CVE-2026-108121

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from...

CVE-2026-108121

Koozali's SME Server version 11.0rc1-215 contains an improper input validation vulnerability within its domain creation functionality . An attacker with high privileges can exploit this flaw to inject reserved Apache configuration directives , which corrupts the httpd.conf file. This corruption p...

CVE-2026-108121 Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from...

CVE-2026-108121 Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from...

EUVD-2026-104069

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from...

GLPwn

GLPwn A GLPI hack tool, using Apache directory listing and / or CVE-2020-15175 to dump files and valid sessions. Who is vulnerable? Any GLPI instance that has Apache directory listing already enabled on the /files folder All GLPI instances prior to 9.5.1 running on a default Apache2 server. What...

PT-2026-117226

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from...

CVE-2026-87661

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during...

CVE-2026-87661

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during...

CVE-2026-87661

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during...

CVE-2026-87661

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are vulnerable to a persistent Denial of Service (DoS) . The flaw exists because the system directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configu...

PT-2026-107810

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during...

Persistent Denial of Service (DoS) affecting Brocade Fabric OS administrative web management service

: Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering durin...

Apache Configuration Injection via Unsanitized IdP Issuer Setting in Brocade Fabric OS Web Service Interface

: An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...

CVE-2026-100717

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2026-100717

The froxlor server administration panel (versions 2.3.10 and earlier ) contains a CRLF injection vulnerability. The Validate::validateUrl component fails to inspect the userinfo (user:pass@) portion of a URL for carriage return and line feed characters. An authenticated low-privilege customer wit...

CVE-2026-100717 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2021-41773

CVE-2021-41773 Apache HTTP服务器漏洞（仅影响2.4.49版本） 需求设置 httpd.conf ... LoadModule cgimodule modules/modcgi.so 取消注释这一行 ... AllowOverride none Require all denied 注释掉这一行或设置为Require all granted ... 参考 https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis...

EUVD-2026-70850

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

CVE-2026-67402

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...