nginx-devel -- multiple vulnerabilities

The nginx project reports: nginx 1.31.0 fixes multiple security issues affecting HTTP/2 proxying, rewrite handling, SCGI/uWSGI response handling, charset conversion, HTTP/3 connection migration, and OCSP resolver response processing...

F5 NGINX Plus和F5 NGINX Open Source 安全漏洞

F5 NGINX Plus and F5 NGINX Open Source are both products of the American company F5. F5 NGINX Plus is a software-based application delivery platform. F5 NGINX Open Source is a high-performance web server, reverse proxy server, load balancer, and API gateway. Both F5 NGINX Plus and F5 NGINX Open...

PT-2026-40682

Name of the Vulnerable Software and Affected Versions NGINX affected versions not specified Description An issue in the ngx http scgi module and ngx http uwsgi module modules can lead to excessive memory allocation or an over-read of data. When scgi pass or uwsgi pass is configured, an...

CVE-2024-53459

Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting XSS via the /scgi?sid parameter...

CVE-2024-53459

Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting XSS via the /scgi?sid parameter...

CVE-2024-53459

Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting XSS via the /scgi?sid parameter...

CVE-2024-53459

Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting XSS via the /scgi?sid parameter...

CVE-2024-53459

Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter. This CVE (CVE-2024-53459) is documented across multiple sources (NVD, Red Hat, CNVD, CVE listing, etc.) with no explicit exploit details or mitigation guidance provided in the connected records. The v...

CVE-2023-2384

CVE-2023-2384 affects Netgear SRX5308 Web Management Interface, specifically the file scgi-bin/platform.cgi?page=dmz_setup.htm. The vulnerability arises from insufficient input validation on the dhcp.SecDnsIPByte2 parameter, enabling remote cross-site scripting. Multiple sources confirm versions ...

CVE-2023-2381

CVE-2023-2381 affects Netgear SRX5308 Web Management Interface up to firmware 4.3.5-3. The vulnerability is a cross-site scripting flaw in the BandWidthProfile.ProfileName parameter within scgi-bin/platform.cgi?page=bandwidth_profile.htm, exploitable remotely and reportedly disclosed. Public refe...

SUSE CVE-2007-3950

lighttpd 1.4.15, when run on 32 bit platforms, allows remote attackers to cause a denial of service daemon crash via unspecified vectors involving the use of incompatible format specifiers in certain debugging messages in the 1 modscgi, 2 modfastcgi, and 3 modwebdav modules...

GHSA-R587-7JH2-4QR3 Server secret was included in static assets and served to clients

Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface which is unprotected and ALLOWS arbitrary code execution and usually wide-ranging privileges ...

Server secret was included in static assets and served to clients

Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface which is unprotected and ALLOWS arbitrary code execution and usually wide-ranging privileges ...

CVE-2020-13228

An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter...

CVE-2020-13229

An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token...

CVE-2020-13228

An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter...

CVE-2020-13229

An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token...

Cross site scripting

An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter...

CVE-2020-13228

An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter...

Directory traversal

Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter, for reading arbitrary files...