235 matches found
The vulnerability in the `os/unix/ngx_files.c` component of the NGINX application monitoring and management platform allows a attacker to cause a service failure.
The vulnerability in the os/unix/ngxfiles.c component of the NGINX application monitoring and management platform is related to the use of a null pointer. Exploiting this vulnerability could allow an attacker to cause service interruptions...
ROS-2-2170
2.2170 Remote code execution in nginxCVE-2021-23017 1. Vulnerability Description: The vulnerability allows a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to a single error in the ngxresolvercopyfunction when processing DNS responses. A remote...
ROS-2-2151
2.2151 Remote code execution in nginxCVE-2021-23017 1. Vulnerability Description: The vulnerability allows a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to a single error in the ngxresolvercopyfunction when processing DNS responses. A remote...
ROS-2-2202
2.2202 Remote code execution in nginxCVE-2021-23017 1. Vulnerability Description: The vulnerability allows a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to a single error in the ngxresolvercopyfunction when processing DNS responses. A remote...
nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name
A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in...
Cross-site Scripting (XSS)
Overview ngx-markdown-editor is an Angular markdown editor based on ace editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The vulnerability can be exploited when previewing the Markdown content. Details Cross-site scripting or XSS is a code vulnerability that...
PT-2021-11997 · Unknown +3 · Ngx Http Lua Module +3
Name of the Vulnerable Software and Affected Versions: ngx http lua module aka lua-nginx-module versions prior to 0.10.16 Description: The issue allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header. Recommendations: For versions prior to...
Cross-site Scripting (XSS)
Overview ngx-markdown-editor is an Angular markdown editor based on ace editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the markdown editor. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious scri...
Cross-Site Scripting (XSS)
ngx-bootstrap is vulnerable to cross-site scripting which allows an attacker to inject and execute arbitrary Javascript via the search and highlight functionality within the typeahead component...
CVE-2020-24987
Tenda AC18 Router through V15.03.05.05EN and through V15.03.05.196318 CN devices could cause a remote code execution due to incorrect authentication handling of vulnerable logincheck function in /usr/lib/lua/ngxauthserver/ngxwdas.lua file if the administrator UI Interface is set to "radius"...
Malicious Package in ngx-context-menu
Version 0.0.26 of ngx-context-menu contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...
GHSA-XWG3-GJXH-C8PM Malicious Package in ngx-context-menu
Version 0.0.26 of ngx-context-menu contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...
Cross-Site Scripting in ngx-md
Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript. Recommendation...
GHSA-XR53-M937-JR9C Cross-Site Scripting in ngx-md
Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript. Recommendation...
GHSA-76WF-2XCF-6WMX Malicious Package in ngx-pica
Version 1.1.5 of ngx-pica contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate your...
Malicious Package in ngx-pica
Version 1.1.5 of ngx-pica contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate your...
DEBIAN-CVE-2020-11724
An issue was discovered in OpenResty before 1.15.8.4. ngxhttpluasubrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API...
PT-2020-3784 · Openresty +2 · Openresty +2
Name of the Vulnerable Software and Affected Versions: OpenResty versions prior to 1.15.8.4 Description: The issue is related to HTTP request smuggling in the ngx http lua subrequest.c component of the OpenResty web server. This is due to inconsistent interpretation of HTTP requests. The...
Cross-Site Scripting
Overview Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as Click Me is rendered as a Click Me link that executes JavaScript...