267 results · Feed
-
High 7.8
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…
KEV Nov 3, 2021 -
Unscored —
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded serv…
-
Unscored —CVE-2019-0215 EPSS 10%
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verif…
-
Unscored —CVE-2018-17189 EPSS 19%
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …
-
Unscored —CVE-2018-17199 EPSS 20%
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the sess…
-
Unscored —CVE-2019-0190 EPSS 60%
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request…
-
Unscored —CVE-2018-11763 EPSS 51%
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, …
-
Unscored —CVE-2016-4975 EPSS 20%
mod_userdir CRLF injection
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed …
-
Unscored —CVE-2018-8011 EPSS 55%
mod_md, DoS via Coredumps on specially crafted requests
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
-
Unscored —CVE-2018-1333 EPSS 17%
DoS for HTTP/2 connections by crafted requests
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).
-
Unscored —
In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (Sessio…
-
Unscored —CVE-2018-1312 EPSS 16%
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent rep…
-
Unscored —CVE-2018-1301 EPSS 14%
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound a…
-
Unscored —CVE-2018-1303 EPSS 70%
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out…
-
Unscored —CVE-2018-1302 EPSS 13%
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have writ…
-
Unscored —CVE-2017-15710 EPSS 18%
In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCha…
-
Unscored —
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a m…
-
Unscored —
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a use…
-
Unscored —
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured …
-
Unscored —CVE-2016-2161 EPSS 21%
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and e…
-
Unscored —CVE-2016-8743 EPSS 13%
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests an…
-
Unscored —CVE-2017-7659 EPSS 54%
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NU…
-
Unscored —CVE-2017-9788 EPSS 57%
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type '…
-
Unscored —CVE-2017-7668 EPSS 57%
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which a…
-
Unscored —
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when s…
-
Unscored —CVE-2017-3167 EPSS 20%
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules o…
-
Unscored —CVE-2017-3169 EPSS 20%
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mo…
-
Unscored —
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h…
-
Unscored —CVE-2016-5387 EPSS 56%
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from …
-
Unscored —CVE-2016-1546 EPSS 16%
The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream w…
-
Unscored —CVE-2016-4979 EPSS 19%
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "…
-
Unscored —CVE-2015-3185 EPSS 16%
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider …
-
Unscored —CVE-2015-3183 EPSS 74%
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk header…
-
Unscored —CVE-2015-0228 EPSS 17%
The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows …
-
Unscored —CVE-2014-8109 EPSS 22%
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd conf…
-
Unscored —CVE-2014-3583 EPSS 11%
The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows re…
-
Unscored —CVE-2014-3581 EPSS 13%
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server be…
-
Unscored —CVE-2013-4352 EPSS 12%
The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6,…
-
Unscored —CVE-2014-0118 EPSS 37%
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when…
-
Unscored —
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a deni…