7025 matches found
RedHat Update for subversion RHSA-2015:0165-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DEBIAN-CVE-2015-1548
minihttpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long protocol string, which triggers an incorrect response size calculation and an out-of-bounds read...
PT-2015-5344 · Acme +1 · Mini Httpd +1
Name of the Vulnerable Software and Affected Versions: mini httpd versions 1.21 and earlier Description: The issue allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long protocol string. This occurs because the long protocol string triggers an...
CVE-2015-1444
The CVE-2015-1444 entry describes multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend (httpd) of fli4l. Affected are versions before 3.10.1 and 4.0 before 2015-01-30, where the following admin scripts are vulnerable: conntrack.cgi, index.cgi, log_syslog.cgi, pro...
CVE-2015-1444
Multiple cross-site scripting XSS vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allow remote attackers to inject arbitrary web script or HTML via the 1 conntrack.cgi, 2 index.cgi, 3 logsyslog.cgi, 4 problems.cgi, 5...
PT-2015-5291
Name of the Vulnerable Software and Affected Versions fli4l versions prior to 3.10.1 fli4l versions prior to 4.0 specifically before 2015-01-30 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the web administration frontend of the httpd package. These...
CVE-2015-1444: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allow remote attackers to inject arbitrary web script or HTML via the 1 conntrack.cgi, 2 index.cgi, 3 logsyslog.cgi, 4 problems.cgi, 5...
Apache Httpd < 2.4.16 : Crash in ErrorDocument 400 handling
A crash in ErrorDocument handling was found. If ErrorDocument 400 was configured pointing to a local URL-path with the INCLUDES filter active, a NULL dereference would occur when handling the error, causing the child process to crash. This issue affected the 2.4.12 release only...
Internet Bug Bounty: mod_lua: Crash in websockets PING handling
A stack recursion crash in the modlua module was found. A Lua script executing the r:wsupgrade function could crash the process if a malicious client sent a carefully crafted PING request. This issue affected releases 2.4.7 through 2.4.12 inclusive...
Apache Httpd < 2.4.16 : mod_lua: Crash in websockets PING handling
A stack recursion crash in the modlua module was found. A Lua script executing the r:wsupgrade function could crash the process if a malicious client sent a carefully crafted PING request. This issue affected releases 2.4.7 through 2.4.12 inclusive...
Windows-Light-HTTPD-0.1
Buffer overflow in Light HTTPd lhttpd 0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request. import urllib2 from time import sleep def targURL: while True: URL = rawinput"\n Please enter the URL of the Light HTTP server you would like to PWN. Ex. http://192.168.1.1\n\n...
Ultra-Mini-HTTPD-1.21---POST
Exploit Title: Ultra Mini HTTPD stack buffer overflow POST request Date: 16 Feb 2014 Exploit Author: Sumit Vendor Homepage: http://www.picolix.jp/ Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html Version: 1.21 Tested on: Windows XP Professional SP3 A buffer overflow is triggere...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the 1 PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or 2 COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi...
CVE-2011-5284
CVE-2011-5284 describes a Cross-site Request Forgery vulnerability in Smoothwall Express 3.1 and 3.0 SP3 and earlier, specifically in the web management interface’s httpd/cgi-bin/shutdown.cgi. The vulnerability allows an attacker to hijack an administrator’s authenticated session to perform reboo...
CVE-2014-9431: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authentication of administrators for requests that change the 1 admin or 2 dial password via a request to httpd/cgi-bin/changepw.cgi...
CVE-2011-5283: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action...
PT-2014-9008
Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 through 3.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests that change the admin or dial password via a request to "httpd/cgi-bin/changepw.cgi"...
PT-2014-2198
Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site request forgery CSRF issue exists in the web management interface, specifically in the httpd/cgi-bin/shutdown.cgi endpoint. This allows...
PT-2014-2197
Name of the Vulnerable Software and Affected Versions Smoothwall Express versions 3.0 SP3 and earlier, Smoothwall Express version 3.1 Description A cross-site scripting XSS issue exists in the web management interface, specifically in the httpd/cgi-bin/ipinfo.cgi file. This allows remote attacker...
CVE-2014-9430: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action...