Overview 172 matches · 1 in Waratek scope · 0 protected · 6 exploited · 1 CISA KEV · 22 public PoC · 15 EPSS ≥ 0.5
172matches
1in Waratek scope0.6%
0protected0.0%
6exploited3.5%
1CISA KEV0.6%
22public PoC12.8%
15EPSS ≥ 0.58.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
0.6%
No exploit published
0
0.0%
Outside Waratek scope
8
4.7%
Not applicable
163
94.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
172
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 54 / year
20094
Not applicable4
Critical1
High1
Medium2
not blocked4
Exploited2
Working exploit published1
No public exploit1
20104
Not applicable4
Medium4
not blocked4
Working exploit published3
No public exploit1
20111
Not applicable1
Medium1
not blocked1
No public exploit1
20123
Not applicable3
Medium3
not blocked3
No public exploit3
20134
Not applicable4
High3
Medium1
not blocked4
Working exploit published2
No public exploit2
20144
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20150
20165
Not applicable5
Critical1
High3
Medium1
not blocked5
Working exploit published1
Forecast only1
No public exploit3
20171
Not applicable1
High1
not blocked1
Proof of concept only1
20184
Not applicable4
Critical1
High2
Medium1
not blocked4
No public exploit4
20196
Outside Waratek scope3
Not applicable3
Critical1
High2
Medium3
not blocked6
Forecast only3
No public exploit3
202018
Outside Waratek scope4
Not applicable14
Critical3
High9
Medium6
not blocked18
Proof of concept only1
No public exploit17
202110
Not applicable10
Critical1
High6
Medium3
not blocked10
Working exploit published1
No public exploit9
202212
Not applicable12
High6
Medium6
not blocked12
Forecast only1
No public exploit11
202310
Mitigation candidate1
Outside Waratek scope1
Not applicable8
Critical1
High8
Medium1
not blocked10
Exploited1
Proof of concept only2
Forecast only1
No public exploit6
202426
Not applicable26
Critical6
High11
Medium9
not blocked26
Proof of concept only10
No public exploit16
20256
Not applicable6
High2
Medium4
not blocked6
Proof of concept only2
No public exploit4
202654
Not applicable54
Critical14
High25
Medium14
Low1
not blocked54
Exploited3
Working exploit published1
Proof of concept only23
No public exploit27
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-30535 | Medium | 2022-08-04 | Not applicable | No public exploit | In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2021-25746 | High | 2022-05-06 | Not applicable | No public exploit | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. |
| CVE-2021-25745 | High | 2022-05-06 | Not applicable | No public exploit | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. |
| CVE-2022-27495 | Medium | 2022-05-05 | Not applicable | No public exploit | On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
| CVE-2021-23055 | Medium | 2022-04-21 | Not applicable | No public exploit | On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2022-28379 | Medium | 2022-04-03 | Not applicable | Forecast only | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. |
| CVE-2021-3618 | High | 2022-03-23 | Not applicable | No public exploit | ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer. |
| CVE-2022-23008 | Medium | 2022-01-25 | Not applicable | No public exploit | On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2021-42717 | High | 2021-12-07 | Not applicable | No public exploit | ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4. |
| CVE-2021-25742 | High | 2021-10-29 | Not applicable | No public exploit | A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. |
| CVE-2021-23050 | High | 2021-09-14 | Not applicable | No public exploit | On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2017-20005 | Critical | 2021-06-06 | Not applicable | No public exploit | NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module. |
| CVE-2021-23021 | Medium | 2021-06-01 | Not applicable | No public exploit | The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644. |
| CVE-2021-23020 | Medium | 2021-06-01 | Not applicable | No public exploit | The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys. |
| CVE-2021-23019 | High | 2021-06-01 | Not applicable | No public exploit | The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package. |
| CVE-2021-23018 | High | 2021-06-01 | Not applicable | No public exploit | Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster. |
| CVE-2021-23017 | High | 2021-06-01 | Not applicable | Working exploit published | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. |
| CVE-2020-36309 | Medium | 2021-04-06 | Not applicable | No public exploit | ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header. |
| CVE-2020-27730 | Critical | 2020-12-11 | Outside Waratek scope | No public exploit | In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities. |
| CVE-2020-8553 | Medium | 2020-07-29 | Not applicable | No public exploit | The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name. |
| CVE-2020-5911 | High | 2020-07-02 | Not applicable | No public exploit | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system. |
| CVE-2020-5910 | High | 2020-07-02 | Not applicable | No public exploit | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized. |
| CVE-2020-5909 | Medium | 2020-07-02 | Not applicable | No public exploit | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified. |
| CVE-2020-5901 | Critical | 2020-07-01 | Not applicable | No public exploit | In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system. |
| CVE-2020-5900 | High | 2020-07-01 | Not applicable | No public exploit | In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface. |
| CVE-2020-5899 | High | 2020-07-01 | Not applicable | No public exploit | In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code. |
| CVE-2020-5895 | High | 2020-05-07 | Not applicable | No public exploit | On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket. |
| CVE-2020-5894 | High | 2020-05-07 | Not applicable | No public exploit | On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. |
| CVE-2020-5867 | High | 2020-04-23 | Outside Waratek scope | No public exploit | In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages |
| CVE-2020-5866 | Medium | 2020-04-23 | Not applicable | No public exploit | In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments. |
| CVE-2020-5865 | Medium | 2020-04-23 | Outside Waratek scope | No public exploit | In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks. |
| CVE-2020-5864 | High | 2020-04-23 | Not applicable | No public exploit | In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default. |
| CVE-2020-7621 | Critical | 2020-04-02 | Not applicable | No public exploit | strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function. |
| CVE-2020-5863 | High | 2020-03-27 | Outside Waratek scope | No public exploit | In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system. |
| CVE-2018-1002104 | Medium | 2020-01-14 | Not applicable | No public exploit | Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly. |
| CVE-2019-20372 | Medium | 2020-01-09 | Not applicable | Proof of concept only | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. |
| CVE-2011-4968 | Medium | 2019-11-19 | Not applicable | No public exploit | nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM) |
| CVE-2019-15517 | Medium | 2019-08-23 | Not applicable | No public exploit | jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal. |
| CVE-2019-9516 | Medium | 2019-08-13 | Outside Waratek scope | Forecast only | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory. |
| CVE-2019-9513 | High | 2019-08-13 | Outside Waratek scope | Forecast only | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. |
| CVE-2019-9511 | High | 2019-08-13 | Outside Waratek scope | Forecast only | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. |
| CVE-2019-7401 | Critical | 2019-02-08 | Not applicable | No public exploit | NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request. This may result in a denial of service (router process crash) or possibly have unspecified other impact. |
| CVE-2018-19991 | Critical | 2018-12-10 | Not applicable | No public exploit | VeryNginx 0.3.3 allows remote attackers to bypass the Web Application Firewall feature because there is no error handler (for get_uri_args or get_post_args) to block the API misuse described in CVE-2018-9230. |
| CVE-2018-16845 | Medium | 2018-11-07 | Not applicable | No public exploit | nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module. |
| CVE-2018-16844 | High | 2018-11-07 | Not applicable | No public exploit | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. |
| CVE-2018-16843 | High | 2018-11-07 | Not applicable | No public exploit | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. |
| CVE-2017-7529 | High | 2017-07-13 | Not applicable | Proof of concept only | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. |
| CVE-2016-1247 | High | 2016-11-29 | Not applicable | Working exploit published | The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log. |
| CVE-2016-4450 | High | 2016-06-07 | Not applicable | No public exploit | os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. |
| CVE-2016-0747 | Medium | 2016-02-15 | Not applicable | No public exploit | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution. |
| CVE-2016-0746 | Critical | 2016-02-15 | Not applicable | No public exploit | Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing. |
| CVE-2016-0742 | High | 2016-02-15 | Not applicable | Forecast only | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response. |
| CVE-2014-3556 | Medium | 2014-12-29 | Not applicable | No public exploit | The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. |
| CVE-2014-3616 | Medium | 2014-12-08 | Not applicable | No public exploit | nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks. |
| CVE-2014-0088 | High | 2014-04-29 | Not applicable | No public exploit | The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32-bit platform, allows remote attackers to execute arbitrary code via a crafted request. |
| CVE-2014-0133 | High | 2014-03-28 | Not applicable | No public exploit | Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. |
| CVE-2013-4547 | High | 2013-11-23 | Not applicable | Working exploit published | nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI. |
| CVE-2013-0337 | High | 2013-10-27 | Not applicable | No public exploit | The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files. |
| CVE-2013-2070 | Medium | 2013-07-20 | Not applicable | No public exploit | http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028. |
| CVE-2013-2028 | High | 2013-07-20 | Not applicable | Working exploit published | The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow. |
| CVE-2011-4963 | Medium | 2012-07-26 | Not applicable | No public exploit | nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions and access restricted files via (1) a trailing . (dot) or (2) certain "$index_allocation" sequences in a request. |
| CVE-2012-2089 | Medium | 2012-04-17 | Not applicable | No public exploit | Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file. |
| CVE-2012-1180 | Medium | 2012-04-17 | Not applicable | No public exploit | Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request. |
| CVE-2011-4315 | Medium | 2011-12-08 | Not applicable | No public exploit | Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response. |
| CVE-2010-4180 | Medium | 2010-12-06 | Not applicable | No public exploit | OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. |
| CVE-2010-2266 | Medium | 2010-06-15 | Not applicable | Working exploit published | nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence. |
| CVE-2010-2263 | Medium | 2010-06-15 | Not applicable | Working exploit published | nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending ::$DATA to the URI. |
| CVE-2009-4487 | Medium | 2010-01-13 | Not applicable | Working exploit published | nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. |
| CVE-2009-3898 | Medium | 2009-11-24 | Not applicable | Working exploit published | Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method. |
| CVE-2009-3896 | Medium | 2009-11-24 | Not applicable | No public exploit | src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. |
| CVE-2009-3555 | Critical | 2009-11-09 | Not applicable | Exploited | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. |
| CVE-2009-2629 | High | 2009-09-15 | Not applicable | Exploited | Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests. |