Friday Squid Blogging: Vulnerabilities in Squid Server

It's always nice when I can combine squid and security: Multiple versions of the Squid web proxy cache server built with Basic Authentication features are currently vulnerable to code execution and denial-of-service DoS attacks triggered by the exploitation of a heap buffer overflow security flaw...

[SECURITY] Fedora 30 Update: httpd-2.4.41-1.fc30

The Apache HTTP Server is a powerful, efficient, and extensible web server...

[SECURITY] Fedora 30 Update: nginx-1.16.1-1.fc30

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration Vulnerability

Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS is a set of Linux-based infrastructure software from Cisco. The software is mainly used for designing, deploying and managing network services and dynamically deploying virtualized network functions on supported Cisco...

Cisco UCS C-Series, Cisco UCS S-Series Integrated Management Controller Software License Issue Vulnerability

Cisco UCS C-Series and Cisco UCS S-Series are both products of Cisco Corporation.Cisco UCS C-Series is a C-Series rackmount server.Cisco UCS S-Series is an S-Series rackmount server.Integrated Management Integrated Management Controller IMC Software is a suite of software used to manage the UCS...

HPESBUX03950 rev.1 - HP-UX Web Server Suite running Apache on HP-UX 11iv3, Multiple Remote Vulnerabilities

Potential Security Impact: Local: Unauthorized Disclosure of Information, Unauthorized Modification; Remote: Bypass Security Restrictions, Denial of Service DoS, Unauthorized Disclosure of Information, Unauthorized Modification SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX...

Cisco UCS C-Series Servers and UCS S-Series Servers Integrated Management Controller Denial of Service Vulnerability

Cisco Integrated Management Controller IMC is a set of software from the American company Cisco Cisco for the management of UCS Unified Computing System. The software supports HTTP, SSH access, etc., and can perform operations such as powering on, powering off and rebooting the server. A...

CVE-2019-1900

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service DoS condition on an affected system. The vulnerability is due to insufficient validation of...

CVE-2019-1907

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by...

CVE-2019-1907

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by...

Input validation

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service DoS condition on an affected system. The vulnerability is due to insufficient validation of...

CVE-2019-1907

CVE-2019-1907 affects Cisco UCS Integrated Management Controller (IMC) web server. The vulnerability arises from improper handling of substring comparisons, enabling an authenticated, remote attacker to modify sensitive configuration values and escalate privileges from read-only to administrator....

CVE-2019-1907 Cisco Integrated Management Controller Substring Comparison Privilege Escalation Vulnerability

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations that are performed by...

CVE-2019-1900 Cisco Integrated Management Controller Unauthenticated Denial of Service Vulnerability

A vulnerability in the web server of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service DoS condition on an affected system. The vulnerability is due to insufficient validation of...

CVE-2019-1900

The CVE-2019-1900 issue affects Cisco Integrated Management Controller (IMC) web server. The vulnerability stems from insufficient validation of user-supplied input on the web interface, allowing an unauthenticated, remote attacker to induce the web server process to crash via crafted HTTP reques...

CVE-2019-12623

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different...

CVE-2019-12623

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different...

Design/Logic Flaw

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different...

CVE-2019-12623 Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration Vulnerability

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software NFVIS could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different...

CVE-2019-12623

CVE-2019-12623 affects Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) web server. In NFVIS versions prior to 3.12.1, the web server responds with different error codes for existing versus non-existing files, enabling an authenticated remote attacker to enumerate...