11 matches found
CVE-2014-3583
CVE-2014-3583 affects Apache HTTP Server 2.4.10 and earlier, where the handle_headers function in mod_proxy_fcgi.c can be triggered by long response headers to cause a denial of service (buffer over-read and daemon crash). The vulnerability stems from the proxy/Fcgi header handling in mod_proxy_f...
CVE-2016-4694
CVE-2016-4694 (httpoxy) affects Apache httpd on Apple OS X prior to 10.12/OS X Server prior to 5.2, where untrusted CGI client data in the HTTP_PROXY environment variable could redirect outbound traffic to an arbitrary proxy via a crafted Proxy header. The connected Apple security content shows A...
CVE-2015-1150
CVE-2015-1150 affects Apple OS X Server before 4.1, where the Firewall component uses an incorrect pathname in configuration files. This allows remote attackers to bypass network-access restrictions by sending packets intended for a blocked custom rule. Affected product: Apple OS X Server prior t...
CVE-2014-4406
Apple OS X Server’s CoreCollaboration component (Xcode Server) is affected by CVE-2014-4406, a Cross-site Scripting (XSS) vulnerability in Xcode Server prior to 3.2.1. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected open-source/enter...
CVE-2013-1034
CVE-2013-1034 affects Apple Mac OS X Server’s Wiki Server prior to version 2.2.2, where multiple XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD notes no confidentiality impact, but partial integrity impact (I:P) with no availabil...
CVE-2014-4424
CVE-2014-4424 is an SQL injection vulnerability in CoreCollaboration’s Wiki Server on Apple OS X Server, affecting OS X Server before 2.2.3 and OS X Server 3.x before 3.2.1. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Apple addresses include OS X S...
CVE-2014-4446
CVE-2014-4446 affects Mail Service on Apple OS X Server prior to 4.0. The SACL changes are cached and not enforced until the Mail service restarts, enabling remote authenticated users to bypass access restrictions in opportunistic circumstances. No explicit remediation details are provided in the...
CVE-2015-1151
CVE-2015-1151 affects Apple OS X Server prior to 4.1. The Wiki Server component is vulnerable such that a remote attacker can bypass access restrictions on Activity and People pages by connecting from an iPad client. The NVD entry lists a CVSS v2 base score of 5.0 (Medium) with network attack vec...
CVE-2013-5143
The CVE-2013-5143 issue affects Apple OS X Server’s RADIUS service (Server App) prior to version 3.0. The root cause is the service selecting a fallback X.509 certificate under unspecified conditions, which could enable a man-in-the-middle attack to hijack RADIUS sessions by an attacker who knows...
CVE-2016-4754
CVE-2016-4754 affects ServerDocs Server in Apple OS X Server before 5.2. The issue is weaknesses in the RC4 cryptographic algorithm that allow an unauthenticated, remote attacker to defeat cryptographic protection. Apple’s macOS Server 5.2 mitigation removes RC4 support for ServerDocs Server, add...