RLSA-2023:5924 Important: varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fixes: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rap...

[SECURITY] Fedora 38 Update: httpd-2.4.58-1.fc38

The Apache HTTP Server is a powerful, efficient, and extensible web server...

CVE-2022-38484

An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to version 0.1. A remote authenticated attacker could leverage this vulnerability to upload files to any location on the target operating system...

AZL-31611 CVE-2023-45802 affecting package httpd for versions less than 2.4.58-1

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

Moodle < 3.9.24, 3.11.x < 3.11.17, 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

PT-2023-13612 · Unknown · Agevolt Portal

Name of the Vulnerable Software and Affected Versions: AgeVolt Portal versions prior to 0.1 Description: A directory traversal issue exists that leads to Information Disclosure. A remote authenticated attacker could leverage this issue to read files from any location on the target operating syste...

Trane Tracer SC Sensitive Information Disclosure (CVE-2016-0870)

The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

The vulnerability of the httpd component’s debug credentials in the microprogramming-based industrial Wi-Fi routers Yifan YF325, due to security flaws in the authentication process, allows attackers to bypass the authentication mechanism.

The vulnerability of the httpd component’s debug credentials in the microprogramming-based industrial Wi-Fi routers Yifan YF325 is related to security flaws in the system. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process remotely...

The vulnerability of the web server of the microprogramming software for communication module control devices CP-8031 MASTER MODULE and CP-8050 MASTER MODULE allows attackers to upload arbitrary files and elevate their privileges to the level of administrators.

The vulnerability of the web server of the microprogramming software for communication module control devices CP-8031 MASTER MODULE and CP-8050 MASTER MODULE is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious...

The vulnerability of the Web Listener component of the Oracle HTTP Server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Web Listener component of the Oracle HTTP Server is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the httpd next_page function in the microprogramming software of industrial Wi-Fi routers Yifan YF325 allows a hacker to execute arbitrary commands.

The vulnerability of the httpd nextpage function in the microprogramming-based industrial Wi-Fi routers Yifan YF325 relates to reading data outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Exploit for Unprotected Alternate Channel in Rockwellautomation Allen-Bradley_Stratix_5200_Firmware

CVE-2023-20198 - PoC SCRIPT /!\ Disclaimer: This script...

D-Link D-View 8 Web Server Detection

Binary data dlinkdview8webserverdetect.nbin...

CVE-2023-42666

The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used...

Information disclosure

The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used...

CVE-2023-42666

DexGate (DEXGate device from DEXMA) is affected by CVE-2023-42666, an exposure of sensitive information to an unauthorized actor vulnerability that can enable crafting malicious requests to obtain the web server version information. Public documentation in the connected sources identifies the aff...

CVE-2023-42666 Exposure of Sensitive Information to an Unauthorized Actor in DEXMA DEXGate

The affected product is vulnerable to an exposure of sensitive information to an unauthorized actor vulnerability, which may allow an attacker to create malicious requests for obtaining the information of the version about the web server used...

USN-6438-1: .NET vulnerabilities

Kevin Jones discovered that .NET did not properly process certain X.509 certificates. An attacker could possibly use this issue to cause a denial of service. CVE-2023-36799 It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly...

USN-6427-2 dotnet8 vulnerability

USN-6427-1 fixed a vulnerability in .NET. This update provides the corresponding update for .NET 8. Original advisory details: It was discovered that the .NET Kestrel web server did not properly handle HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service...

php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

A vulnerability was found in PHP where the weak randomness affects applications that use SOAP with HTTP Digest authentication against a possibly malicious server over HTTP allows a remote authenticated attackers to cause a stack information leak...