TI-2021-02584 CVE-2021-3639 · GHSA-mhcv-7w89-jjj5
Open redirect in mod_auth_mellon
Priority LOW 29
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly.
Vulnerabilities
6 records
TI-2017-04558 CVE-2017-6807 · GHSA-25ph-rcq4-c44c
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack…
Priority LOW 29
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server t…
TI-2016-01957 CVE-2016-2146 · GHSA-cm8g-34xp-fvpw
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount…
Priority LOW 39
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory con…
TI-2016-01956 CVE-2016-2145 · GHSA-c4mg-qw2m-q8mc
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the…
Priority LOW 38
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and proc…
TI-2014-07038 CVE-2014-8566 · GHSA-4cw9-fccf-p75x
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive…
Priority LOW 34
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "session…
TI-2014-07039 CVE-2014-8567 · GHSA-wggx-3j62-wmwr
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of…
Priority MEDIUM 47
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.