openSUSE Security Update : apache2-mod_fcgid (openSUSE-SU-2013:1664-1)

security issue fixed in apache2-modfcgid : loop counter handled incorrectly, leading to SEGV and 'Premature end of script headers' errors. bnc844935 CVE-2013-4365 This patch will be obsoleted by the next version update to 2.3.9 or higher. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:1138-1)

The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash CVE-2011-2483. After this update existing hashes with id '$2a$' for passwords that contain 8-bit characters will no longer be compatible with newly...

openSUSE Security Update : apache2 (openSUSE-SU-2012:0212-1)

This update fixes several security issues in the Apache2 webserver. CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a modproxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3607: Integer overflow in appregsub function resulting in a heap based...

openSUSE Security Update : apache2 (openSUSE-2011-55)

specially crafted requests could bypass RewriteRule and ProxyPassMatch - new template file: /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1 only, browser match stuff commented out. - rc script /etc/init.d/apache2: handle reload with deleted binaries by message to stdout only, but refrain...

openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:0276-1)

php5 was updated to fix several security issues. CVE-2010-3709, CVE-2010-4150, CVE-2010-4645, CVE-2010-4697, CVE-2010-4698, CVE-2010-4699, CVE-2010-4700, CVE-2011-0752, CVE-2011-0753, CVE-2011-0755,CVE-2011-0708, CVE-2011-0420 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

openSUSE Security Update : apache2 (openSUSE-SU-2013:0629-1)

apache2 was updated to fix : - fix for cross site scripting vulnerability in modbalancer. This is CVE-2012-4558 bnc807152 - fixes for low profile cross site scripting vulnerabilities, known as CVE-2012-3499 bnc806458 - Escape filename for the case that uploads are allowed with untrusted user's...

openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:1137-1)

The blowfish password hashing implementation did not properly handle 8-characters in passwords, which made it easier for attackers to crack the hash CVE-2011-2483. After this update existing hashes with id '$2a$' for passwords that contain 8-bit characters will no longer be compatible with newly...

openSUSE Security Update : apache2 (openSUSE-SU-2013:1337-1)

httpd-2.2.x-bnc829056-CVE-2013-1896-pr1482522-moddav.diff CVE-2013-1896: Sending a MERGE request against a URI handled by moddavsvn with the source href sent as part of the request body as XML pointing to a URI that is not configured for DAV will trigger a segfault. bnc829056 -...

openSUSE Security Update : apache2 (openSUSE-SU-2011:0859-1)

This update fixes : - CVE-2011-0419 and CVE-2011-1928: unconstrained recursion when processing patterns - CVE-2010-1623: a remote DoS memory leak in APR's reqtimeoutfilter function %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE Security Update : apache2 (openSUSE-SU-2012:0248-1)

This update fixes several security issues in the Apache2 webserver. CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a modproxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3607: Integer overflow in appregsub function resulting in a heap based...

openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:0645-1)

This php5 update fixes : - CVE-2011-0421: CVSS v2 Base Score: 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P: Input Validation CWE-20 - CVE-2011-1092: CVSS v2 Base Score: 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P: Numeric Errors CWE-189 - CVE-2011-1148: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P: Resource Managemen...

Madness Pro 1.14 Cross Site Scripting

!/usr/bin/env python2 -- coding: utf-8 -- Exploit Title: Madness Pro %3C%2Fscript%3E%3C%2Fa%3E" "%3Ca%20href%3D%22%23%22%20onclick%3D%5C%22setstatus\'12345".formatpanelindexurl, beefhookurl print f.re...

Madness Pro 1.14 - Persistent Cross-Site Scripting

Madness Pro 1.14 - Persistent Cross-Site Scripting !/usr/bin/env python2 -- coding: utf-8 -- Exploit Title: Madness Pro %3C%2Fscript%3E%3...

Madness Pro <= 1.14 Persistent XSS / SQL InjectionVulnerabilities

Exploit for php platform in category web applications !/usr/bin/env python2 -- coding: utf-8 -- Exploit Title: Madness Pro = 1.14 Persistent XSS Date: June 05, 2014 Exploit Author: @botnethunter Version: 1.14 Tested on: Apache2 - Ubuntu - MySQL ▄▄▌ ▄▄▄▄· ▄▄▄▄▄ • ▌ ▄ ·. ▄· ▄▌ ██• ▪ ▐█ ▀█▪▪ •██ ▪ ·...

Madness Pro 1.14 - Persistent Cross-Site Scripting

!/usr/bin/env python2 -- coding: utf-8 -- Exploit Title: Madness Pro %3C%2Fscript%3E%3C%2Fa%3E" "%3Ca%20href%3D%22%...

Fedora 19 : php-5.5.12-1.fc19 (2014-5984)

Notice: to fix CVE-2014-0185 this version change default php-fpm unix domain socket permission to 660 instead of 666. Check your configuration if php-fpm use UDS default configuration use a network socket. Upstream Changelog: 01 May 2014, PHP 5.5.12 Core : - Fixed bug 61019 Out of memory on comma...

Medium: mod_security

Issue Overview: apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header. Affected Packages: modsecurity Issue Correction: Run yum update modsecurity or yum upda...

Fedora 20 : php-5.5.12-1.fc20 (2014-5960)

Notice: to fix CVE-2014-0185 this version change default php-fpm unix domain socket permission to 660 instead of 666. Check your configuration if php-fpm use UDS default configuration use a network socket. Upstream Changelog: 01 May 2014, PHP 5.5.12 Core : - Fixed bug 61019 Out of memory on comma...

[USN-2105-1] MAAS vulnerabilities

========================================================================== Ubuntu Security Notice USN-2105-1 February 13, 2014 maas vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

Localize: Apache2 /icons/ folder accessible

The Apache2 icons folder is accessible from http://www.localize.io/icons/. This is not by definition dangerous, but removing the directory can help obfuscate the server version you're running, which may prevent targeted attacks against your web server. To remove the directory you should look for...