CVSS: 5.0EPSS: 8%CPEs: 283EXPL: 2CVE-2009-3896
https://notcve.org/view.php?id=CVE-2009-3896
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. src/http/ngx_http_parse.c en nginx (como Engine X) v0.1.0 hasta v0.4.14, v0.5.x anterior v0.5.38, v0.6.x anterior v0.6.39, v0.7.x anterior v0.7.62, y v0.8.x anterior 0.8.14 permite a atacantes remotos causar una denegación de servicio (deferencia puntero nulo y caída de proceso) a través de una URI larga. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=552035 http://marc.info/?l=nginx&m=125692080328141&w=2 http://secunia.com/advisories/48577 http://security.debian.org/pool/updates/main/n/nginx/nginx_0.4.13-2+etch3.diff.gz http://security.gentoo.org/glsa/glsa-201203-22.xml http://sysoev.ru/nginx/patch.null.pointer.txt http://www.debian.org/security/2009/dsa-1920 http://www.openwall.com/lists/oss-security/2009/11/20/1 http://www.openwall.com/lists/os • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.9EPSS: 0%CPEs: 285EXPL: 2CVE-2009-3898 – Nginx 0.7.61 - WebDAV Directory Traversal
https://notcve.org/view.php?id=CVE-2009-3898
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method. Vulnerabilidad de salto de directorio en src/http/modules/ngx_http_dav_module.c en nginx (como Engine X) anterior v0.7.63, y v0.8.x anterior v0.8.17, permite a usuarios autentificados remotamente crear y sobrescribir archivos de su elección a través de .. (punto punto) en la cabecera HTTP Destination para el WebDAV (1) COPY o (2) méetodo MOVE. • https://www.exploit-db.com/exploits/9829 http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0379.html http://marc.info/?l=oss-security&m=125897327321676&w=2 http://marc.info/?l=oss-security&m=125897425223039&w=2 http://marc.info/?l=oss-security&m=125900327409842&w=2 http://secunia.com/advisories/36818 http://secunia.com/advisories/48577 http://security.gentoo.org/glsa/glsa-201203-22.xml http://www.openwall.com/lists/oss-security/2009/11/20/1 http:&#x • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •