ModSecurity < 2.5.9 Multiple Remote DoS Vulnerabilities

ModSecurity is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-1903

The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service Apache httpd crash via a request for a PDF file that does not use the GET method...

CVE-2009-1903

ModSecurity (Apache module) prior to version 2.5.9 is affected by two CVEs; CVE-2009-1902 (NULL pointer dereference when processing multipart requests without a part header name) and CVE-2009-1903 (PDF XSS protection failing for PDF requests not using GET), leading to possible denial of service (...

Fedora 10 : mod_security-2.5.9-1.fc10 (2009-2686)

Security fixes for potential denials of service when using PDF XSS protection as well as when parsing multipart requests. http://sourceforge.net/project/shownotes.php?releaseid=667542&groupi d=68846 Note that Tenable Network Security has extracted the preceding description block directly from the...

Fedora Core 9 FEDORA-2009-2654 (mod_security)

The remote host is missing an update to modsecurity announced via advisory FEDORA-2009-2654. OpenVAS Vulnerability Test $Id: fcore20092654.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-2654 modsecurity Authors: Thomas Reinke Copyright: Copyright c...

Fedora Core 10 FEDORA-2009-2686 (mod_security)

The remote host is missing an update to modsecurity announced via advisory FEDORA-2009-2686. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...

Fedora Core 9 FEDORA-2009-2654 (mod_security)

The remote host is missing an update to modsecurity announced via advisory FEDORA-2009-2654. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...

[SECURITY] CVE-2009-0781 XSS in Apache Tomcat examples web application

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-0781: Apache Tomcat cross-site scripting vulnerability Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 6.0.0 to 6.0.18 Tomcat 5.5.0 to 5.5.27 Tomcat 4.1.0 to 4.1.39 Description: The calendar application in the...

Apache Tomcat Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2009-0781: Apache Tomcat cross-site scripting vulnerability Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 6.0.0 to 6.0.18 Tomcat 5.5.0 to 5.5.27 Tomcat 4.1.0 to 4.1.39 Description: The calendar application in the...

Cross site scripting

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows remote attackers to bypass the XSS protection mechanism and conduct XSS or redirection attacks, as demonstrated by the 1 Location and 2...

Cross site scripting

The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks via a CRLF sequence in conjunction with a crafted Content-Type header, as demonstrated by a header with a utf-7 charset value. NOTE: the vendor has...

CVE-2008-5554

The CVE-2008-5554 entry describes a vulnerability in Microsoft Internet Explorer 8.0 Beta 2 where the XSS Filter fails to properly handle certain HTTP headers that appear after a CRLF in a URI, permitting bypass of the XSS protection and enabling XSS or redirection via headers such as Location or...

CVE-2008-5551

Microsoft Internet Explorer 8.0 Beta 2 contains an anti-XSS filter bypass vulnerability (the XSS Filter) that allows XSS by injecting data at two positions in HTML documents (STYLE elements and the CSS expression property), described as a "double injection." The connected OpenVAS entry and relate...

CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

Cross site scripting

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...

CVE-2008-3219

The vulnerability CVE-2008-3219 affects Drupal: the filter_xss_admin function in Drupal 5.x before 5.8 and 6.x before 6.3 does not prevent use of the object HTML tag in administrator input. Impact is not clearly defined in the provided documents, with unknown potential attack vectors and an indic...

Cross site scripting

The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "" characters in the 1 issue parameter to scripts2/knowlegebase, 2 user parameter to...

CVE-2008-2070

The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "" characters in the 1 issue parameter to scripts2/knowlegebase, 2 user parameter to...

CVE-2008-2070

The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "" characters in the 1 issue parameter to scripts2/knowlegebase, 2 user parameter to...

CVE-2008-0644

Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to bypass the cross-site scripting XSS protection mechanism for applications via unspecified vectors related to the setEncoding function...