Nginx Security Vulnerabilities and Issues — Nginx CVE List

Lucene search

F5Nginx

4 matches found

CVE•added 2014/03/28 3:55 p.m.•345 views

CVE-2014-0133

Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.

7.5CVSS9.5AI score0.20913EPSS

CVE•added 2014/12/08 11:59 a.m.•187 views

CVE-2014-3616

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

4.3CVSS6.4AI score0.02276EPSS

CVE•added 2014/12/29 8:59 p.m.•95 views

CVE-2014-3556

The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext comman...

6.8CVSS6.8AI score0.6945EPSS

CVE•added 2014/04/29 2:38 p.m.•86 views

CVE-2014-0088

The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request.

7.5CVSS7.5AI score0.02625EPSS