exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 25 of 100 RSS Feed

Files

apache2049.txt
Posted Mar 19, 2004
Site apache.org

Apache 2.0.49 has been released to address three security vulnerabilities. A race condition that allows for a denial of service attack, a condition that allow arbitrary strings to get written to the error log, and a memory leak in mod_ssl have all been addressed.

tags | advisory, denial of service, arbitrary, vulnerability, memory leak
advisories | CVE-2004-0174, CVE-2003-0020, CVE-2004-0113
SHA-256 | 666378a2dac755746ebe339e702406b4148bfa0f7e45b8cfb45a932c59ff3931

Related Files

Red Hat Security Advisory 2012-1166-01
Posted Aug 14, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1166-01 - mod_cluster is an Apache HTTP Server based load balancer that forwards requests from httpd to application server nodes. It can use the AJP, HTTP, or HTTPS protocols for communication with application server nodes. The RHSA-2012:0035 update for JBoss Enterprise Web Server 1.0.2 introduced a regression, causing mod_cluster to register and expose the root context of a server by default, even when "ROOT" was in the "excludedContexts" list in the mod_cluster configuration. If an application was deployed on the root context, a remote attacker could use this flaw to bypass intended access restrictions and gain access to that application.

tags | advisory, remote, web, root, protocol
systems | linux, redhat
advisories | CVE-2012-1154
SHA-256 | f780b0c2beb4f13cd5fd92b554dd4ba5fbcdbbc13f13e931837e863861773d32
Secunia Security Advisory 50186
Posted Aug 13, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in Apache Qpid, which can be exploited by malicious people to bypass certain security restrictions.

tags | advisory
SHA-256 | ca4a9ca066ded44a60ab8b838d6a9ab0b5cea990d6c69bcb228727ab637ec11b
LibreOffice / OpenOffice Code Execution
Posted Aug 10, 2012
Authored by Timo Warns | Site pre-cert.de

LibreOffice versions prior to 3.5.5 and Apache OpenOffice versions 3.4.0 and below suffer from a code execution vulnerability.

tags | advisory, code execution
advisories | CVE-2012-2665
SHA-256 | 3885049d1011ea25a22ee7462ec84341203997a45057579787881898c872ee6b
Secunia Security Advisory 50148
Posted Aug 6, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A security issue has been reported in the Apache Libcloud, which can be exploited by malicious people to conduct spoofing attacks.

tags | advisory, spoof
SHA-256 | d1d5fe805cc6958dfef07a0f9e383a7e8dd359745fd81685c4e0b39cf0325118
Apache Libcloud 0.11.1 Possible Man In The Middle
Posted Aug 3, 2012
Authored by Suman Jana, Vitaly Shmatikov, Martin Georgiev | Site libcloud.apache.org

Apache Libcloud versions 0.4.2 through 0.11.1 suffer from a possible man-in-the-middle condition. When establishing a secure (SSL / TLS) connection to a target server an invalid regular expression has been used for performing the hostname verification. Subset instead of the full target server hostname has been marked as an acceptable match for the given hostname.

tags | advisory
advisories | CVE-2012-3446
SHA-256 | 9e708dbf4b24b26ef40d5b23c71eaa9fae3674a5663c7c3350ac8e0bede741fe
Mandriva Linux Security Advisory 2012-114
Posted Jul 27, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-114 - A vulnerability has been discovered and corrected in mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids. The updated packages have been upgraded to the latest version which is not affected by this issue.

tags | advisory, local
systems | linux, mandriva
advisories | CVE-2012-2760
SHA-256 | 852743b91a6fc19a2da608cfbc287d316b2388514eed739efdd5105fe90c10d4
Apache Hadoop HDFS Information Disclosure
Posted Jul 10, 2012
Authored by Aaron T. Myers

Apache Hadoop version 2.0.0-alpha suffers from an HDFS information disclosure vulnerability. Malicious clients may gain write access to data for which they have read-only permission, or gain read access to any data blocks whose IDs they can determine.

tags | advisory, info disclosure
advisories | CVE-2012-3376
SHA-256 | 8ea4cabe21ecd11c0e368081bd0fd9e1d9007bdbf2e8fcaaf287c6748a7721da
Secunia Security Advisory 49840
Posted Jul 9, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in Apache Sling, which can be exploited by malicious people to cause a DoS (Denial of Service).

tags | advisory, denial of service
SHA-256 | 91010b5ff590244643a68e32676e6d2eee5f6ea60ec9ca154c924c3ead7b5178
Secunia Security Advisory 49782
Posted Jul 5, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Debian has issued an update for libapache-mod-security. This fixes a vulnerability, which can be exploited by malicious people to bypass certain security restrictions.

tags | advisory
systems | linux, debian
SHA-256 | fa00932de69677d2d347e5020e73afb44b98f142318a063eedac76b761105083
Red Hat Security Advisory 2012-1053-01
Posted Jul 3, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1053-01 - mod_cluster is an Apache HTTP Server based load balancer that forwards requests from httpd to application server nodes. It can use the AJP, HTTP, or HTTPS protocols for communication with application server nodes. The JBoss Enterprise Web Platform 5.1.2 release introduced a regression, causing mod_cluster to register and expose the root context of a server by default, even when "ROOT" was in the "excludedContexts" list in the mod_cluster configuration. If an application was deployed on the root context, a remote attacker could use this flaw to bypass intended access restrictions and gain access to that application.

