UBUNTU-CVE-2019-12815

An arbitrary file copy vulnerability in modcopy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306...

PT-2019-11526 · Zmartzone Iam · Mod Auth Openidc

Name of the Vulnerable Software and Affected Versions: ZmartZone IAM mod auth openidc versions 2.3.10.1 and earlier Description: The issue affects the ZmartZone IAM mod auth openidc, allowing for Cross Site Scripting XSS attacks. This can lead to redirecting the user to a phishing page or...

Apache mod_ssl Remote Buffer Overflow Vulnerability

ModSSL is the SSL implementation on the Apache server used to provide cryptographic support for the Apache Web server. A remote buffer overflow vulnerability in OpenSSL OpenFuckV2.c in Apache modssl versions prior to 2.8.7 can be exploited by an attacker to execute unauthorized commands, which ca...

PT-2019-3893

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.39 Description A limited cross-site scripting issue was reported affecting the mod proxy error page in Apache HTTP Server. This issue could allow an attacker to cause the link on the error page to ...

PT-2019-5693 · Apache +3 · Mod Auth Mellon +4

Name of the Vulnerable Software and Affected Versions: mod auth mellon versions 0.14.2 and earlier Description: The issue is related to an Open Redirect via the login?ReturnTo= substring. This can be exploited by omitting the // after http: in the target URL, allowing a remote attacker to redirec...

CVE-2018-18802

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/modusers/controller.php?action=edit...

PT-2019-9633

Name of the Vulnerable Software and Affected Versions Tubigan "Welcome to our Resort" version 1.0 Description The issue allows for CSRF, which can be exploited via the "admin/mod users/controller.php?action=edit" API endpoint. This could potentially allow attackers to perform unauthorized actions...

PT-2019-7246

Name of the Vulnerable Software and Affected Versions mod ucam webauth versions prior to 2.0.2 Description A Directory Traversal issue was discovered, allowing an attacker to manipulate the kid field in the IdP's HTTP response message, specifically the "WLS-Response". The kid field, which should...

[SECURITY] Fedora 30 Update: mod_cluster-1.3.11-1.fc30

Modcluster is an httpd-based load balancer. Like modjk and modproxy, modcluster uses a communication channel to forward requests from httpd to one of a set of application server nodes. Unlike modjk and modproxy, modclus ter leverages an additional connection between the application server nodes a...

httpd: mod_ssl: access control bypass when using per-location client certification authentication

A flaw was found in Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38. A bug in modssl, when using per-location client certificate verification with TLSv1.3, allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. An attacker could perform vario...

The vulnerability of the register_hooks() function in the Apache HTTP Server’s web server, related to the possibility of bypassing authentication, allows attackers to circumvent existing access control mechanisms.

The vulnerability of the registerhooks function modauthmellon in the Apache HTTP Server is related to the possibility of bypassing authentication by executing a special SAML ECP. Exploiting this vulnerability allows a malicious actor to circumvent existing access control mechanisms by using...

The vulnerability of the mod_session module in the Apache HTTP Server, related to the lack of consideration for the lifetime of a session, allows attackers to compromise the integrity of protected data.

The vulnerability of the modsession module in the Apache HTTP Server is related to the lack of time-out checking before session data is decoded. Exploiting this vulnerability allows an attacker to compromise the integrity of protected data...

PT-2019-12340

Name of the Vulnerable Software and Affected Versions Zotonic versions prior to 0.47 Description The issue is related to a mod admin XSS in Zotonic. Recommendations For versions prior to 0.47, update to version 0.47 or later to resolve the issue...

PT-2019-12312

Name of the Vulnerable Software and Affected Versions CutePHP CuteNews version 2.1.2 Description An issue allows an attacker to infiltrate the server through the avatar upload process in the profile area via the "index.php?mod=main&opt=personal" endpoint, by exploiting the avatar file field. The...

CVE-2019-11447: Unrestricted Upload of File with Dangerous Type

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...

Ubuntu: Security Advisory (USN-3924-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2019-3892

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.32 through 2.4.39 Description The issue is related to a stack buffer overflow or NULL pointer deference in the mod remoteip module of the Apache HTTP Server. This can be triggered by a specially crafted PROXY...

Moodle CMS 3.6.x <= 3.6.2 Authentication Bypass Vulnerability

Moodle CMS is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...

PT-2019-3930

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.38 and prior Description A race condition in the mod auth digest component of the Apache HTTP Server could allow a user with valid credentials to authenticate using another username, bypassing configured access...

PT-2019-2672

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.17 through 2.4.38 Description A vulnerability was discovered in the Apache HTTP Server, specifically in the mod http2 module, related to the use of freed memory. This issue could allow a remote attacker to cause...