6734 matches found
CVE-2024-45310 vulnerabilities
Vulnerabilities for packages: syft, podman, cadvisor, k8s-device-plugin, grafana-alloy, buildah, docker, k3s, runc, grype, kubernetes, ctop, opentelemetry-collector-contrib, neuvector-scanner...
CVE-2024-7347 affecting package nginx for versions less than 1.22.1-12
CVE-2024-7347 affecting package nginx for versions less than 1.22.1-12. A patched version of the package is available...
Nginx+ Dashboard Unrestricted Access
Nginx Plus is a proprietary solution from F5 built on top of Nginx and featuring a dashboard called "Live Activity Monitoring". When accessible without authentication it may contain sensitives information that can be used by an attacker. No source data...
Nginx HTTP API Module Unrestricted Access
Nginx HTTP API Module provide a REST API for accessing various status information, configuring upstream server groups on-the-fly, and managing key-value pairs without the need of reconfiguring nginx. If these endpoints are accessible to an attacker, he can modify the configuration in place and, i...
The vulnerability of the ngx_http_v4_module in NGINX Plus and NGINX OSS web servers, related to reading data from outside of memory, allows attackers to cause service interruptions.
The vulnerability of the ngxhttpv4module in NGINX Plus and NGINX OSS web servers is related to reading data from outside of the memory boundaries. Exploiting this vulnerability can allow attackers to cause service failures...
Nginx Source Code Disclosure/Download
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nginx Source Code Disclosure/Download', 'Description' = %q This module exploits a source code disclosure/download vulnerability in versions 0.7 a...
Improper Input Validation
Ingress-nginx is vulnerable to Improper Input Validation. The vulnerability is due to improper annotation validation, allowing an actor with permission to create Ingress objects to inject arbitrary commands and obtain the credentials of the ingress-nginx controller...
OESA-2024-2065 nginx security update
NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Nginx
Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Nginx Vulnerability Details CVEID:CVE-2024-32760 DESCRIPTION: F5 NGINX Plus and NGINX Open Source are vulnerable to a denial of service, caused by a flaw when configured to use the HTTP/3 QUIC module. By...
CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...
CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...
SUSE CVE-2024-7646
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...
ROS-20240827-15
A vulnerability in the ngxhttpv4module module of the NGINX Plus and NGINX OSS web servers is related to reading out-of-bounds memory. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information...
Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware
CVE-2023-20198 Exploit PoC for CVE-2023-20198 Description...
[SECURITY] Fedora 40 Update: nginx-mod-naxsi-1.6-6.fc40
naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...
[SECURITY] Fedora 40 Update: nginx-mod-fancyindex-0.5.2-7.fc40
The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: Custom headers. Either local or stored remotely. Cust...
[SECURITY] Fedora 40 Update: nginx-1.26.2-1.fc40
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...
[SECURITY] Fedora 40 Update: nginx-mod-vts-0.2.2-9.fc40
Nginx virtual host traffic status module...
[SECURITY] Fedora 40 Update: nginx-mod-modsecurity-1.0.3-13.fc40
The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity ModSecurity v3. Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector...