CVE-2013-4547

CVE-2013-4547 affects nginx versions 0.8.41–1.4.3 and 1.5.x prior to 1.5.7. Root cause: an unescaped space character in a URI can bypass intended restrictions, enabling remote bypass of access controls as described in the entry. Impact: restriction bypass is possible; exploitation and mitigation ...

CVE-2011-4315

CVE-2011-4315 describes a heap-based buffer overflow in nginx’s DNS resolver path (core/ngx_resolver.c) that can be triggered by compression-pointer processing. Affected: nginx versions prior to 1.0.10. Impact stated across sources: remote resolvers may cause a denial of service (daemon crash) an...

CVE-2012-0435

CVE-2012-0435 affects SUSE WebYaST prior to 1.2 0.2.63-0.6.1. A remote attacker can modify the hosts list via a crafted /host request on TCP port 4984, enabling a man-in-the-middle attack against WebYaST. The root cause is the insecure handling of the hosts list, allowing unauthenticated modifica...

CVE-2013-3709

CVE-2013-3709 affects WebYaST 1.3 where the config/initializers/secret_token.rb file has weak permissions, allowing a local attacker to read the Rails secret token and potentially forge session cookies. SUSE/openSUSE advisories (openSUSE-SU-2013:1952/1954/1961) patch this by making secret_token.r...