73 results · Feed
-
Unscored —
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from …
-
Unscored —
ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when usi…
-
Unscored —
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demon…
-
Unscored —
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the abil…
-
Unscored —
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle a…
-
High 7.5
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…
-
High 7.5
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…
-
High 7.5CVE-2019-9516 EPSS 57%
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. S…
-
High 8.2
nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to c…
-
Medium 5.3
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Medium 5.3CVE-2018-16844 EPSS 13%
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessiv…
-
Unscored —
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range f…
-
Unscored —CVE-2016-1247 Public exploit
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LT…
-
Unscored —CVE-2016-4450 EPSS 16%
os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of servic…
-
Unscored —
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remot…
-
Unscored —
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attack…
-
Unscored —CVE-2016-0742 EPSS 82%
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invali…
-
Unscored —
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and…
-
Unscored —
nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers,…
-
Unscored —
Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remot…
-
Unscored —
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unesca…
-
Unscored —
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log…
-
Unscored —CVE-2013-2070 EPSS 12%
http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with…
-
Unscored —CVE-2012-4929 Public exploit
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compre…
-
Unscored —
Directory traversal vulnerability in naxsi-ui/nx_extract.py in the Naxsi module before 0.46-1 for Nginx allows local us…
-
Unscored —CVE-2012-1180 EPSS 11%
Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensit…
-
Unscored —
Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 thro…
-
Unscored —
Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remot…
-
Unscored —
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers …
-
Unscored —
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and …
-
Unscored —CVE-2009-3896 EPSS 10%
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x…
-
Critical 9.8
Apache Tomcat affected by vulnerability in TLS and SSL protocol
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Serv…
-
Unscored —
Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, …