Nginx 1.27.0 Buffer Over-read

According to its Server response header, the installed version of nginx is 1.5.13 to 1.26.2 or 1.27.0. It is, therefore, affected by a security issue was identified in the ngxhttpmp4module, which might allow an attacker to cause a worker process crash by using a specially crafted mp4 file...

Kubernetes: Injection in path parameter of Ingress-nginx

A vulnerability was discovered in the Ingress-nginx controller where an attacker could inject arbitrary content into the path parameter of an Ingress. This allowed the attacker to upload a malicious nginx configuration file to the ingress controller's file system and then include that file in a...

Medium: nginx

Issue Overview: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and...

Medium: nginx

Issue Overview: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and...

Medium: nginx

Issue Overview: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and...

GHSA-JFVP-7X6P-H2PV vulnerabilities

Vulnerabilities for packages: kubernetes, ctop, k8s-device-plugin, k3s, opentelemetry-collector-contrib, podman, docker, grype, grafana-alloy, cadvisor, syft, neuvector-scanner, runc, buildah...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: grafana-alloy, kubernetes-fips, grype, grafana-alloy-fips, cadvisor-fips, cluster-autoscaler, k8s-device-plugin, eks-distro-fips, gosu, neuvector-fips, node-feature-discovery, cadvisor, runc, cluster-autoscaler-fips, docker, podman, kubernetes, neuvector, buildah,...

CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: kubernetes, ctop, k8s-device-plugin, k3s, opentelemetry-collector-contrib, podman, docker, grype, grafana-alloy, cadvisor, syft, neuvector-scanner, runc, buildah...

CVE-2024-7347 affecting package nginx for versions less than 1.22.1-12

CVE-2024-7347 affecting package nginx for versions less than 1.22.1-12. A patched version of the package is available...

The vulnerability of the ngx_http_v4_module in NGINX Plus and NGINX OSS web servers, related to reading data from outside of memory, allows attackers to cause service interruptions.

The vulnerability of the ngxhttpv4module in NGINX Plus and NGINX OSS web servers is related to reading data from outside of the memory boundaries. Exploiting this vulnerability can allow attackers to cause service failures...

Nginx HTTP API Module Unrestricted Access

Nginx HTTP API Module provide a REST API for accessing various status information, configuring upstream server groups on-the-fly, and managing key-value pairs without the need of reconfiguring nginx. If these endpoints are accessible to an attacker, he can modify the configuration in place and, i...

Nginx+ Dashboard Unrestricted Access

Nginx Plus is a proprietary solution from F5 built on top of Nginx and featuring a dashboard called "Live Activity Monitoring". When accessible without authentication it may contain sensitives information that can be used by an attacker. No source data...

Nginx Source Code Disclosure/Download

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nginx Source Code Disclosure/Download', 'Description' = %q This module exploits a source code disclosure/download vulnerability in versions 0.7 a...

Improper Input Validation

Ingress-nginx is vulnerable to Improper Input Validation. The vulnerability is due to improper annotation validation, allowing an actor with permission to create Ingress objects to inject arbitrary commands and obtain the credentials of the ingress-nginx controller...

OESA-2024-2065 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Nginx

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Nginx Vulnerability Details CVEID:CVE-2024-32760 DESCRIPTION: F5 NGINX Plus and NGINX Open Source are vulnerable to a denial of service, caused by a flaw when configured to use the HTTP/3 QUIC module. By...

CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...

CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...

SUSE CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

ROS-20240827-15

A vulnerability in the ngxhttpv4module module of the NGINX Plus and NGINX OSS web servers is related to reading out-of-bounds memory. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information...