HServer Webserver <= 0.1.1 Multiple Directory Traversal Vulnerabilities - Active Check

HServer Webserver is prone to multiple directory traversal vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Stack overflow

Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request...

[oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision

2011-003 multiple implementations denial-of-service via hash algorithm collision Description: A variety of programming languages suffer from a denial-of-service DoS condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting...

OpenSSL Version Detection

Nessus was able to extract the OpenSSL version from the web server's banner. Note that security patches in many cases are backported and the displayed version number does not show the patch level. Using it to identify vulnerable software is likely to lead to false detections. C Tenable, Inc...

[SECURITY] Fedora 16 Update: yubikey-val-2.10-1.fc16

This is a server that validates Yubikey OTPs. It is written in PHP, for use with web servers such as Apache...

Web Servers UDP Flooding Denial of Service (CVE-2011-2013)

A denial of service vulnerability has been reported in all web servers. The vulnerability is due to the server's inability to handle multiple incoming UDP requests within a short period of time. Remote attackers may exploit this issue by rapidly sending a large number of UDP requests to the serve...

Embedthis GoAhead 2.5 'name' and 'address' XSS Vulnerabilities - Active Check

Embedthis GoAhead is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

nginx DNS Resolver Remote Heap Buffer Overflow Vulnerability

nginx is prone to a remote heap-based buffer-overflow vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nginx:nginx"...

Another Dutch CA, KPN, Stops Issuing Certificates After Finding DDoS Tool On Server

Another Dutch certificate authority, KPN, has stopped issuing digital certificates after finding attack tools on a server in its Web infrastructures. The CA said that while it doesn’t have evidence right now that it’s CA infrastructure was compromised, it is taking the actions as a precaution. Th...

Apache Httpd < 2.2.22 : mod_proxy reverse proxy exposure

An additional exposure was found when using modproxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web...

CVE-2011-3426

Cross-site scripting XSS vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header...

CVE-2011-3242

The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie...

Design/Logic Flaw

CFNetwork in Apple Mac OS X before 10.7.2 does not properly follow an intended cookie-storage policy, which makes it easier for remote web servers to track users via a cookie, related to a "synchronization issue."...

CVE-2011-3231

The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates, which allows remote web servers to execute arbitrary code via a crafted certificate...

CVE-2011-3242

The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie...

CVE-2011-3426

CVE-2011-3426 is an XSS vulnerability in Safari for iOS prior to 5, caused by Safari’s handling of files with the HTTP Content-Disposition header value “attachment.” A crafted file can execute inline scripts when opened in Safari, enabling remote script execution. Public references (e.g., JVN/JVN...

CVE-2011-3426

Cross-site scripting XSS vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header...

CVE-2011-3231

CVE-2011-3231 affects Apple Safari before 5.1.1 on Mac OS X before 10.7. The SSL implementation accesses uninitialized memory during X.509 certificate processing, enabling remote code execution via a crafted certificate. Public records include the NVD entry, vulnerability lists, and Apple’s advis...

Apache 1.3 -- mod_proxy reverse proxy exposure

Apache HTTP server project reports: An exposure was found when using modproxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from...

Web Servers HTTP Flooding Denial of Service

The vulnerability is due to the server's inability to handle multiple incoming HTTP requests within a short period of time. Remote attackers may exploit this issue by rapidly sending a large number of HTTP requests to the server. The attack may be initiated from one or more sources DDoS. Successf...