HighCVSS 7.8
EPSS 1.0%
njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.
Technology
Nginx vulnerabilities
nginx open source and NGINX Plus. 549 published CVES affecting Nginx, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 549
- Critical
- 82
- High
- 248
- Medium
- 172
- Low
- 14
- Unscored
- 33
- CISA KEV
- 1
Latest Nginx CVEs
Newest publication first · page 19 of 22
-
-
MediumCVSS 5.5 EPSS 0.42%
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.
-
MediumCVSS 5.5 EPSS 0.42%
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
-
MediumCVSS 5.5 EPSS 0.53%
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
-
CVE-2020-8553 Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names
PublishedMediumCVSS 5.9 EPSS 0.89%The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyph...
-
DLA-2283-1 nginx - security update
PublishedUnknown -
MediumCVSS 5.4 EPSS 0.40%
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
-
HighCVSS 7.5 EPSS 1.2%
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
-
HighCVSS 7.3 EPSS 1.0%
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.
-
CriticalCVSS 9.6 EPSS 1.5%
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.
-
HighCVSS 7.8 EPSS 0.19%
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using t...
-
HighCVSS 8.8 EPSS 0.45%
In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.
-
HighCVSS 7.5 EPSS 1.4%
An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50.
-
HighCVSS 7.8 EPSS 0.30%
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writ...
-
HighCVSS 8.1 EPSS 1.0%
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.
-
CriticalCVSS 9.8 EPSS 3.7%
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to b...
-
HighCVSS 8.1 EPSS 0.48%
In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
-
MediumCVSS 5.5 EPSS 0.34%
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
-
HighCVSS 7.4 EPSS 1.1%
In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.
-
MediumCVSS 4.8 EPSS 0.40%
In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.
-
HighCVSS 7.5 EPSS 2.6%
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
-
CriticalCVSS 9.8 EPSS 3.0%
strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.
-
HighCVSS 8.6 EPSS 1.2%
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of...
-
MediumCVSS 5.3 EPSS 15.0%
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
-
MediumCVSS 4.8 EPSS 4.0%
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.