tags | advisory, remote, web, root, protocol
systems | linux, redhat
advisories | CVE-2012-1154
SHA-256 | be342307962d2a0aba931e86cb2c6c1accf14360770bfcdedc4165480978b07d
Red Hat Security Advisory 2012-1052-01
Posted Jul 3, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1052-01 - mod_cluster is an Apache HTTP Server based load balancer that forwards requests from httpd to application server nodes. It can use the AJP, HTTP, or HTTPS protocols for communication with application server nodes. The JBoss Enterprise Application Platform 5.1.2 release introduced a regression, causing mod_cluster to register and expose the root context of a server by default, even when "ROOT" was in the "excludedContexts" list in the mod_cluster configuration. If an application was deployed on the root context, a remote attacker could use this flaw to bypass intended access restrictions and gain access to that application.

tags | advisory, remote, web, root, protocol
systems | linux, redhat
advisories | CVE-2012-1154
SHA-256 | ee17c0226e885f70c197193cd8587c7e1e7303d76510efafd7f64a7c8aa78b8b
Debian Security Advisory 2506-1
Posted Jul 3, 2012
Authored by Debian | Site debian.org

Debian Linux Security Advisory 2506-1 - Qualys Vulnerability and Malware Research Labs discovered a vulnerability in ModSecurity, a security module for the Apache webserver. In situations where present in HTTP headers, the vulnerability could allow an attacker to bypass policy and execute cross-site script (XSS) attacks through properly crafted HTML documents.

tags | advisory, web
systems | linux, debian
advisories | CVE-2012-2751
SHA-256 | 268fa7526f03a156888745c47b7f004f546de02d75ff3065034b7484a643b7e5
Mod_auth_pubtkt 0.8
Posted Jun 28, 2012
Site neon1.net

mod_auth_pubtkt is a simple Web single sign-on (SSO) solution for Apache. It validates authentication tickets provided by the client in a cookie using public-key cryptography (DSA or RSA). Thus, only the login server that generates the tickets needs to possess the private key, while Web servers can verify tickets given only the public key. The implementation of the login server is left to the user, but an example and a library in PHP are provided with the distribution.

Changes: A new option and corresponding field in the ticket ("bauth") make it possible to specify the Basic authorization username/password in the ticket (e.g., when reverse proxying to a third party system which cannot use mod_auth_pubtkt). The credentials can optionally be encrypted in the ticket.
tags | web, php
systems | unix
SHA-256 | 6243e220a650147a49269970cfc1491e6c727f6e9ef4eb34673909783bc258b2
Red Hat Security Advisory 2012-1046-01
Posted Jun 28, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1046-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations content. Note: This update disables file writing by default. A new PHP configuration directive, "xsl.security_prefs", can be used to enable file writing in XSLT.

tags | advisory, remote, web, arbitrary, php
systems | linux, redhat
advisories | CVE-2010-2950, CVE-2011-4153, CVE-2012-0057, CVE-2012-0781, CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2336, CVE-2012-2386
SHA-256 | fe71e26fd75c9403f91014baf93c4a6d167a5d5aef0be73d9f6c0fe60b8a1865
Red Hat Security Advisory 2012-1045-01
Posted Jun 28, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1045-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations content. Note: This update disables file writing by default. A new PHP configuration directive, "xsl.security_prefs", can be used to enable file writing in XSLT.

tags | advisory, remote, web, arbitrary, php
systems | linux, redhat
advisories | CVE-2011-4153, CVE-2012-0057, CVE-2012-0789, CVE-2012-1172, CVE-2012-2336
SHA-256 | 57bee9f577390f47d09269171763d581bac37a4751fb81fddb955d4db237ace9
Red Hat Security Advisory 2012-1047-01
Posted Jun 28, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1047-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations content. Note: This update disables file writing by default. A new PHP configuration directive, "xsl.security_prefs", can be used to enable file writing in XSLT.

tags | advisory, remote, web, arbitrary, php
systems | linux, redhat
advisories | CVE-2010-2950, CVE-2011-4153, CVE-2012-0057, CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2336, CVE-2012-2386
SHA-256 | ad1e0d74169944968d087c38eeee1c4b790cf754e68c22a60bc2f608214be628
Secunia Security Advisory 49593
Posted Jun 27, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in Apache Roller, which can be exploited by malicious people to conduct cross-site request forgery attacks.

tags | advisory, csrf
SHA-256 | 917313a6f7629cd9857192c1be48db0101dd3a74dd37bc5c24555e49d8e82b75
Secunia Security Advisory 49049
Posted Jun 26, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - A vulnerability has been reported in Apache Roller, which can be exploited by malicious people to conduct cross-site request forgery attacks.

