CVE-2015-3675

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the modhfsapple module, which allows remote attackers to bypass HTTP authentication via a crafted URL...

PT-2015-6273

Name of the Vulnerable Software and Affected Versions Apache HTTP Server on Apple OS X versions prior to 10.10.4 Description The issue concerns the default configuration of the Apache HTTP Server on Apple OS X, where the mod hfs apple module is not enabled. This allows remote attackers to bypass...

CVE-2015-3675: Improper Access Control

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the modhfsapple module, which allows remote attackers to bypass HTTP authentication via a crafted URL...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

CVE-2015-3200

The CVE-2015-3200 entry concerns lighttpd mod_auth prior to 1.4.36. A remote attacker can inject log entries via a basic-auth string without a colon, demonstrated using a NULL/newline in the string. Impact is log injection; some references note potential information exposure. Remediation exists: ...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

CVE-2015-3200

modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

PT-2015-6091

Name of the Vulnerable Software and Affected Versions lighttpd versions prior to 1.4.36 Description The issue allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character. This can be achieved by using a string containing a NULL and new...

lighttpd -- Log injection vulnerability in mod_auth

MITRE reports: modauth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character...

Unspecified Vulnerability in Websense TRITON AP-WEB

Websense TRITON is the Unified Content Architecture for data security. Websense TRITON AP-WEB HTTP authentication unspecified security vulnerability allows attackers to submit a special request to enumerate windows domain users...

CVE-2015-2762

Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication...

CVE-2015-2762

Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication...

CVE-2015-2762

Websense TRITON AP-WEB (before 8.0.0) is affected. The vulnerability allows remote attackers to enumerate Windows domain user accounts via HTTP authentication-related vectors. Root cause is exposure in the AP-WEB authentication flow prior to version 8.0.0. Impact includes potential information di...

PT-2015-5878

Name of the Vulnerable Software and Affected Versions Websense TRITON AP-WEB versions prior to 8.0.0 Description The issue allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication. Recommendations For versions prior to 8.0.0, update to version...

CVE-2015-2762: Exposure of Sensitive Information to an Unauthorized Actor

Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication...

Oracle Solaris Third-Party Patch Update : lighttpd (cve_2011_4362_denial_of)

The remote Solaris system is missing necessary patches to address security updates : - Integer signedness error in the base64decode function in the HTTP authentication functionality httpauth.c in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial...

ZTE ZXDSL 831CII Direct Object Reference

The modem usually serves html files & protects them with HTTP Basic authentication. however, the cgi files, does not get this protection. so simply requesting any cgi file without no authentication would give a remote attacker full access to the modem and then can easily be used to root the modem...

UBUNTU-CVE-2014-5015

bozotic HTTP server aka bozohttpd before 20140708, as used in NetBSD, truncates paths when checking .htpasswd restrictions, which allows remote attackers to bypass the HTTP authentication scheme and access restrictions via a long path...

PT-2014-6247

Name of the Vulnerable Software and Affected Versions bozotic HTTP server aka bozohttpd versions before 20140708 Description The issue allows remote attackers to bypass the HTTP authentication scheme and access restrictions. This is achieved by exploiting the path truncation when checking .htpass...