Ubuntu 14.04 LTS : nginx vulnerability (USN-2351-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2351-1 advisory. Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certa...

USN-2351-1 nginx vulnerability

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certain configurations to obtain access to information from a different virtual host...

Debian DSA-3029-1 : nginx - security update

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Debian Security Advisory DSA 3029-1 (nginx - security update)

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position. OpenVAS Vulnerability Test $Id: deb3029.nasl 6735...

DSA-3029-1 nginx - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3029-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2014-3616

nginx 0.5.6 through 1.7.4, when using the same shared sslsessioncache or sslsessionticketkey for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks...

SUSE-RU-2015:0591-1 Recommended update for apache2-mod_nss

This update brings several improvements to apache2-modnss. More TLS 1.2 ciphers have been added, including AES-GCM and Camelia ciphers. These can be selected by their tags: o rsaaes128sha256 o rsaaes128gcmsha o rsaaes256sha256 o rsacamellia128sha o rsacamellia256sha o ecdhecdsaaes128gcmsha o...

Virtual Host Administrator 0.1 Modules_Dir Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22218/info Virtual Host Administrator is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application...

Qing bamboo virtual host management system sql injection vulnerability with the backend configured cookie login-vulnerability warning-the black bar safety net

Brief description: Qing bamboo virtual host management systemsql injectionvulnerability Detailed description: Qing bamboo virtual host management systemsql injectionvulnerability NCompany\Index. asp loadfilefromcache templatePath&"NCompany-Index.html" 'load index. html template...

Internet Bug Bounty: TLS Virtual Host Confusion

I am a security researcher at INRIA Paris in team PROSECCO http://prosecco.inria.fr We have been investigating a new class of attacks against the deployment of TLS on the Web. The main idea behind these attacks is that when two servers host different domains but share the same certificate which...

domain_dot

This plugin finds misconfigurations in the virtual host settings by sending a specially crafted request with a trailing dot in the domain name. For example, if the input for this plugin is http://host.tld/ , the plugin will perform a request to http://host.tld./ . In some misconfigurations, the...

Plesk Horde Detection

The remote web server is running Horde, an open source, PHP-based application framework from The Horde Project. This installation was detected on a web server configured with Parallels Plesk Panel, a web hosting control panel. Plesk pre-configures the Horde install with a virtual host such as...

N-point virtual host management system Business Edition SQL injection vulnerability-vulnerability warning-the black bar safety net

Brief description: All versions of N-point virtual host management system of the commercial version are receiving this vulnerability affects visually more than half of Taobao virtual host merchant caught quickly fix it N point is so I Detailed description:...

A domain name is a virtual host distribution management system 0day-vulnerability warning-the black bar safety net

google search: inurl:help/notice. asp? nid= Placed directly into the injection tool is injected directly can wait until the DBOWNER Background setinmanager...

Enterprise SEO professional website vulnerabilities and fixes-vulnerability warning-the black bar safety net

Program description: 1, upload to the virtual hostroot directory in. 2, If uploaded to the virtual host root directory is to modify the filespecial attention to modify the site configuration in the site address domain+“/” such as http://www. xxx. com/ or local test http://127.0.0.1/ then click on...

Debian Security Advisory DSA 2436-1 (libapache2-mod-fcgid)

The remote host is missing an update to libapache2-mod-fcgid announced via advisory DSA 2436-1. OpenVAS Vulnerability Test $Id: deb24361.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2436-1 libapache2-mod-fcgid Authors: Thomas Reinke Copyright: Copyright ...

Debian DSA-2452-1 : apache2 - insecure default configuration

Niels Heinen noticed a security issue with the default Apache configuration on Debian if certain scripting modules like modphp or modrivet are installed. The problem arises because the directory /usr/share/doc, which is mapped to the URL /doc, may contain example scripts that can be executed by...

A domain name is a virtual host distribution management system 0day-vulnerability warning-the black bar safety net

google search: inurl:help/notice. asp? nid= Placed directly into the injection tool is injected directly can wait until the DBOWNER Background setinmanager Table name segment does not tell you! You guys are hackers you know. Nerve haha...

Debian DSA-2436-1 : libapache2-mod-fcgid - inactive resource limits

It was discovered that the Apache FCGID module, a FastCGI implementation, did not properly enforce the FcgidMaxProcessesPerClass resource limit, rendering this control ineffective and potentially allowing a virtual host to consume excessive resources. %NASLMINLEVEL 70300 C Tenable Network Securit...