Monkey HTTP Daemon: Multiple vulnerabilities

Background Monkey HTTP Daemon is a lightweight and powerful web server for GNU/Linux. Description Multiple vulnerabilities have been discovered in Monkey HTTP Daemon. Please review the CVE identifiers referenced below for details. Impact A remote attacker could send a specially crafted request,...

CVE-2013-2181

Cross-site scripting XSS vulnerability in the Directory Listing plugin in Monkey HTTP Daemon monkeyd 1.2.2 allows attackers to inject arbitrary web script or HTML via a file name...

CVE-2013-2181

Cross-site scripting XSS vulnerability in the Directory Listing plugin in Monkey HTTP Daemon monkeyd 1.2.2 allows attackers to inject arbitrary web script or HTML via a file name...

Cross site scripting

Cross-site scripting XSS vulnerability in the Directory Listing plugin in Monkey HTTP Daemon monkeyd 1.2.2 allows attackers to inject arbitrary web script or HTML via a file name...

CVE-2013-2181

Affected software : Monkey HTTP Daemon (monkeyd) 1.2.2 with the Directory Listing plugin. Vulnerability : Cross-site scripting (XSS) via a file name (CVE-2013-2181). Root cause : Directory Listing plugin mishandles file names, enabling script/HTML injection. Impact : potential execution of arbitr...

CVE-2013-2181

Cross-site scripting XSS vulnerability in the Directory Listing plugin in Monkey HTTP Daemon monkeyd 1.2.2 allows attackers to inject arbitrary web script or HTML via a file name...

Monkey HTTP Daemon Mandril Security Plugin - Security Bypass

source: https://www.securityfocus.com/bid/60569/info The Mandril Security plugin for Monkey HTTP Daemon is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions, which may aid in launching further...

Monkey HTTP Daemon Mandril Security Plugin - Security Bypass

Monkey HTTP Daemon Mandril Security Plugin - Security Bypass source: https://www.securityfocus.com/bid/60569/info The Mandril Security plugin for Monkey HTTP Daemon is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform...

Race condition

Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check...

CVE-2012-4442

Summary: CVE-2012-4442 affects Monkey HTTP Daemon 0.9.3. The issue arises because the daemon retains the supplementary group IDs of the root account while operating with a non-root effective UID, which could allow local users to bypass file-read restrictions due to a race condition in a file-perm...

CVE-2012-4442

Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check...

CVE-2012-5303

Monkey HTTP Daemon 0.9.3 is vulnerable to a local file overwrite via a symlink attack on its PID file. The issue is a race condition that can occur when a pathname different from the default /var/run/monkey.pid is used, allowing local users to trick the daemon into overwriting arbitrary files. Im...

CVE-2012-4443

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

CVE-2012-4443

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

CVE-2012-4443

Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access...

Monkey HTTP Daemon < 0.9.3 Denial of Service Vulnerability

Exploit for unknown platform in category dos / poc ========================================================== Monkey HTTP Daemon " % argv0 sys.exit0 host = argv1 port = intargv2 print " target: %s:%d" % host, port payload = GET payload += "HTTP/1.1\r\nConnection:\n\r\n\r\n"; print " payload: %s" ...

Monkey HTTP Daemon < 0.9.3 - Denial of Service

Monkey HTTP Daemon is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Versions prior to Monkey HTTP Daemon 0.9.3 are vulnerable. !/usr/bin/env python monkeyex.py -- Patroklos Argyroudis, ar...

Monkey HTTP Daemon 0.9.3 - Denial of Service

Monkey HTTP Daemon 0.9.3 - Denial of Service Monkey HTTP Daemon is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Versions prior to Monkey HTTP Daemon 0.9.3 are vulnerable. !/usr/bin/env...

Monkey HTTP Daemon Invalid HTTP 'Connection' Header Denial Of Service Vulnerability

Monkey HTTP Daemon is prone to a denial-of-service vulnerability. Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users. Versions prior to Monkey HTTP Daemon 0.9.3 are vulnerable. OpenVAS Vulnerability Test $Id: monkeyhttp37307.nasl 5390...

CVE-2002-2154

CVE-2002-2154 describes a directory traversal vulnerability in the web server component Monkey HTTP Daemon 0.1.4. Remote attackers can read arbitrary files by using dot-dot sequences in the request path. The problem is documented across multiple feeds (NVD, Red Hat advisories, CVE listings) with ...