CVSS: 5.0EPSS: 1%CPEs: 7EXPL: 0CVE-2001-1342
https://notcve.org/view.php?id=CVE-2001-1342
Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer. • http://bugs.apache.org/index.cgi/full/7522 http://marc.info/?l=bugtraq&m=99054258728748&w=2 http://online.securityfocus.com/archive/1/176144 http://www.apacheweek.com/issues/01-05-25 http://www.iss.net/security_center/static/6527.php http://www.securityfocus.com/bid/2740 https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.o •
CVSS: 5.0EPSS: 94%CPEs: 5EXPL: 6CVE-2001-0925 – Apache 1.3 - Artificially Long Slash Path Directory Listing
https://notcve.org/view.php?id=CVE-2001-0925
The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex. • https://www.exploit-db.com/exploits/20692 https://www.exploit-db.com/exploits/20693 https://www.exploit-db.com/exploits/20694 https://www.exploit-db.com/exploits/20695 http://www.apacheweek.com/features/security-13 http://www.debian.org/security/2001/dsa-067 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-077.php3 http://www.linuxsecurity.com/advisories/other_advisory-1452.html http://www.securityfocus.com/archive/1/168497 http://www.securityfocus.com/archive • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-1999-1125
https://notcve.org/view.php?id=CVE-1999-1125
Oracle Webserver 2.1 and earlier runs setuid root, but the configuration file is owned by the oracle account, which allows any local or remote attacker who obtains access to the oracle account to gain privileges or modify arbitrary files by modifying the configuration file. • http://marc.info/?l=bugtraq&m=87602880019796&w=2 •