tags | advisory, csrf
SHA-256 | 01856174b1dcf04423c8e4deaf524aed773ff87a20f9779011b6cdccad323169
Apache Roller 4.x / 5.x Cross Site Request Forgery
Posted Jun 25, 2012
Authored by Jun Zhu | Site apache.org

Apache Roller versions 4.0.0 through 4.0.1 and 5.0 suffer from a cross site request forgery vulnerability.

tags | advisory, csrf
advisories | CVE-2012-2380
SHA-256 | 4763bc6a74cffbb8c4a98ebfd85497d4c135a0229565573c11711bb32366736c
Apache Roller 4.x / 5.x Cross Site Scripting
Posted Jun 25, 2012
Authored by Jun Zhu | Site apache.org

Apache Roller versions 4.0.0 through 4.0.1 and 5.0 suffer from a cross site scripting vulnerability.

tags | advisory, xss
advisories | CVE-2012-2381
SHA-256 | 2a3ef283fa2c44950937510f6450a29a58cbf100742cf9efd1a746297da0ed8a
Secunia Security Advisory 49701
Posted Jun 25, 2012
Authored by Secunia | Site secunia.com

Secunia Security Advisory - Gentoo has issued an update for apache. This fixes two weaknesses, a security issue, and multiple vulnerabilities, which can be exploited by malicious, local users to bypass certain security restrictions and gain escalated privileges and by malicious people to bypass certain security restrictions, disclose potentially sensitive information, and cause a DoS (Denial of Service).

tags | advisory, denial of service, local, vulnerability
systems | linux, gentoo
SHA-256 | 5dcde0570daa54490d4a2ecaf350348ea6ae8c4b09304ba20e077bcb242c2242
Gentoo Linux Security Advisory 201206-25
Posted Jun 24, 2012
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201206-25 - Multiple vulnerabilities were found in Apache HTTP Server. Versions less than 2.2.22-r1 are affected.

tags | advisory, web, vulnerability
systems | linux, gentoo
advisories | CVE-2010-0408, CVE-2010-0434, CVE-2010-1452, CVE-2010-2791, CVE-2011-3192, CVE-2011-3348, CVE-2011-3368, CVE-2011-3607, CVE-2011-4317, CVE-2012-0021, CVE-2012-0031, CVE-2012-0053, CVE-2012-0883
SHA-256 | 384b2487f5f9cd58a858736f481966a3ddea24b706867ab02a3f57c4c6800e0f
Gentoo Linux Security Advisory 201206-24
Posted Jun 24, 2012
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201206-24 - Multiple vulnerabilities were found in Apache Tomcat, the worst of which allowing to read, modify and overwrite arbitrary files. Versions 5.5.34 are affected.

tags | advisory, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2008-5515, CVE-2009-0033, CVE-2009-0580, CVE-2009-0781, CVE-2009-0783, CVE-2009-2693, CVE-2009-2901, CVE-2009-2902, CVE-2010-1157, CVE-2010-2227, CVE-2010-3718, CVE-2010-4172, CVE-2010-4312, CVE-2011-0013, CVE-2011-0534, CVE-2011-1088, CVE-2011-1183, CVE-2011-1184, CVE-2011-1419, CVE-2011-1475, CVE-2011-1582, CVE-2011-2204, CVE-2011-2481, CVE-2011-2526, CVE-2011-2729, CVE-2011-3190, CVE-2011-3375, CVE-2011-4858
SHA-256 | 2554deef0443d375e952662e346879fa72a6339fcb77237d7e198b3b4d27ff87
Zero Day Initiative Advisory 12-100
Posted Jun 22, 2012
Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-100 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP OpenView Performance Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PMParamHandler component of Performance Manager, which is served via an Apache Tomcat instance that listens on TCP port 8081. The process receives a filename from a remote user and performs insufficient validation of the provided file path. Additionally, the user can specify an arbitrary extension due to premature truncation resulting from an embedded null byte. Remote unauthenticated attackers can exploit this vulnerability by sending malformed message packets to the target, which could lead to a directory traversing arbitrary file write and ultimately remote code execution under the context of the SYSTEM user.

tags | advisory, remote, arbitrary, tcp, code execution
advisories | CVE-2012-0127
SHA-256 | 62fba378efa118194bf75380e1caf3bdbb3a81ca43f314376ca1627030337be8
Red Hat Security Advisory 2012-1012-01
Posted Jun 20, 2012
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1012-01 - mod_cluster is an Apache HTTP Server based load balancer that forwards requests from httpd to application server nodes. It can use the AJP, HTTP, or HTTPS protocols for communication with application server nodes. The RHSA-2012:0036 update for JBoss Enterprise Web Server 1.0.2 introduced a regression, causing mod_cluster to register and expose the root context of a server by default, even when "ROOT" was in the "excludedContexts" list in the mod_cluster configuration. If an application was deployed on the root context, a remote attacker could use this flaw to bypass intended access restrictions and gain access to that application.

tags | advisory, remote, web, root, protocol
systems | linux, redhat
advisories | CVE-2012-1154
SHA-256 | 106f6909d35fc9d2c45a96191a20b629c3f0868b4f173b821e361478e556f98f
Page 1 of 4
Back1234Next

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close