CVSS: 4.3EPSS: 0%CPEs: 22EXPL: 0CVE-2010-4180 – openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack
https://notcve.org/view.php?id=CVE-2010-4180
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. OpenSSL en versiones anteriores a 0.9.8q y 1.0.x en versiones anteriores a 1.0.0c, cuando SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG está habilitado, no previene adecuadamente la modificación del conjunto de cifrado en la caché de sesión, lo que permite a atacantes remotos forzar la degradación para un cifrado no destinado a través de vectores que involucran rastreo de tráfico de red para descubrir un identificador de sesión. • http://cvs.openssl.org/chngview?cn=20131 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777 http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html& •
CVSS: 5.0EPSS: 2%CPEs: 3EXPL: 6CVE-2010-2263 – Nginx 0.8.36 - Source Disclosure / Denial of Service
https://notcve.org/view.php?id=CVE-2010-2263
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI. nginx 0.8 en versiones anteriores a la 0.8.40 y 0.7 en versiones anteriores a la 0.7.66, al ser ejecutado en Windows, permite a atacantes remotos obtener código fuente o contenido sin interpretar de ficheros de su elección que estén bajo la raíz de documentos web añadiendo ::$DATA a la URI. • https://www.exploit-db.com/exploits/13818 https://www.exploit-db.com/exploits/13822 http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html http://www.exploit-db.com/exploits/13818 http://www.exploit-db.com/exploits/13822 http://www.securityfocus.com/bid/40760 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 2CVE-2010-2266 – Nginx 0.8.36 - Source Disclosure / Denial of Service
https://notcve.org/view.php?id=CVE-2010-2266
nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence. nginx v0.8.36 permite a atacantes remotos provocar una denegación de servicio (mediante caída de la aplicación) a través de ciertas secuencias codificadas de salto de directorio que provocan corrupción de memoria, como se demuestra usando la secuencia "%c0.%c0." . • https://www.exploit-db.com/exploits/13818 http://www.exploit-db.com/exploits/13818 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 2CVE-2009-4487 – Nginx 0.7.64 - Terminal Escape Sequence in Logs Command Injection
https://notcve.org/view.php?id=CVE-2009-4487
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. nginx v0.7.64, escribe datos en un archivo de los sin depurar los caracteres no escribibles, lo que podría permitir a atacantes remotos modificar la ventana de título, o posiblemente ejecutar comandos de su elección o sobrescribir archivos, a través de una petición HTTP que contiene una secuencia de escape para el emulador de terminal. Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa are subject to log escape sequence injection vulnerabilities. • https://www.exploit-db.com/exploits/33490 http://www.securityfocus.com/archive/1/508830/100/0/threaded http://www.securityfocus.com/bid/37711 http://www.ush.it/team/ush/hack_httpd_escape/adv.txt •
CVSS: 5.0EPSS: 6%CPEs: 283EXPL: 2CVE-2009-3896
https://notcve.org/view.php?id=CVE-2009-3896
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. src/http/ngx_http_parse.c en nginx (como Engine X) v0.1.0 hasta v0.4.14, v0.5.x anterior v0.5.38, v0.6.x anterior v0.6.39, v0.7.x anterior v0.7.62, y v0.8.x anterior 0.8.14 permite a atacantes remotos causar una denegación de servicio (deferencia puntero nulo y caída de proceso) a través de una URI larga. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=552035 http://marc.info/?l=nginx&m=125692080328141&w=2 http://secunia.com/advisories/48577 http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch3.diff.gz http://security.gentoo.org/glsa/glsa-201203-22.xml http://sysoev.ru/nginx/patch.null.pointer.txt http://www.debian.org/security/2009/dsa-1920 http://www.openwall.com/lists/oss-security/2009/11/20/1 http://www.openwall.com/lists/os • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •