AZL-35029 CVE-2020-24347 affecting package nginx for versions less than 1.25.4-1

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

CVE-2020-24346

njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c...

CVE-2020-24347

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

CVE-2020-24347

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

CVE-2020-24346

njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c...

Out-of-bounds

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njsjsonstringifyiterator in njsjson.c...

Design/Logic Flaw

njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c...

Out-of-bounds

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

Design/Logic Flaw

njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...

CVE-2020-24346

njs through 0.4.3, used in NGINX, has a use-after-free in njsjsonparseiteratorcall in njsjson.c...

CVE-2020-24346

CVE-2020-24346 affects the NGINX-integrated JavaScript engine, specifically njs through 0.4.3. The vulnerability is a use-after-free in function njs_json_parse_iterator_call within njs_json.c. This concrete detail is corroborated by multiple sources in the connected documents (e.g., Red Hat, NVD,...

CVE-2020-24347

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njslvlhshlevelfind in njslvlhsh.c...

CVE-2020-24347

The connected data confirms CVE-2020-24347 affects njs up to version 0.4.3 when used with NGINX, due to an out-of-bounds read in njs_lvlhsh_level_find (njs_lvlhsh.c). Affected component: njs (embedded JavaScript) used in NGINX; root cause is an out-of-bounds read in the hash-level lookup implemen...

CVE-2020-24348

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njsjsonstringifyiterator in njsjson.c...

CVE-2020-24348

The CVE-2020-24348 vulnerability is in njs up to version 0.4.3, used in NGINX. It stems from an out-of-bounds read in the njs_json_stringify_iterator function within njs_json.c. The provided sources do not specify affected product versions beyond 0.4.3, nor do they detail the exploit vectors, imp...

CVE-2020-24349

njs through 0.4.3, used in NGINX, allows control-flow hijack in njsvalueproperty in njsvalue.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface...

CVE-2020-24349

CVE-2020-24349 affects njs up to version 0.4.3 used in NGINX, enabling a control-flow hijack in njs_value_property within njs_value.c. Public sources confirm the issue, with Red Hat and PT-Security entries citing vulnerable versions prior to 0.4.4 and recommending upgrading to 0.4.4+ to resolve. ...

CVE-2020-5416: CF clusters with NGINX in front of them may be vulnerable to DoS | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry Routing Gorouter, versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacke...

Exploit for Improper Encoding or Escaping of Output in F5 Nginx

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID is not explicitly mentioned, but the repository contains various vulnerable environments, including ones related to CVE-2016-9086, CVE-2017-1000353, CVE-2013-4547, and CVE-2018-1000006. The target...

CVE-2020-8553

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace ...