Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2017-6807

mod_auth_mellon: Cross-site session transfer vulnerability

mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Uninett
Products
Mod Auth Mellon
CVE-2014-8566

mod_auth_mellon: remote memory disclosure flaw

The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."

CVSS 2.0 · 6.4 Medium EPSS 2.7% KEV · Not listed
Vendors
Oracle Redhat Uninett
Products
Linux Enterprise Linux Mod Auth Mellon
CVE-2016-2145

mod_auth_mellon: Missing error check when calling ap_get_client_block()

The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Fedoraproject Uninett
Products
Fedora Mod Auth Mellon
CVE-2016-2146

mod_auth_mellon: Failure to limit amount of POST data submitted by client

The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Fedoraproject Uninett
Products
Fedora Mod Auth Mellon
CVE-2021-3639

mod_auth_mellon: Open Redirect vulnerability in logout URLs

A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.

CVSS 3.1 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Uninett
Products
Enterprise Linux Mod Auth Mellon