462 matches found
Mandriva Linux Security Advisory : apache (MDVSA-2014:142)
Updated apache package fixes security vulnerabilities : A race condition flaw, leading to heap-based buffer overflows, was found in the modstatus httpd module. A remote attacker able to access a status page served by modstatus on a server using a threaded Multi-Processing Module MPM could send a...
Debian DSA-2989-1 : apache2 - security update
Several security issues were found in the Apache HTTP server. - CVE-2014-0118 The DEFLATE input filter inflates request bodies in moddeflate allows remote attackers to cause a denial of service resource consumption via crafted request data that decompresses to a much larger size. - CVE-2014-0226 ...
[SECURITY] [DSA 2989-1] apache2 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2989-1 [email protected] http://www.debian.org/security/ Stefan Fritsch July 24, 2014 http://www.debian.org/security/faq -...
Debian Security Advisory DSA 2989-1 (apache2 - security update)
Several security issues were found in the Apache HTTP server. CVE-2014-0118 The DEFLATE input filter inflates request bodies in moddeflate allows remote attackers to cause a denial of service resource consumption via crafted request data that decompresses to a much larger size. CVE-2014-0226 A ra...
DSA-2989-1 apache2 - security update
Bulletin has no description...
Scientific Linux Security Update : httpd on SL5.x, SL6.x i386/x86_64 (20140723)
A race condition flaw, leading to heap-based buffer overflows, was found in the modstatus httpd module. A remote attacker able to access a status page served by modstatus on a server using a threaded Multi-Processing Module MPM could send a specially crafted request that would cause the httpd chi...
httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update
CentOS Errata and Security Advisory CESA-2014:0921 Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...
apache22 -- several vulnerabilities
Apache HTTP SERVER PROJECT reports: moddeflate: The DEFLATE input filter inflates request bodies now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit,...
Zeus Web Server 3.x Null Terminated Strings Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/977/info Appending %00 to the end of a CGI script filename will permit a remote client to view full contents of the script if the CGI module option allow CGIs anywhere is enabled. Scripts located in directories which are...
Apache suEXEC Privilege Elevation / Information Disclosure
No description provided by source. Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web server. Normally, when a CGI ...
Computer Software Manufaktur Alibaba 2.0 Piped Command Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1485/info Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine...
BizDesign ImageFolio 2.x/3.0.1 nph-build.cgi XSS
No description provided by source. source: http://www.securityfocus.com/bid/6265/info Reportedly, ImageFolio is prone to cross site scripting attacks due to insufficient sanitization of user-supplied input. The vulnerability exists in various cgi scripts included with ImageFolio. As a result, it ...
CNC Technology BizDB 1.0 bizdb-search.cgi Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1104/info BizDB is a web databse integration product using perl CGI scripts. One of the scripts, bizdb-search.cgi, passes a variable's contents to an unchecked open call and can therefore be made to execute commands at th...
BizDesign ImageFolio 2.x/3.0.1 imageFolio.cgi direct Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/6265/info Reportedly, ImageFolio is prone to cross site scripting attacks due to insufficient sanitization of user-supplied input. The vulnerability exists in various cgi scripts included with ImageFolio. As a result, it ...
D-Link WBR-1310 Authentication Bypass Vulnerability
No description provided by source. Exploit Title: D-Link WBR-1310 Authentication Bypass Vulnerability Shodan Dork: Embedded HTTP Server 2.00 Date: 22-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dlink.com/products/?pid=474 Version: 2.00 Tested on: WBR-1301, firmware versio...
Power Up HTML 0.8033 beta Directory Traversal Arbitrary File Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/3304/info Power Up HTML is a set of HTML-like commands that can be placed into web pages. It provides a central routing point to simplify programming and customization of CGI scripts. A vulnerability exists in Power Up HT...
Python CGIHTTPServer - Encoded Directory Traversal
Advisory: Python CGIHTTPServer File Disclosure and Potential Code Execution The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root...
Python CGIHTTPServer File Disclosure / Code Execution
Advisory: Python CGIHTTPServer File Disclosure and Potential Code Execution The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary CGI scripts in the server's document root...
Apache Httpd < 2.4.10 : mod_cgid denial of service
A flaw was found in modcgid. If a server using modcgid hosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang indefinitely, leading to denial of service...
SuSE 11.3 Security Update : nagios (SAT Patch Number 9071)
The monitoring service Nagios has been updated to fix potential buffer overflows in its CGI scripts. CVE-2014-1878 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyrig...