Most recent entries from all

bdu:2022-02389

Withdrawn: BELL-CVE-2019-20372 — CVE-2019-20372 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-719 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2021-avi-719

Withdrawn: CLEANSTART-2026-AF45008 — When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumptio…

Withdrawn by the publisher.

Affected: CleanStart: nginx

Multiple security vulnerabilities affect the nginx package. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. See references for individual vulnerability details.

cnvd-2020-03021

EUVD-2026-59825

fkie_cve-2019-20372

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

GHSA-c9vh-3f9g-f2xf

gsd-2019-20372

msrc_CVE-2019-20372 — NGINX before 1.17.7 with certain error_page configurations allows HTTP request smuggling as demonstrated by the ability…

msrc_CVE-2019-20372

openSUSE-SU-2020:0204-1 — Security update for nginx

Security update for nginx

RHSA-2020:2817 — Red Hat Security Advisory: rh-nginx116-nginx security update

nginx: HTTP request smuggling in configurations with URL redirect used as error_page

SCA-2025-0009 — Vulnerabilities affecting SICK TDC-E210GC

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances. An unauthorized access vulnerabiitly exists in all versions of Portainer, which could let a malicious user obtain sensitive information. NOTE: Portainer has received no detail of this CVE report. There is also no response after multiple attempts of contacting the original source. In ISC DHCP 4.1-ESV-R…

SUSE-SU-2020:0348-1 — Security update for nginx

Security update for nginx

UBUNTU-CVE-2019-20372

Affected: Ubuntu:Pro:14.04:LTS: nginx, Ubuntu:16.04:LTS: nginx, Ubuntu:18.04:LTS: nginx

WID-SEC-W-2023-2481 — NGINX: Schwachstelle ermöglicht Manipulation von Daten

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in NGINX ausnutzen, um Daten zu manipulieren.