CVE-2021-41773

Apache 2.4.49 CVE-2021-41773 および 2.4.50 CVE-2021-42013 の両方に対するRCEエクスプロイト: 私見では、このRCEに対して脆弱なのは「特別な」構成のみです。 これまで見てきた「任意ファイル読み取り」エクスプロイトについても同様です。 両CVEは実際にはほぼ同じパストラバーサル脆弱性です（2つ目は1つ目に対する不完全な修正です）。 パストラバーサルはマップされたURI（例: Apacheディレクティブの「Alias」や「ScriptAlias」）からのみ機能します。DocumentRootのみでは不十分です。 "/cgi-bin/"...

CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

Default configuration

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

CVE-2013-4878

CVE-2013-4878 affects Parallels Plesk Panel 9.0.x–9.2.x on UNIX and Small Business Panel 10.x on UNIX, due to an improper ScriptAlias directive for phppath that enables remote code execution via crafted requests. Affected versions expose code execution under the web server user; exploitation reli...

CVE-2013-4878

The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than...

CVE-2006-4110

Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase or alternate case characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems...