204 matches found
EUVD-2024-34446
Malicious code in bioql PyPI...
EUVD-2022-44913
Malicious code in bioql PyPI...
EUVD-2023-58107
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2019-25043
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a string index out of range error and worker-process crash for a Cookie: =abc...
Linux Distros Unpatched Vulnerability : CVE-2014-3199
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The wrap function in bindings/core/v8/custom/V8EventCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 38.0.2125.101, has an erroneous...
Denial Of Service (DoS)
Salt is vulnerable to Denial Of Service DoS. The vulnerability is due to unsanitized input handling due to the pubret method using an unvalidated jid value to construct a file path, which can be exploited to cause worker process hangs through crafted read operations...
Salt's worker process vulnerable to denial of service through file read operation
Worker process denial of service through file read operation. .A vulnerability exists in the Master's āpubretā method which is exposed to all minions. The un-sanitized input value ājidā is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by...
GHSA-989C-M532-P2HV Salt's worker process vulnerable to denial of service through file read operation
Worker process denial of service through file read operation. .A vulnerability exists in the Master's āpubretā method which is exposed to all minions. The un-sanitized input value ājidā is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by...
Linux Distros Unpatched Vulnerability : CVE-2022-41742
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R...
Exploit for Off-by-one Error in F5 Nginx
CVE-2021-23017-POC A security issue in nginx resolver was iden...
Fedora 37 : nginx (2022-12721789aa)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-12721789aa advisory. Security: processing of a specially crafted mp4 file by the ngxhttpmp4module might cause a worker process crash, worker process memory disclosure, o...
Fedora 39 : nginx / nginx-mod-fancyindex / nginx-mod-modsecurity / etc (2024-8ba5080dfa)
The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-8ba5080dfa advisory. Security: processing of a specially crafted mp4 file by the ngxhttpmp4module might cause a worker process crash CVE-2024-7347. Thanks to Nils Bars. Tenable h...
Fedora 39 : nginx (2024-2e4858330c)
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2e4858330c advisory. Security: when using HTTP/3, processing of a specially crafted QUIC session might cause a worker process crash, worker process memory disclosure on...
BIT-NGINX-2024-35200 NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate...
RHEL 7 : mod_auth_mellon (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - modauthmellon: Cross-site session transfer vulnerability CVE-2017-6807 - The amreadpostdata function in...
ALPINE-CVE-2024-35200
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate...
CVE-2024-31079
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacke...
RHEL 9 : nginx (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nginx: Memory corruption in the ngxhttpmp4module CVE-2022-41741 - Rejected reason: DO NOT USE THIS...
BIT-NGINX-2021-23017
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact...
BIT-NGINX-2022-41742 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to cause a worker process crash, or might...