Page 20 of 106 results (0.017 seconds)

CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1

CVE-2013-2249

https://notcve.org/view.php?id=CVE-2013-2249

mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors. mod_session_dbd.c en el módulo mod_session_dbd en Apache HTTP Server anterior a 2.4.5, continua con las operaciones de guardado para una sesión sin considerar la "dirty flag" y la solicitud para una nuevo ID de sesión, lo que tiene un impacto no especificado y vectores de ataque remotos. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/session/mod_session_dbd.c?r1=1409170&r2=1488158&diff_format=h http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-2249 http://www.apache.org/dist/httpd/CHANGES_2.4.6 https://httpd.apache.org/security/vulnerabilities_24.html https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E https://lists.apach •

CVSS: 5.0EPSS: 92%CPEs: 23EXPL: 1

CVE-2013-1896 – httpd: mod_dav DoS (httpd child process crash) via a URI MERGE request with source URI not handled by mod_dav

https://notcve.org/view.php?id=CVE-2013-1896

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI. mod_dav.c en el Apache HTTP Server anterior a 2.2.25 no determina adecuadamente si DAV está activado para URI, lo que permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria) a través de una petición MERGE en la que la URI está configurada para manejarse con el módulo mod_dav_svn, pero determinados atributos href en los datos XML se refieren a una URI que no es del tipo DAV. • http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html http://rhn.redhat.com/errata/RHSA-2013-1156.html http://rhn.redhat.com/errata/RHSA-2013-1207.html http://rhn.redhat.com/errata/RHSA-2013-1208.html http://rhn.redhat.com/errata/RHSA-2013-1209.html http://secunia.com/advisories/55032 http://support.apple.com/kb/HT6150 http:/ •

CVSS: 5.1EPSS: 20%CPEs: 27EXPL: 0

CVE-2013-1862 – httpd: mod_rewrite allows terminal escape sequences to be written to the log file

https://notcve.org/view.php?id=CVE-2013-1862

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. mod_rewrite.c en el modulo mod_rewrite en Apache HTTP Server v2.2.x anterior a v2.2.25 escribe datos en un archivo de log sin eliminar caracteres no imprimibles, lo que podría permitir a un atacante remotos ejecutar comandos arbitrarios a través de una petición HTTP que contiene una secuencia de escape para un emulador de terminal. • http://lists.opensuse.org/opensuse-updates/2013-08/msg00026.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00029.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00030.html http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch http://rhn.redhat.com/errata/RHSA-2013-0815.html http://rhn.redhat.com/errata/RHSA-2013-1207.html http://rhn.redhat.com/errata/RHSA-2013-1208.html http://rhn.redhat.com/errata/RHSA-2013-1209.html http://secunia. •

CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 0

CVE-2012-3499 – httpd: multiple XSS flaws due to unescaped hostnames

https://notcve.org/view.php?id=CVE-2012-3499

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Apache HTTP Server v2.2.x antes de v2.2.24-dev y v2.4.x antes de v2.4.4 que permite ataques remotos de inyección de web script o HTML por vectores relacionados con los nombres de host y URIs en el (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, y (5) módulos mod_status. • http://httpd.apache.org/security/vulnerabilities_22.html http://httpd.apache.org/security/vulnerabilities_24.html http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html http://marc.info/?l=bugtraq&m=136612293908376&w=2 http://rhn.redhat.com/errata/RHSA-2013-0815.html http://rhn.redhat.com/errata/RHSA-2013-1207.html http://rhn.redhat.com/errata/RHSA-2013-1208.html http://rhn.redhat • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 21%CPEs: 27EXPL: 0

CVE-2012-4558 – httpd: XSS flaw in mod_proxy_balancer manager interface

https://notcve.org/view.php?id=CVE-2012-4558

Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en la función balancer_handler en la interfaz de gestión mod_proxy_balancer.c en el módulo mod_proxy_blanacer de Apache HTTP Server v2.2.x antes de v2.2.24-dev y v2.4.x antes de v2.4.4 que permite ataques remotos de inyección web script p HTML por cadenas hechas a mano. • http://httpd.apache.org/security/vulnerabilities_22.html http://httpd.apache.org/security/vulnerabilities_24.html http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101196.html http://marc.info/?l=bugtraq&m=136612293908376&w=2 http://rhn.redhat.com/errata/RHSA-2013-0815.html http://rhn.redhat.com/errata/RHSA-2013-1207.html http://rhn.redhat.com/errata/RHSA-2013-1208.html http://rhn.redhat • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •