CVSS: 4.3EPSS: 0%CPEs: 22EXPL: 0CVE-2010-4180 – openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack
https://notcve.org/view.php?id=CVE-2010-4180
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. OpenSSL en versiones anteriores a 0.9.8q y 1.0.x en versiones anteriores a 1.0.0c, cuando SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG está habilitado, no previene adecuadamente la modificación del conjunto de cifrado en la caché de sesión, lo que permite a atacantes remotos forzar la degradación para un cifrado no destinado a través de vectores que involucran rastreo de tráfico de red para descubrir un identificador de sesión. • http://cvs.openssl.org/chngview?cn=20131 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777 http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html& •
CVSS: 5.0EPSS: 2%CPEs: 3EXPL: 6CVE-2010-2263 – Nginx 0.8.36 - Source Disclosure / Denial of Service
https://notcve.org/view.php?id=CVE-2010-2263
nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI. nginx 0.8 en versiones anteriores a la 0.8.40 y 0.7 en versiones anteriores a la 0.7.66, al ser ejecutado en Windows, permite a atacantes remotos obtener código fuente o contenido sin interpretar de ficheros de su elección que estén bajo la raíz de documentos web añadiendo ::$DATA a la URI. • https://www.exploit-db.com/exploits/13818 https://www.exploit-db.com/exploits/13822 http://spa-s3c.blogspot.com/2010/06/full-responsible-disclosurenginx-engine.html http://www.exploit-db.com/exploits/13818 http://www.exploit-db.com/exploits/13822 http://www.securityfocus.com/bid/40760 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 2CVE-2010-2266 – Nginx 0.8.36 - Source Disclosure / Denial of Service
https://notcve.org/view.php?id=CVE-2010-2266
nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence. nginx v0.8.36 permite a atacantes remotos provocar una denegación de servicio (mediante caída de la aplicación) a través de ciertas secuencias codificadas de salto de directorio que provocan corrupción de memoria, como se demuestra usando la secuencia "%c0.%c0." . • https://www.exploit-db.com/exploits/13818 http://www.exploit-db.com/exploits/13818 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.9EPSS: 0%CPEs: 285EXPL: 2CVE-2009-3898 – Nginx 0.7.61 - WebDAV Directory Traversal
https://notcve.org/view.php?id=CVE-2009-3898
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method. Vulnerabilidad de salto de directorio en src/http/modules/ngx_http_dav_module.c en nginx (como Engine X) anterior v0.7.63, y v0.8.x anterior v0.8.17, permite a usuarios autentificados remotamente crear y sobrescribir archivos de su elección a través de .. (punto punto) en la cabecera HTTP Destination para el WebDAV (1) COPY o (2) méetodo MOVE. • https://www.exploit-db.com/exploits/9829 http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0379.html http://marc.info/?l=oss-security&m=125897327321676&w=2 http://marc.info/?l=oss-security&m=125897425223039&w=2 http://marc.info/?l=oss-security&m=125900327409842&w=2 http://secunia.com/advisories/36818 http://secunia.com/advisories/48577 http://security.gentoo.org/glsa/glsa-201203-22.xml http://www.openwall.com/lists/oss-security/2009/11/20/1 http:&#x • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 6%CPEs: 283EXPL: 2CVE-2009-3896
https://notcve.org/view.php?id=CVE-2009-3896
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. src/http/ngx_http_parse.c en nginx (como Engine X) v0.1.0 hasta v0.4.14, v0.5.x anterior v0.5.38, v0.6.x anterior v0.6.39, v0.7.x anterior v0.7.62, y v0.8.x anterior 0.8.14 permite a atacantes remotos causar una denegación de servicio (deferencia puntero nulo y caída de proceso) a través de una URI larga. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=552035 http://marc.info/?l=nginx&m=125692080328141&w=2 http://secunia.com/advisories/48577 http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch3.diff.gz http://security.gentoo.org/glsa/glsa-201203-22.xml http://sysoev.ru/nginx/patch.null.pointer.txt http://www.debian.org/security/2009/dsa-1920 http://www.openwall.com/lists/oss-security/2009/11/20/1 http://www.openwall.com/lists/os • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •