Server Status by Hostname/IP <= 4.6 - Authenticated SQL Injection

The last time it was checked the plugin was still affected and had been closed. PoC http://www.example.com/wp-admin/admin.php?page=all-servers=2+UNION+SELECT+1%2C2%2C3%2C%40%40version+=edit...

TomTom: Apache mod_status /server-status Information Disclosure

Description It is possible to obtain an overview of the remote Apache web server's activity and performance by requesting the URL '/server-status'. This overview includes information such as current hosts and requests being processed, the number of workers idle and service requests, and CPU...

Capital One: Apache server-status enabled

Apache /server-status displays information about your Apache status. If you are not using this feature, disable it. GET /server-status HTTP/1.1 Connection: keep-alive Accept: / Accept-Encoding: gzip,deflate Host: proxy-copp.capitalone.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64...

Mail.ru: сервант статус

Apache server status was available at jw-cn-test-1.ext.terrhq.ru...

Mail.ru: [info.tmgame.mail.ru] Apache Server Status

Open Apache Server Status in info.tmgame.mail.ru tmgame.mail.ru is not currently covered by Bug Bounty program...

Mail.ru: Apache Server-Status Detected

prosieben.icq.com was delegated to a partner site as a part of a partner program and this site exposes Apache server-status. An issue is related to partner host outside of ICQ control, does not affect ICQ users and was accepted outside of bug bounty scope...

How Do I Remove an Inactive or Non-existent License Server From LUI Reports

This article describes how to remove XenApp and XenDesktop license servers from the License Usage Insights LUI service that are no longer in in use. These servers appear in the Server Status page in the LUI service with a “not reporting” status. Who is affected? Citrix Service Provider partners...

Citrix ADC: DNS resolution fails towards Name servers.

Citrix ADC is unable to resolve DNS. Effective state of the Name server could bedown...

http-apache-server-status NSE Script

Attempts to retrieve the server-status page for Apache webservers that have modstatus enabled. If the server-status page exists and appears to be from modstatus the script will parse useful information such as the system uptime, Apache version and recent HTTP requests. References: Script Argument...

Gratipay: server calendar and server status available to public

It was found that a calendar containing information about various tasks to be performed by the server admin can be viewed by any user. link: http://inside.gratipay.com/appendices/calendar it reveals stuff link data of expiration of ssl certificate, lastpass accounts, etc further important entries...

Mail.ru: [ling.go.mail.ru] Server-Status opened for all users

Приветствую! По ссылке http://ling.go.mail.ru/server-status видно расшаренный server-status. Правда, он урезан для этого сервера, но всё равно, наверное, стоить спрятать от обычных пользователей...

DEBIAN-CVE-2014-8326

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name, related to the...

DEBIAN-CVE-2014-5273

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 browse table page, related to js/sql.js; 2 ENUM editor page, related to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 browse table page, related to js/sql.js; 2 ENUM editor page, related to...

Apache 2.4.7 mod_status - Scoreboard Handling Race Condition

Apache 2.4.7 modstatus - Scoreboard Handling Race Condition -- 0. Sparse summary Race condition between updating httpd's "scoreboard" and modstatus, leading to several critical scenarios like heap buffer overflow with user supplied payload and leaking heap which can leak critical memory containin...

Chindi Server 1.0 - Denial of Service Exploit

No description provided by source. / Chindi server 1.0 Denial of Service Proof of Concept by Luca Ercoli luca.ercoli at inwind.it After DoS, server appears to be up, but will not allow new connections. include include include include include define PORT 4444 define DOS crash int mainint argc, cha...

Apache Httpd < 2.4.10 : mod_status buffer overflow

A race condition was found in modstatus. An attacker able to access a public server status page on a server using a threaded MPM could send a carefully crafted request which could lead to a heap buffer overflow. Note that it is not a default or recommended configuration to have a public accessibl...

Apache Httpd < 2.2.29 : mod_status buffer overflow

A race condition was found in modstatus. An attacker able to access a public server status page on a server using a threaded MPM could send a carefully crafted request which could lead to a heap buffer overflow. Note that it is not a default or recommended configuration to have a public accessibl...

server_status

This plugin fetches the server-status file used by Apache, and parses it. After parsing, new URLs are found, and in some cases, the plugin can deduce the existance of other domains hosted on the same server. Plugin type Infrastructure Options This plugin doesnt have any user configured options...

[Http-enum] Automated HTTP Enumeration Tool

Null Security Team writing a python script for Automated HTTP Enumeration. currently only in the initial beta stage, but includes basic checking of files including the Apache server-status as well as well IIS WebDAV and Microsoft FrontPage Extensions, many more features will be added to this tool...