Nginx vulnerabilities

Latest Nginx CVEs

Newest publication first · page 18 of 22

1. CVE-2021-3882 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb

   Published 2021-10-14

   Medium·CVSS 6.8 EPSS 1.1%

   LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data b...

2. CVE-2021-23050 On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled polic...

   Published 2021-09-14

   High·CVSS 7.5 EPSS 0.47%

   On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the...

3. CVE-2021-24490 Email Artillery <= 4.1 - Arbitrary File Upload

   Published 2021-09-13

   Medium·CVSS 6.8 EPSS 0.56%

   The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF...

4. CVE-2021-38712 OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to block the access via an NGINX configuration file.

   Published 2021-08-16

   High·CVSS 7.5 EPSS 1.1%

   OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to block the access via an NGINX configuration file.

5. DLA-2680-1 nginx - security update

   Published 2021-06-07

   Unknown

6. CVE-2017-20005 NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date fa...

   Published 2021-06-06

   Critical·CVSS 9.8 EPSS 3.3%

   NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.

7. CVE-2021-23017 A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process cras...

   Published 2021-06-01

   High·CVSS 7.7 EPSS 53.5% Public exploit

   A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

8. CVE-2021-23021 The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.

   Published 2021-06-01

   Medium·CVSS 5.5 EPSS 0.23%

   The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.

9. CVE-2021-23020 The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys.

   Published 2021-06-01

   Medium·CVSS 5.5 EPSS 0.26%

   The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys.

10. CVE-2021-23019 The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.

    Published 2021-06-01

    High·CVSS 7.8 EPSS 0.24%

    The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.

11. CVE-2021-23018 Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster.

    Published 2021-06-01

    High·CVSS 7.4 EPSS 0.54%

    Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster.

12. DLA-2670-1 nginx - security update

    Published 2021-05-30

    Unknown

13. CVE-2021-32637 Authentication bypassed with malformed request URI

    Published 2021-05-28

    Critical·CVSS 10.0 EPSS 2.2%

    Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could th...

14. DSA-4921-1 nginx - security update

    Published 2021-05-28

    Unknown

15. CVE-2021-29509 Keepalive Connections Causing Denial Of Service in puma

    Published 2021-05-11

    High·CVSS 7.5 EPSS 1.6% PoC

    Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threa...

16. CVE-2020-36309 ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

    Published 2021-04-06

    Medium·CVSS 5.3 EPSS 1.4%

    ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

17. CVE-2021-21396 Bulk list client endpoint exposes too much metadata about a client

    Published 2021-03-26

    Medium·CVSS 6.5 EPSS 1.2%

    wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the GET /users/list-clients endpoint. The endpoint could be used by any logged i...

18. CVE-2020-29238 An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted....

    Published 2021-03-10

    High·CVSS 7.5 EPSS 16.5% Public exploit

    An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.

19. CVE-2021-21335 Basic Authentication can be bypassed using a malformed username

    Published 2021-03-08

    Critical·CVSS 9.8 EPSS 1.7%

    In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentication can be bypassed using a malformed username. This affects users of spnego-http-auth-nginx-module that have enabled basic authentication. This is fixed in ve...

20. CVE-2020-29658 Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.

    Published 2021-03-05

    Critical·CVSS 9.8 EPSS 4.1%

    Zoho ManageEngine Application Control Plus before 100523 has an insecure SSL configuration setting for Nginx, leading to Privilege Escalation.

21. CVE-2020-14097 Wrong nginx configuration, causing specific paths to be downloaded without authorization. This affects Xiaomi router AX6 ROM version < 1.0.18.

    Published 2021-01-13

    High·CVSS 7.5 EPSS 0.87%

    Wrong nginx configuration, causing specific paths to be downloaded without authorization. This affects Xiaomi router AX6 ROM version < 1.0.18.

22. CVE-2020-27730 In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.

    Published 2020-12-11

    Critical·CVSS 9.8 EPSS 1.7%

    In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.

23. CVE-2020-24660 Lack of URL normalization may lead to authorization bypass when URL access rules are used

    Published 2020-09-14

    Critical·CVSS 9.8 EPSS 2.5%

    An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

24. DSA-4750-1 nginx - security update

    Published 2020-08-26

    Unknown

25. CVE-2020-5416 CF clusters with NGINX in front of them may be vulnerable to DoS

    Published 2020-08-21

    Medium·CVSS 6.5 EPSS 1.2%

    Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP reque...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.