CVSS: 7.5EPSS: 70%CPEs: 10EXPL: 2CVE-2002-2029 – Apache 1.3.20 (Win32) - 'PHP.exe' Remote File Disclosure
https://notcve.org/view.php?id=CVE-2002-2029
PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string. • https://www.exploit-db.com/exploits/21204 http://www.iss.net/security_center/static/7815.php http://www.securiteam.com/windowsntfocus/5ZP030U60U.html http://www.securityfocus.com/bid/3786 •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2002-1822
https://notcve.org/view.php?id=CVE-2002-1822
IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page (JSP). • http://marc.info/?l=bugtraq&m=103726020802411&w=2 http://www.iss.net/security_center/static/10628.php http://www.securityfocus.com/bid/6181 •
CVSS: 5.0EPSS: 1%CPEs: 13EXPL: 0CVE-2002-2103
https://notcve.org/view.php?id=CVE-2002-2103
Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities. • http://www.apache.org/dist/httpd/CHANGES_1.3 http://www.iss.net/security_center/static/8629.php http://www.securityfocus.com/bid/4358 •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 3CVE-2002-1850 – Apache 2.0.39/40 - Oversized STDERR Buffer Denial of Service
https://notcve.org/view.php?id=CVE-2002-1850
mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script. • https://www.exploit-db.com/exploits/21854 http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/generators/mod_cgi.c?r1=1.148.2.7&r2=1.148.2.8 http://issues.apache.org/bugzilla/show_bug.cgi?id=10515 http://issues.apache.org/bugzilla/show_bug.cgi?id=22030 http://marc.info/?l=apache-httpd-dev&m=103291952019514&w=2 http://seclists.org/bugtraq/2002/Sep/0253.html http://securitytracker.com/id? • CWE-667: Improper Locking •
CVSS: 2.6EPSS: 0%CPEs: 19EXPL: 0CVE-2002-1233
https://notcve.org/view.php?id=CVE-2002-1233
A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131. Apache 1.3.27 y anteriores, y posiblemente versiones posteriores, puede permitir a usuarios locales leer o modificar el fichero de contraseñas de Apache mediante un ataque de enlaces simbólicos en ficheros temporales cuando el administrador de Apache corre htpasswd o htdigest. • http://marc.info/?l=bugtraq&m=103480856102007&w=2 http://www.debian.org/security/2002/dsa-187 http://www.debian.org/security/2002/dsa-188 http://www.debian.org/security/2002/dsa-195 http://www.iss.net/security_center/static/10412.php http://www.iss.net/security_center/static/10413.php http://www.securityfocus.com/bid/5981 http://www.securityfocus.com/bid/5990 •