CVSS: 7.5EPSS: 14%CPEs: 9EXPL: 0CVE-2014-3523 – httpd: WinNT MPM denial of service
https://notcve.org/view.php?id=CVE-2014-3523
20 Jul 2014 — Memory leak in the winnt_accept function in server/mpm/winnt/child.c in the WinNT MPM in the Apache HTTP Server 2.4.x before 2.4.10 on Windows, when the default AcceptFilter is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted requests. Fuga de memoria en la función winnt_accept en server/mpm/winnt/child.c en el MPM WinNT en Apache HTTP Server 2.4.x anterior a 2.4.10 en Windows, cuando el AcceptFilter por defecto está habilitado, permite a atacantes remotos causa... • http://httpd.apache.org/security/vulnerabilities_24.html • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 4%CPEs: 1EXPL: 0CVE-2013-4352 – httpd: mod_cache NULL pointer dereference crash
https://notcve.org/view.php?id=CVE-2013-4352
20 Jul 2014 — The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value. La función cache_invalidate en modules/cache/cache_storage.c en el módulo mod_cache en Apache HTTP Server 2.4.6, cuando un proxy del cacheo de reenvíos está habilitado, permite a servidores HTTP remot... • http://httpd.apache.org/security/vulnerabilities_24.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 56%CPEs: 8EXPL: 0CVE-2014-0118 – httpd: mod_deflate denial of service
https://notcve.org/view.php?id=CVE-2014-0118
20 Jul 2014 — The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size. La función deflate_in_filter en mod_deflate.c en el módulo mod_deflate en Apache HTTP Server anterior a 2.4.10, cuando la descompresión del cuerpo de una solicitud está habilitada, permite a atacantes remotos ca... • http://advisories.mageia.org/MGASA-2014-0304.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 38%CPEs: 2EXPL: 0CVE-2014-0231 – httpd: mod_cgid denial of service
https://notcve.org/view.php?id=CVE-2014-0231
20 Jul 2014 — The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor. El módulo mod_cgid en Apache HTTP Server anterior a 2.4.10 no tiene un mecanismo de timeout, lo que permite a atacantes remotos causar una denegación de servicio (cuelgue del proceso) a través de una solicitud en una secuencia de comandos CGI que no lee desde su... • http://advisories.mageia.org/MGASA-2014-0304.html • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 93%CPEs: 5EXPL: 1CVE-2014-0117 – Apache HTTP Server mod_proxy Denial Of Service Vulnerability
https://notcve.org/view.php?id=CVE-2014-0117
18 Jul 2014 — The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header. El módulo mod_proxy en Apache HTTP Server 2.4.x anterior a 2.4.10, cuando un proxy inverso está habilitado, permite a atacantes remotos causar una denegación de servicio (caída del proceso hijo) a través de una cabecera de conexión HTTP manipulada. A denial of service flaw was found in the mod_pro... • https://packetstorm.news/files/id/127563 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 95%CPEs: 18EXPL: 5CVE-2014-0226 – Apache httpd mod_status Heap Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-0226
16 Jul 2014 — Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c. Condición de carrera en el módulo mod_status en Apache HTTP Ser... • https://packetstorm.news/files/id/127546 • CWE-122: Heap-based Buffer Overflow CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 25%CPEs: 76EXPL: 1CVE-2013-5704 – httpd: bypass of mod_headers rules via chunked requests
https://notcve.org/view.php?id=CVE-2013-5704
15 Apr 2014 — The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such." El módulo mod_headers en el servidor de Apache HTTP 2.2.22 permite a atacantes remotos evadir directivas "RequestHeader unset" mediante la colocación de una cabera en la porción "trailer" de datos enviados con codificación de tran... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 33%CPEs: 14EXPL: 0CVE-2014-0098 – httpd: mod_log_config does not properly handle logging certain cookies resulting in DoS
https://notcve.org/view.php?id=CVE-2014-0098
18 Mar 2014 — The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation. La función log_cookie en mod_log_config.c en el módulo mod_log_config en el Apache HTTP Server anterior a 2.4.8 permite a atacantes remotos causar una denegación de servicio (fallo de segmentación y caída de demonio) a través de una cookie ... • http://advisories.mageia.org/MGASA-2014-0135.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 30%CPEs: 10EXPL: 0CVE-2013-6438 – httpd: mod_dav denial of service via crafted DAV WRITE request
https://notcve.org/view.php?id=CVE-2013-6438
18 Mar 2014 — The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request. La función dav_xml_get_cdata en main/util.c en el módulo mod_dav en el Apache HTTP Server anterior a 2.4.8 no elimina debidamente caracteres de espacio en blanco de secciones CDATA, lo que permite a atacantes remotos causar una de... • http://advisories.mageia.org/MGASA-2014-0135.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 46EXPL: 3CVE-2013-5697 – mod_accounting Module 0.5 - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2013-5697
26 Sep 2013 — SQL injection vulnerability in mod_accounting.c in the mod_accounting module 0.5 and earlier for Apache allows remote attackers to execute arbitrary SQL commands via a Host header. Vulnerabilidad de inyección SQL en mod_accounting.c del módulo mod_accounting para Apache en la versión 0.5 y anteriores permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de la cabecera Host. mod_accounting version 0.5 suffers from a remote blind SQL injection vulnerability. • https://packetstorm.news/files/id/123408 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •