CVSS: 7.8EPSS: 10%CPEs: 55EXPL: 0CVE-2019-9514 – Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
https://notcve.org/view.php?id=CVE-2019-9514
13 Aug 2019 — Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. Algunas implementaciones de HTTP / 2 son vulnerables a una inundación de reinicio, lo que puede conducir a una denegación de servicio. El atacante abre una... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2018-11783
https://notcve.org/view.php?id=CVE-2018-11783
07 Mar 2019 — sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1. El plugin sslheaders extrae información del certificado del cliente y establece cabeceras en la petición en base a la configuración de dicho plugin. El plugin no elimina las cabeceras de la petición en algu... • http://www.securityfocus.com/bid/107032 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 5%CPEs: 3EXPL: 1CVE-2018-8004 – Debian Security Advisory 4282-1
https://notcve.org/view.php?id=CVE-2018-8004
29 Aug 2018 — There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Hay múltiples problemas de "HTTP smuggling" y envenenamiento de caché cuando los clientes que realizan peticiones maliciosas interactúan con Apache Traffic Server (ATS). Est... • https://github.com/mosesrenegade/CVE-2018-8004 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 5.3EPSS: 10%CPEs: 3EXPL: 0CVE-2018-8005 – Debian Security Advisory 4282-1
https://notcve.org/view.php?id=CVE-2018-8005
29 Aug 2018 — When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Cuando hay múltiples rangos en una petición de rango, Apache Traffic Server (ATS) leerá el objeto completo desde la caché. • http://www.securityfocus.com/bid/105187 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 22%CPEs: 3EXPL: 0CVE-2018-1318 – Debian Security Advisory 4282-1
https://notcve.org/view.php?id=CVE-2018-1318
29 Aug 2018 — Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. La adición de métodos de listas de control de acceso en remap.config puede provocar un segfault cuando el usuario realiza una petición cuidadosamente manipulada. Esto afecta a Apache ... • http://www.securityfocus.com/bid/105176 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 18%CPEs: 3EXPL: 0CVE-2018-8040 – Debian Security Advisory 4282-1
https://notcve.org/view.php?id=CVE-2018-8040
29 Aug 2018 — Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Las páginas que se renderizan mediante el plugin ESI pueden tener acceso a la cabecera de la cookie cuando el plugin está configurado para no permitir el a... • http://www.securityfocus.com/bid/105181 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.6EPSS: 2%CPEs: 10EXPL: 0CVE-2017-5660 – Debian Security Advisory 4128-1
https://notcve.org/view.php?id=CVE-2017-5660
27 Feb 2018 — There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used. Hay una vulnerabilidad en Apache Traffic Server (ATS) en versiones 6.2.0 y anteriores y versiones 7.0.0 y anteriores con la cabecera Host y el plegado de líneas. Esto puede provocar problemas al interactuar con proxies ascendentes empleando el host erróneo. Several vulnerabilities were dis... • https://lists.apache.org/thread.html/22d84783d94c53a5132ec89f002fe5165c87561a9428bcb6713b3c98%40%3Cdev.trafficserver.apache.org%3E • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 4%CPEs: 4EXPL: 0CVE-2017-7671 – Debian Security Advisory 4128-1
https://notcve.org/view.php?id=CVE-2017-7671
27 Feb 2018 — There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump. Hay una vulnerabilidad de ataque de denegación de servicio en Apache Traffic Server (ATS) de las versión 5.2.0 a la 5.3.2; versión 6.0.0 a 6.2.0 y la versión 7.0.0 con la negociación TLS. Este problema puede provocar que el sistema vuelque la memoria. Several vulnerabilities were discovered in Apache Traffic Server, a reverse and fo... • https://lists.apache.org/thread.html/203bdcf9bbb718f3dc6f7aaf3e2af632474d51fa9e7bfb7832729905%40%3Cdev.trafficserver.apache.org%3E • CWE-20: Improper Input Validation •