|
101
|
9.8
7.5
|
CRITICAL
Network
|
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2017-7679
|
cpe:2.3:a:apache:http_server:*:*
|
2.2.0
2.4.0
|
|
|
2.2.33
2.4.26
|
2024-11-21 12:32
2017-06-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
102
|
9.8
7.5
|
CRITICAL
Network
|
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
|
CWE-476
NULL Pointer Dereference
|
CVE-2017-3169
|
cpe:2.3:a:apache:http_server:2.4.2:*
cpe:2.3:a:apache:http_server:2.4.25:*
cpe:2.3:a:apache:http_server:2.4.23:*<…
|
|
|
|
|
2024-11-21 12:24
2017-06-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
103
|
7.5
5.0
|
HIGH
Network
|
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously…
|
CWE-125
Out-of-bounds Read
|
CVE-2017-7668
|
cpe:2.3:a:apache:http_server:2.4.25:*
cpe:2.3:a:apache:http_server:2.4.24:*
cpe:2.3:a:apache:http_server:2.2.32:*
|
|
|
|
|
2024-11-21 12:32
2017-06-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
104
|
9.8
7.5
|
CRITICAL
Network
|
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being…
|
CWE-287
Improper Authentication
|
CVE-2017-3167
|
cpe:2.3:a:apache:http_server:*:*
|
2.2.0
2.4.0
|
|
|
2.2.33
2.4.26
|
2024-11-21 12:24
2017-06-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
105
|
7.5
5.0
|
HIGH
Network
|
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to ca…
|
CWE-20
CWE-399
Improper Input Validation
Resource Management Errors
|
CVE-2016-8740
|
cpe:2.3:a:apache:http_server:2.4.23:*
cpe:2.3:a:apache:http_server:2.4.22:*
cpe:2.3:a:apache:http_server:2.4.21:*…
|
|
|
|
|
2024-11-21 11:59
2016-12-6
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
106
|
8.1
6.8
|
HIGH
Network
|
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, wh…
|
NVD-CWE-noinfo
|
CVE-2016-5387
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.1
2.2.0
|
2.4.23
2.2.31
|
|
|
2024-11-21 11:54
2016-07-19
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
107
|
7.5
5.0
|
HIGH
Network
|
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allow…
|
CWE-284
Improper Access Control
|
CVE-2016-4979
|
cpe:2.3:a:apache:http_server:2.4.20:*
cpe:2.3:a:apache:http_server:2.4.19:*
cpe:2.3:a:apache:http_server:2.4.18:*
|
|
|
|
|
2024-11-21 11:53
2016-07-6
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
108
|
5.9
4.3
|
MEDIUM
Network
|
The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a …
|
CWE-399
Resource Management Errors
|
CVE-2016-1546
|
cpe:2.3:a:apache:http_server:2.4.18:*
cpe:2.3:a:apache:http_server:2.4.17:*
|
|
|
|
|
2024-11-21 11:46
2016-07-6
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
109
|
-
4.3
|
MEDIUM
|
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather …
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2015-3185
|
cpe:2.3:a:apache:http_server:2.4.9:*
cpe:2.3:a:apache:http_server:2.4.8:*
cpe:2.3:a:apache:http_server:2.4.7:*
|
|
|
|
2024-11-21 11:28
2015-07-21
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
|
110
|
-
5.0
|
MEDIUM
|
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a…
|
CWE-20
CWE-17
Improper Input Validation
Code
|
CVE-2015-3183
|
cpe:2.3:a:apache:http_server:*:*
|
2.2.0
2.4.0
|
|
|
2.2.31
2.4.16
|
2024-11-21 11:28
2015-07-21
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|