PT-2018-3115

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.0.23 through 2.0.65 Apache httpd versions 2.2.0 through 2.2.34 Apache httpd versions 2.4.0 through 2.4.29 Description The issue is related to the mod authnz ldap component in Apache httpd, specifically when configured...

PT-2018-1820

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.2.0 through 2.4.29 Description The issue is related to the generation of an HTTP Digest authentication challenge, where the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. Thi...

[slackware-security] php

New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/php-5.6.34-i586-1slack14.2.txz: Upgraded. This update fixes a stack buffer overflow vulnerability. For more information, se...

CVE-2018-7561

Stack-based Buffer Overflow in httpd on Tenda AC9 devices V15.03.05.14EN allows remote attackers to cause a denial of service or possibly have unspecified other impact...

CVE-2018-7561

Stack-based Buffer Overflow in httpd on Tenda AC9 devices V15.03.05.14EN allows remote attackers to cause a denial of service or possibly have unspecified other impact...

CVE-2018-7561: Out-of-bounds Write

Stack-based Buffer Overflow in httpd on Tenda AC9 devices V15.03.05.14EN allows remote attackers to cause a denial of service or possibly have unspecified other impact...

PT-2018-18156

Name of the Vulnerable Software and Affected Versions Tenda AC9 version V15.03.05.14 EN Description A stack-based buffer overflow issue in the httpd service on Tenda AC9 devices allows remote attackers to cause a denial of service or possibly have other unspecified impacts. Recommendations For...

CVE-2018-6940

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF...

Design/Logic Flaw

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF...

Cross site request forgery (csrf)

A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS...

CVE-2018-6940

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF...

CVE-2018-6941

A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS...

CVE-2018-6941

A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS...

CVE-2018-6941

A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS...

CVE-2018-6940

CVE-2018-6940 describes a Remote Command Execution risk in NAT32 v2.2 Build 22284 through the HTTPD interface. The vulnerability stems from a /shell?cmd= endpoint exposed on NAT32’s web UI ( port 8080 ) that could allow attackers to execute commands, potentially via CSRF as indicated by multiple ...

CVE-2018-6941

CVE-2018-6941 describes a CSRF vulnerability in NAT32 v2.2 Build 22284 HTTPD that can enable Remote Code Execution when an authenticated NAT32 user visits a malicious link or page. Public writeups/PoCs (e.g., Exploit-DB, PacketStorm) illustrate a payload like /shell?cmd= and document that no chec...

CVE-2018-6940

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF...

CVE-2018-6941: Cross-Site Request Forgery (CSRF)

A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS...

PT-2018-17831

Name of the Vulnerable Software and Affected Versions NAT32 version 2.2 Build 22284 Description A CSRF issue exists in the HTTPD component that can be exploited for Remote Code Execution in conjunction with XSS, specifically through the "/shell?cmd=" endpoint. Recommendations For NAT32 version 2....

CVE-2018-6940: Improper Neutralization of Input During Web Page Generation

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF...