Fixed in
Check your version
nginx -vCVEs affecting 0.7
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2009-3555 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Ser... | 9.8 | 87.3% | 2009-11-09 | |
| CVE-2016-0746 | Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remo... | 9.8 | 8.9% | 2016-02-16 | |
| CVE-2017-20005 | NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a... | 9.8 | 3.3% | 2021-06-07 | |
| CVE-2016-1247 | The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu... | 7.8 | 4.9% | 2016-11-30 | |
| CVE-2021-23017 | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP pack... | 7.7 | 53.5% | 2021-06-01 | |
| CVE-2009-2629 | Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before... | 7.5 | 75.1% | 2009-09-16 | |
| CVE-2013-0337 | The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) a... | 7.5 | 2.2% | 2013-10-27 | |
| CVE-2016-0742 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of servic... | 7.5 | 82.4% | 2016-02-16 | |
| CVE-2017-7529 | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in ngin... | 7.5 | 62.6% | 2017-07-13 | |
| CVE-2021-3618 | ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing differen... | 7.4 | 2.0% | 2022-03-23 | |
| CVE-2009-4487 | nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote a... | 6.8 | 26.8% | 2010-01-14 | |
| CVE-2011-4315 | Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 all... | 6.8 | 6.0% | 2011-12-09 | |
| CVE-2016-0747 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which all... | 5.3 | 8.7% | 2016-02-16 | |
| CVE-2019-20372 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by... | 5.3 | 15.0% | 2020-01-10 | |
| CVE-2009-3896 | src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.... | 5.0 | 10.2% | 2009-11-25 | |
| CVE-2010-2263 | nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain sour... | 5.0 | 71.9% | 2010-06-15 | |
| CVE-2010-2266 | nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traver... | 5.0 | 21.5% | 2010-06-15 | |
| CVE-2012-1180 | Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obta... | 5.0 | 10.6% | 2012-04-18 | |
| CVE-2011-4963 | nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access rest... | 5.0 | 6.0% | 2012-07-27 | |
| CVE-2009-3898 | Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7... | 4.9 | 15.9% | 2009-11-25 | |
| CVE-2011-4968 | nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the... | 4.8 | 4.0% | 2019-11-20 | |
| CVE-2010-4180 | OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does... | 4.3 | 9.5% | 2010-12-06 | |
| CVE-2014-3616 | nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple... | 4.3 | 5.7% | 2014-12-08 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).