mod_cluster: Buffer overflow in mod_manager when sending request with long JVMRoute

It was discovered that specifying configuration with a JVMRoute path longer than 80 characters will cause segmentation fault leading to a server crash...

BSA-2017-501

Security Advisory ID : BSA-2017-501 Component : Apache HTTPD Revision : 2.0: Final In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to modauthdigest can cause the server to crash, and each instance continues to crash even for subsequently valid requests...

ipa security update

4.4.0-14.0.1.el73.1.1 - Blank out header-logo.png product-name.png Replace login-screen-logo.png 20362818 4.4.0-14.1.1 - Resolves: 1370493 CVE-2016-7030 ipa: DoS attack against kerberized services by abusing password policy - ipa-kdb: search for password policies globally - Renamed patches 1011 a...

CentOS Update for ipa-admintools CESA-2017:0001 centos7

Check the version of ipa-admintools SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882622";...

Moderate: Red Hat Security Advisory: ipa security update

An update for ipa is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

RedHat Update for ipa RHSA-2017:0001-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Unspecified Vulnerability in Apache HTTP Server

Apache httpd is the U.S. Apache Apache Software Foundation, an open source HTTP server developed and maintained specifically for modern operating systems. A security vulnerability exists in Apache httpd, which stems from the program's failure to properly parse HTTP headers. A remote attacker coul...

wdrodze.pl XSS vulnerability

Vulnerable URL: https://www.wdrodze.pl/index.php?mod=search=tak=tak=tak=tak=tak=nie=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

UBUNTU-CVE-2016-0736

In Apache HTTP Server versions 2.4.0 to 2.4.23, modsessioncrypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation AES256-CBC by default, hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle...

Red Hat mod_cluster Denial of Service Vulnerability

Red Hat JBoss Web Server is a U.S. Red Hat company built on top of Apache and Tomcat Web server , which supports the development of large-scale Web sites and Web applications in a customized , lightweight framework. modcluster is one of the HTTP protocol-based load balancing, fault-tolerant clust...

mod_cluster: Protocol parsing logic error

An error was found in protocol parsing logic of modcluster load balancer Apache HTTP Server modules. An attacker could use this flaw to cause a Segmentation Fault in the serving httpd process...

CVE-2016-9575

It was found that IdM's certprofile-mod command did not properly check the user's permissions while modifying certificate profiles. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently...

PT-2016-3171 · Apache +5 · Apache Http Server +5

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server mod ssl versions 2.2.x through 2.2.32 Apache HTTP Server mod ssl versions 2.4.x through 2.4.25 Description: The issue is related to a NULL pointer dereference error in the mod ssl module of the Apache HTTP Server. This erro...

UBUNTU-CVE-2016-8734

Apache Subversion's moddontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory...

mod_cluster: remotely Segfault Apache http server

It was discovered that it is possible to remotely Segfault Apache http server with a specially crafted string sent to the modcluster via service messages MCMP...

asus.com XSS vulnerability

Vulnerable URL: http://www.asus.com/zentalk/tw/misc.php?mod=tag=2030ehvpt"...

[SECURITY] Fedora 25 Update: mod_cluster-1.3.3-8.fc25

Modcluster is an httpd-based load balancer. Like modjk and modproxy, modcluster uses a communication channel to forward requests from httpd to one of a set of application server nodes. Unlike modjk and modproxy, modclus ter leverages an additional connection between the application server nodes a...

SUSE-SU-2016:2285-1 Security update for apache2-mod_nss

This update provides apache2-modnss 1.0.14, which brings several fixes and enhancements: - Fix OpenSSL ciphers stopped parsing at +. CVE-2016-3099 - Created valgrind suppression files to ease debugging. - Implement SSLPPTYPEFILTER to call executables to get the key password pins. - Improvements t...

raf.mod.uk XSS vulnerability

Vulnerable URL:...

PHP 'ext/session/mod_files.c' Buffer Overflow Vulnerability

PHP is an open source general-purpose computer scripting language. A buffer overflow vulnerability exists in PHP 'ext/session/modfiles.c', which allows attackers to exploit the vulnerability to execute arbitrary script code or cause a denial of service...