CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28656 – Apache Zeppelin: CSRF vulnerability in the Credentials page
https://notcve.org/view.php?id=CVE-2021-28656
Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions. La vulnerabilidad de Cross-Site Request Forgery (CSRF) en la página de credenciales de Apache Zeppelin permite a un atacante enviar solicitudes maliciosas. Este problema afecta a Apache Zeppelin Apache Zeppelin versión 0.9.0 y versiones anteriores. • http://www.openwall.com/lists/oss-security/2024/04/09/3 https://lists.apache.org/thread/dttzkkv4qyn1rq2fdv1r94otb1osxztc • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31860 – Apache Zeppelin: Path traversal vulnerability
https://notcve.org/view.php?id=CVE-2024-31860
Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue. Vulnerabilidad de validación de entrada incorrecta en Apache Zeppelin. Al agregar indicadores de ruta relativa (por ejemplo .. ), los atacantes pueden ver el contenido de cualquier archivo en el sistema de archivos al que pueda acceder la cuenta del servidor. Este problema afecta a Apache Zeppelin: desde 0.9.0 antes de 0.11.0. Se recomienda a los usuarios actualizar a la versión 0.11.0, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/04/09/2 https://github.com/apache/zeppelin/pull/4632 https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24746 – Apache NimBLE: Denial of service in NimBLE Bluetooth stack
https://notcve.org/view.php?id=CVE-2024-24746
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT server leading to denial of service in Bluetooth stack or device. This issue affects Apache NimBLE: through 1.6.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue. Bucle con vulnerabilidad de condición de salida inalcanzable ("bucle infinito") en Apache NimBLE. La operación GATT especialmente manipulada puede causar un bucle infinito en el servidor GATT que lleva a la denegación de servicio en la pila o dispositivo Bluetooth. Este problema afecta a Apache NimBLE: hasta 1.6.0. Se recomienda a los usuarios actualizar a la versión 1.7.0, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/04/05/2 https://github.com/apache/mynewt-nimble/commit/d42a0ebe6632bd0c318560e4293a522634f60594 https://lists.apache.org/thread/bptkzc0o2ymjk8qqzqdmy39kcmh27078 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24795 – Apache HTTP Server: HTTP Response Splitting in multiple modules
https://notcve.org/view.php?id=CVE-2024-24795
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue. La división de la respuesta HTTP en varios módulos en el servidor HTTP Apache permite que un atacante pueda inyectar encabezados de respuesta maliciosos en aplicaciones backend para provocar un ataque de desincronización HTTP. Se recomienda a los usuarios actualizar a la versión 2.4.59, que soluciona este problema. A flaw was found in httpd. An HTTP response splitting in multiple httpd modules may allow an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. • http://www.openwall.com/lists/oss-security/2024/04/04/5 https://httpd.apache.org/security/vulnerabilities_24.html https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html https://lists.debian.org/debian-lts-announce/2024/05/msg00014.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ https://lists.fedoraproj • CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38709 – Apache HTTP Server: HTTP response splitting
https://notcve.org/view.php?id=CVE-2023-38709
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. La validación de entrada defectuosa en el núcleo de Apache permite que generadores de contenido/backend maliciosos o explotables dividan las respuestas HTTP. Este problema afecta al servidor HTTP Apache: hasta 2.4.58. A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers, resulting in an HTTP response splitting. • http://www.openwall.com/lists/oss-security/2024/04/04/3 https://httpd.apache.org/security/vulnerabilities_24.html https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNV4SZAPV • CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') CWE-1284: Improper Validation of Specified Quantity in Input •