6720 matches found
CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
Ingress-nginx path sanitization can be bypassed with logformat directive...
CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive
Ingress-nginx path sanitization can be bypassed with logformat directive...
Moderate: Red Hat Security Advisory: nginx:1.22 security update
An update for the nginx:1.22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...
ingress-nginx path sanitization can be bypassed
Issue Details A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use directives to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentia...
PT-2023-6604 · Unknown · Ingress-Nginx
Name of the Vulnerable Software and Affected Versions: ingress-nginx affected versions not specified Description: The issue is related to a controller vulnerability in the Kubernetes ingress-nginx cluster, which is associated with errors in processing input data. This can allow a remote attacker ...
Ingress NGINX Controller Injection Vulnerability
Ingress NGINX Controller is a Kubernetes open source entry controller for Kubernetes. A security vulnerability exists in Ingress NGINX Controller. An attacker can exploit this vulnerability to execute arbitrary commands...
PT-2023-6428
Name of the Vulnerable Software and Affected Versions ingress-nginx versions prior to 1.9.0 Description A security issue in ingress-nginx allows for arbitrary command execution due to annotation injection. This can be exploited by a remote attacker to execute arbitrary code or elevate privileges...
ALSA-2023:6120 Moderate: nginx:1.22 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 For more details about the securi...
Moderate: nginx:1.22 security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 For more details about the securi...
RHEL 9 : nginx:1.22 (RHSA-2023:6120)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6120 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...
CLSA-2023-1698101447 nginx: Fix of CVE-2023-44487
CVE-2023-44487: HTTP/2 - per-iteration stream handling limit...
nginx: Fix of CVE-2023-44487
CVE-2023-44487: HTTP/2 - per-iteration stream handling limit...
BIT-2023-44388
Discourse is an open source platform for community discussion. A malicious request can cause production log files to quickly fill up and thus result in the server running out of disk space. This problem has been patched in the 3.1.1 stable and 3.2.0.beta2 versions of Discourse. It is possible to...
Exploit for Off-by-one Error in F5 Nginx
CVE-2021-23017 CVE-2021-23017-PoC python3 poc.py --ta...
The vulnerability of the Nginx module NAXSI, related to the violation of data protection mechanisms, allows attackers to circumvent existing security restrictions.
The vulnerability of the Nginx module NAXSI is related to a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker, operating remotely, to circumvent existing security restrictions...
CLSA-2023-1697817547 nginx: Fix of CVE-2023-44487
CVE-2023-44487: HTTP/2 - per-iteration stream handling limit...
Ubuntu 16.04 ESM : Phusion Passenger vulnerabilities (USN-5261-1)
The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5261-1 advisory. It was discovered that Phusion Passenger incorrectly handled a file path in the application root folder. An attacker could possibly use this issue to rea...
