). Red Hat and other sources confirm this is a year‑old entry, with common...

CVE-2019-11838

CVE-2019-11838 concerns njs (used in NGINX) up to version 0.3.1, with a heap-based buffer overflow in Array.prototype.splice after a resize. The root cause is reported as mishandling the size in njs_array_expand, affecting njs_array_prototype_splice in njs/njs_array.c. Documents consistently desc...

CVE-2019-11838

njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njsarrayprototypesplice in njs/njsarray.c, because of njsarrayexpand size mishandling...

CVE-2019-11837

CVE-2019-11837 affects njs up to version 0.3.1 used in NGINX. The vulnerability is a segmentation fault in String.prototype.toBytes for negative arguments, tied to nxt_utf8_next (nxt/nxt_utf8.h) and njs_string_offset (njs/njs_string.c). The connected documents provide concrete technical details a...

CVE-2019-11837

njs through 0.3.1, used in NGINX, has a segmentation fault in String.prototype.toBytes for negative arguments, related to nxtutf8next in nxt/nxtutf8.h and njsstringoffset in njs/njsstring.c...

Fedora Update for nginx FEDORA-2018-7c540fdab4

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Denial Of Service (DoS)

nginx is vulnerable to denial of service DoS. The vulnerability exists through a null pointer dereference flaw when saving client request body to a temporary file...

Denial Of Service (DoS)

nginx is vulnerable to denial of service DoS. The vulnerability exists through processing the CNAME value in a DNS response...

Denial Of Service (DoS)

nginx is vulnerable to denial of service DoS. The vulnerability exists as nginx does not enforce sane limits on the value of CNAME...

NGINX Unit 0.x > 0.3 / 1.x < 1.7.1 Heap Buffer Overflow (CVE-2019-7401)

According to the self-reported version in its response header, the version of NGINX Unit hosted on the remote web server is 0.x later than 0.3 or 1.x prior to 1.7.1. It is, therefore, affected by a heap buffer overflow vulnerability in the router process. An unauthenticated, remote attacker can...

NGINX Unit HTTP Server Detection

Nessus was able to detect the NGINX Unit HTTP server by looking at the HTTP banner on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid124336; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/12";...

The vulnerability of the nginx web server module in Phusion Passenger, related to the simultaneous use of shared resources and synchronization errors, allows attackers to gain access to confidential data.

The vulnerability of the nginx web server module in Phusion Passenger is related to the simultaneous use of a shared resource and synchronization errors when the passengerinstanceregistrydir configuration is not set strictly enough. Exploiting this vulnerability can allow an attacker to gain acce...

DeepSync Sundray WLAN Controller Command Injection Vulnerability

Sundray WLAN Controller Sundray WAC is a set of wireless LAN controller software from China Sundray Network Technology Sundray. A security vulnerability exists in Sundray WAC 3.7.4.2 and previous versions of WAC. The vulnerability can be exploited by a remote attacker to read the...

CVE-2019-9161

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2019-9161

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2019-9161

WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system, because shell metacharacters in the nginxwebconsole.php Cookie header can be used to read an etc/config/wac/wnscfgadmindetail.xm...

CVE-2019-9161

CVE-2019-9161 affects Sangfor Sundray WLAN Controller (WAC) versions 3.7.4.2 and earlier. The issue is a remote code execution vulnerability where shell metacharacters in the nginx_webconsole.php Cookie header allow an attacker to read /etc/config/wac/wns_cfg_admin_detail.xml, exposing the admin ...