CVSS: 9.8EPSS: 4%CPEs: 5EXPL: 0CVE-2012-2089
https://notcve.org/view.php?id=CVE-2012-2089
17 Apr 2012 — Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file. Un desbordamiento de búfer en ngx_http_mp4_module.c en el módulo de ngx_http_mp4_module en nginx v1.0.7 a v1.0.14 y en v1.1.3 a v1.1.18, cuando se usa la directiva mp4, permite a atacantes remotos causar una denegación... • http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079388.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 2%CPEs: 6EXPL: 0CVE-2011-4315
https://notcve.org/view.php?id=CVE-2011-4315
08 Dec 2011 — Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response. Desbordamiento de búfer basado en memoria dinámica en el procesamiento de compresión puntero en core/ngx_resolver.c en nginx antes de v1.0.10 permite a resolvers remotos causar una denegación de servicio (caída del demonio) o posiblemente tener un impacto no especificado a ... • http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070569.html • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 5%CPEs: 22EXPL: 0CVE-2010-4180 – openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack
https://notcve.org/view.php?id=CVE-2010-4180
06 Dec 2010 — OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. OpenSSL en versiones anteriores a 0.9.8q y 1.0.x en versiones anteriores a 1.0.0c, cuando SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG está habilitado, no previene adecuadame... • http://cvs.openssl.org/chngview?cn=20131 •
CVSS: 9.1EPSS: 39%CPEs: 3EXPL: 7CVE-2010-2263 – Nginx 0.8.36 - Source Disclosure / Denial of Service
https://notcve.org/view.php?id=CVE-2010-2263
14 Jun 2010 — nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI. nginx 0.8 en versiones anteriores a la 0.8.40 y 0.7 en versiones anteriores a la 0.7.66, al ser ejecutado en Windows, permite a atacantes remotos obtener código fuente o contenido sin interpretar de ficheros de su elección que estén bajo la raíz de documentos web añadiendo ::$DATA a la URI. • https://packetstorm.news/files/id/181086 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 6%CPEs: 2EXPL: 2CVE-2010-2266 – Nginx 0.8.36 - Source Disclosure / Denial of Service
https://notcve.org/view.php?id=CVE-2010-2266
14 Jun 2010 — nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence. nginx v0.8.36 permite a atacantes remotos provocar una denegación de servicio (mediante caída de la aplicación) a través de ciertas secuencias codificadas de salto de directorio que provocan corrupción de memoria, como se demuestra usando la secuencia "%c0.%c0." . • https://www.exploit-db.com/exploits/13818 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2009-4487 – Nginx 0.7.64 - Terminal Escape Sequence in Logs Command Injection
https://notcve.org/view.php?id=CVE-2009-4487
13 Jan 2010 — nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. nginx v0.7.64, escribe datos en un archivo de los sin depurar los caracteres no escribibles, lo que podría permitir a atacantes remotos modificar la ventana de título, o posiblemente ejecutar comandos de su elección o sobrescribir ... • https://www.exploit-db.com/exploits/33490 •
CVSS: 7.5EPSS: 2%CPEs: 283EXPL: 2CVE-2009-3896
https://notcve.org/view.php?id=CVE-2009-3896
24 Nov 2009 — src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. src/http/ngx_http_parse.c en nginx (como Engine X) v0.1.0 hasta v0.4.14, v0.5.x anterior v0.5.38, v0.6.x anterior v0.6.39, v0.7.x anterior v0.7.62, y v0.8.x anterior 0.8.14 permite a atacantes remotos causar una denegación de servic... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=552035 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 1%CPEs: 285EXPL: 2CVE-2009-3898 – Nginx 0.7.61 - WebDAV Directory Traversal
https://notcve.org/view.php?id=CVE-2009-3898
24 Nov 2009 — Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method. Vulnerabilidad de salto de directorio en src/http/modules/ngx_http_dav_module.c en nginx (como Engine X) anterior v0.7.63, y v0.8.x anterior v0.8.17, permite a usuarios autentificados remotamente crear y s... • https://www.exploit-db.com/exploits/9829 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 3%CPEs: 21EXPL: 6CVE-2009-3555 – Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass
https://notcve.org/view.php?id=CVE-2009-3555
09 Nov 2009 — The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other... • https://www.exploit-db.com/exploits/10071 • CWE-295: Improper Certificate Validation CWE-300: Channel Accessible by Non-Endpoint •
CVSS: 9.8EPSS: 86%CPEs: 10EXPL: 1CVE-2009-2629 – Nginx 0.6.38 - Heap Corruption
https://notcve.org/view.php?id=CVE-2009-2629
15 Sep 2009 — Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests. Desbordamiento de búfer inferior en src/http/ngx_http_parse.c en nginx v0.1.0 a la v0.5.37, v0.6.x a la v0.6.39, v0.7.x a la v0.7.62, y v0.8.x anterior a v0.8.15, permite a atacantes ejecutar código de su elección a través de peticiones HTTP manipuladas. • https://www.exploit-db.com/exploits/14830 • CWE-787: Out-of-bounds Write •