157 matches found
SUSE CVE-2017-8342
Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method...
SUSE CVE-2017-17663
The htpasswd implementation of minihttpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution...
WordPress WP htpasswd Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)
Software WP htpasswd Type Plugin Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25064 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2c981e0b60d7 Credits Rio Darmawan Required privilege...
CVE-2023-23596
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an...
Command injection
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an...
CVE-2023-23596
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an...
SimpleSAMLphp allows timing side-channel attacks
The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...
GHSA-V882-949X-6V28 SimpleSAMLphp allows timing side-channel attacks
The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...
Radicale is vulnerable to timing oracles and simple bruteforce attacks
Radicale before 1.1.2 and 2.0.0rc1 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method...
Whispers - Identify Hardcoded Secrets In Static Structured Text
"My little birds are everywhere, even in the North, they whisper to me the strangest stories." - Lord Varys Whispers is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can...
httpd:2.4 security, bug fix, and enhancement update
httpd 2.4.37-39.0.1 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracles index page oracleindex.html 2.4.37-39 - prevent htcacheclean from while break when first file processed 2.4.37-38 - Resolves: 1918741 - Thousands of /tmp/modproxy.tmp. files created by...
Debian DLA-2187-1 : radicale security update
Radicale, a simple calendar and addressbook server - daemon, is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 8 'Jessie', this problem has been fixed in version 0.9-1+deb8u2. We recommend that you upgrade your radicale packages...
[SECURITY] [DLA 2187-1] radicale security update
Package : radicale Version : 0.9-1+deb8u2 CVE ID : CVE-2017-8342 Radicale, a simple calendar and addressbook server - daemon, is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 8 "Jessie", this problem has been fixed in version...
httpd security, bug fix, and enhancement update
2.4.6-93.0.1 - replace index.html with Oracles index page oracleindex.html 2.4.6-93 - Resolves: 1677496 - CVE-2018-17199 httpd: modsessioncookie does not respect expiry time 2.4.6-92 - htpasswd: add SHA-2 crypt support 1486889 2.4.6-91 - Resolves: 1630886 - scriptlet can fail if hostname is not...
thttpd code issue vulnerability
thttpd is a lightweight open source web server from ACME Labs. A code issue vulnerability exists in thttpd, which can be exploited by an attacker to cause a denial of service with the help of a specially crafted .htpasswd file...
CVE-2012-5640
thttpd has a local DoS vulnerability via specially-crafted .htpasswd files...
Design/Logic Flaw
thttpd has a local DoS vulnerability via specially-crafted .htpasswd files...
CVE-2012-5640
thttpd has a local DoS vulnerability via specially-crafted .htpasswd files...
CVE-2012-5640
CVE-2012-5640 affects thttpd,; local DoS via specially crafted .htpasswd files. The OSV openSUSE entry notes a fix in thttpd-2.26-4.7 for GA media; other connected entries reiterate the local DoS vector. Exploitation status is not detailed in the provided documents. Monitor for updated advisories...
