144 results · Feed
-
Unscored —CVE-2018-1301 EPSS 14%
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound a…
-
Unscored —CVE-2018-1303 EPSS 70%
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out…
-
Unscored —CVE-2018-1302 EPSS 13%
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have writ…
-
Unscored —CVE-2017-15710 EPSS 18%
In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCha…
-
Unscored —
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a m…
-
Unscored —
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a use…
-
Unscored —
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured …
-
Unscored —CVE-2016-2161 EPSS 21%
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and e…
-
Unscored —CVE-2016-8743 EPSS 13%
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests an…
-
Unscored —CVE-2017-9788 EPSS 57%
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type '…
-
Unscored —CVE-2017-7668 EPSS 57%
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which a…
-
Unscored —
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when s…
-
Unscored —CVE-2017-3167 EPSS 20%
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules o…
-
Unscored —CVE-2017-3169 EPSS 20%
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mo…
-
Unscored —CVE-2016-5387 EPSS 56%
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from …
-
Unscored —CVE-2015-3185 EPSS 16%
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider …
-
Unscored —CVE-2015-3183 EPSS 74%
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk header…
-
Unscored —CVE-2014-3581 EPSS 13%
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server be…
-
Unscored —CVE-2014-0118 EPSS 37%
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when…
-
Unscored —
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a deni…
-
Unscored —CVE-2014-0231 EPSS 45%
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote atta…
-
Unscored —CVE-2014-0117 EPSS 36%
The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote atta…
-
Unscored —CVE-2013-5704 EPSS 58%
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directi…
-
Unscored —
readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor co…