Ubuntu 14.04 LTS / 16.04 LTS : nginx vulnerability (USN-3114-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3114-1 advisory. Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote attacker could possibly use this issue to obtain...

Debian DSA-3701-1 : nginx - security update

Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability www-data to root due to the way log files are handled. This security update changes ownership of the /var/log/nginx directory root. In addition, /var/log/nginx has to be made...

Amazon Linux: Security Advisory (ALAS-2016-715)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3114-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3114-1: nginx vulnerability

Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote attacker could possibly use this issue to obtain root privileges...

USN-3114-1 nginx vulnerability

Dawid Golunski discovered that the nginx package incorrectly handled log file permissions. A remote attacker could possibly use this issue to obtain root privileges...

[SECURITY] [DSA 3701-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3701-1 [email protected] https://www.debian.org/security/ Florian Weimer October 25, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3701-1 (nginx - security update)

Dawid Golunski reported the nginx web server packages in Debian suffered from a privilege escalation vulnerability www-data to root due to the way log files are handled. This security update changes ownership of the /var/log/nginx directory root. In addition, /var/log/nginx has to be made...

DSA-3701-1 nginx - security update

Bulletin has no description...

CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

UBUNTU-CVE-2016-1247

The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access...

Debian: Security Advisory (DSA-3701-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

yawast - The YAWAST Antecedent Web Application Security Toolkit

YAWAST is an application meant to simplify initial analysis and information gathering for penetration testers and security auditors. It performs basic checks in these categories: TLS/SSL - Versions and cipher suites supported; common issues. Information Disclosure - Checks for common information...

MLM Unilevel Plan Script 1.0.2 SQL Injection

Application Name : MLM Unilevel Plan Script v1.0.2 Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL Author Contact : https://twitter.com/byn4tural Vendor Homepage : http://www.i-netsolution.com/ Vulnerable Type : SQL Injection Date : 2016-10-06 Tested on : Windows 10 / Mozilla...

MLM Unilevel Plan Script 1.0.2 - SQL Injection

MLM Unilevel Plan Script 1.0.2 - SQL Injection Application Name : MLM Unilevel Plan Script v1.0.2 Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL Author Contact : https://twitter.com/byn4tural Vendor Homepage : http://www.i-netsolution.com/ Vulnerable Type : SQL Injection Date :...

SOL08250500 - Nginx vulnerability CVE-2016-4450

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

OpenSSL OCSP status request extension there is a serious vulnerability-a vulnerability warning-the black bar safety net

Overview OpenSSL OCSP status request extension there is a serious vulnerability, the vulnerability to make a malicious client can exhaust server memory. The use of the vulnerability, to make the default configuration of the server on each Protocol heavy commercial division with a period of OCSP i...

Coinbase: Information leakage on https://docs.gdax.com

docs.gdax.com was exposing the nginx version in error pages. We changed the nginx configuration to not report that information as a defense-in-depth measure...

IRCCloud: Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCE

Summary ======== During my reconnaissance for your bug bounty program, I discovered an instance of nginx version 1.4.6 running at the IP address https://54.153.101.52. To locate it, I search for IRCCloud-related certificated and found the self-signed certificate for this server...

Raptor Web Application Firewall

Raptor Web Application Firewall Raptor Web Application Firewall is a simple web application firewall made in C, using KISS principle , to make poll use select function, is not better than epoll or kqueue from BSD but is portable, the core of match engine using DFA to detect XSS, SQLi and path...