Legal Robot: AWS S3 website can't serve security headers, may allow clickjacking

Security researcher discovered that our AWS S3 website was not serving some basic security headers like X-Frame-Options. We resolved the issue by putting nginx in front of our AWS S3 website and adding header directives. Fixed security headers can be verified here: https://schd.io/zt...

Uber: Server version disclosure

Hi uber, maybe this is a low risk but i want to report that the nginx and openresty server version are being disclosed. For openresty: Accessing this url: https://chef.uberinternal.com/ will give you an error "502 Bad Gateway" but you can see on the page that the server version was disclose...

Vulnerabilities in the nginx software allow a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.

Overfilling buffers in dynamic memory in the SPDY implementation of nginx allows malicious actors operating remotely to execute arbitrary code using specially crafted requests...

Vulnerability of nginx software, allowing a remote attacker to compromise the confidentiality of protected information

The vulnerability in the SMTP proxy of Nginx allows attackers who operate on a “man-in-the-middle” principle to inject commands into SSL sessions initiated with the STARTTLS command, thereby gaining access to confidential information sent by clients...

Vulnerabilities in the nginx software allow a malicious attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the implementation of SPDY in the ngxhttpspdymodule module of nginx when running on 32-bit platforms allows malicious actors to execute arbitrary code using specially crafted requests...

Paragon Initiative Enterprises: Nginx Version Disclosure On Forbidden Page

Hi, PoC 1- Go that link you'll see the version of nginx server https://paragonie.com/static/highlightjs/...

iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting

Exploit for php platform in category web applications iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities Vendor: iBilling Product web page: http://www.ibilling.io/ Affected version: 3.7.0 Summary: The features you want, the simplicity you need! Beautifully designed...

iBilling 3.7.0 Cross Site Scripting

Cross Site Scripting Stored: http://localhost/ibilling/index.php Parameters: msg, desc, account, phone, company, address, city, state, zip, tags, description, ref POST...

iBilling 3.7.0 - Persistent Cross-Site Scripting Reflected Cross-Site Scripting

iBilling 3.7.0 - Persistent Cross-Site Scripting Reflected Cross-Site Scripting iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities Vendor: iBilling Product web page: http://www.ibilling.io/ Affected version: 3.7.0 Summary: The features you want, the simplicity you...

iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting

iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities Vendor: iBilling Product web page: http://www.ibilling.io/ Affected version: 3.7.0 Summary: The features you want, the simplicity you need! Beautifully designed for best User Interface & User Experience. The softwa...

iBilling v3.7.0 Multiple Stored and Reflected Cross-Site Scripting Vulnerabilities

Summary Summary: The features you want, the simplicity you need! Beautifully designed for best User Interface & User Experience. The software That Works For YOUR Business! Get growing - with affordable, scalable business software. Find innovative ways to manage customers data, communicate with...

Uber: Server version disclosure: team.uberinternal.com

In the HTTP response header from team.uberinternal.com, the nginx web server version is disclosed. HTTP/1.1 301 Moved Permanently Server: nginx/1.8.1 Date: Tue, 21 Jun 2016 22:45:53 GMT Content-Type: text/html Content-Length: 184 Connection: keep-alive Location: https://team.uberinternal.com/...

Fedora Update for nginx FEDORA-2016-c329fc4c32

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 24 Update: nginx-1.10.1-1.fc24

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

Nextcloud: help.nextcloud.com: Known DoS condition (null pointer deref) in Nginx running

The https://help.nextcloud.com sub-site is running Nginx/1.10.0 which is vuln to a known issue CVE-2016-4450 which allows a remote malformed HTTP request to cause the Nginx process to crash. DoS testing is mentioned as not requested, but if you know of an issue give it a go .. You can determine t...

nginx: Multiple vulnerabilities

Background nginx is a robust, small, and high performance HTTP and reverse proxy server. Description Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly cause a Denial of Service condition...

Amazon Linux AMI : nginx (ALAS-2016-715)

A problem was identified in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file. C Tenable Network Security, Inc. The...

Medium: nginx

Issue Overview: A problem was identified in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file. Affected Packages: nginx...

Security Advisory 0021

Security Advisory 0021 PDF Date: June 13th, 2016 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | June 13th, 2016 | Initial release Arista Products vulnerability report for security vulnerability announcement from NGINX on May 31st, 2016 It was announced by NGINX on May 31, 2016 that there ...

USN-2991-1 nginx vulnerability | Cloud Foundry

USN-2991-1 nginx vulnerability Medium Vendor Nginx, Canonical Ubuntu Versions Affected BOSH-release versions prior to 255.11 Description It was discovered that nginx incorrectly handled saving client request bodies to temporary files. A remote attacker could possibly use this issue to cause nginx...