CVSS: 5.5EPSS: 0%CPEs: 17EXPL: 0CVE-2020-13938 – Improper Handling of Insufficient Privileges
https://notcve.org/view.php?id=CVE-2020-13938
10 Jun 2021 — Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows Apache HTTP Server versiones 2.4.0 a 2.4.46 Los usuarios locales sin privilegios pueden detener httpd en Windows • http://httpd.apache.org/security/vulnerabilities_24.html • CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 15%CPEs: 24EXPL: 0CVE-2020-1927 – httpd: mod_rewrite configurations vulnerable to open redirect
https://notcve.org/view.php?id=CVE-2020-1927
01 Apr 2020 — In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. En Apache HTTP Server versiones 2.4.0 hasta 2.4.41, los redireccionamientos configurados con mod_rewrite que pretendían ser autorreferenciales podrían ser engañados por nuevas líneas codificadas y redireccionadas en lugar de una URL inesperada dentro de la URL de petición. A flaw was fou... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 38%CPEs: 21EXPL: 0CVE-2020-1934 – httpd: mod_proxy_ftp use of uninitialized value
https://notcve.org/view.php?id=CVE-2020-1934
01 Apr 2020 — In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. En Apache HTTP Server versiones 2.4.0 hasta 2.4.41, mod_proxy_ftp puede usar memoria no inicializada cuando al enviar un proxy hacia un servidor FTP malicioso. A flaw was found in Apache's HTTP server (httpd) .The mod_proxy_ftp module may use uninitialized memory with proxying to a malicious FTP server. The highest threat from this vulnerability is to data confidentiality. Red Hat JBoss... • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html • CWE-456: Missing Initialization of a Variable CWE-908: Use of Uninitialized Resource •
CVSS: 6.1EPSS: 84%CPEs: 26EXPL: 4CVE-2019-10092 – Apache Httpd mod_proxy - Error Page Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-10092
27 Aug 2019 — In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed. En Apache HTTP Server versiones 2.4.0 hasta 2.4.39, se reportó un problema de cross-site scripting limitado que afecta la ... • https://www.exploit-db.com/exploits/47688 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 79%CPEs: 1EXPL: 1CVE-2019-10098 – Apache Httpd mod_rewrite - Open Redirects
https://notcve.org/view.php?id=CVE-2019-10098
27 Aug 2019 — In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. En el servidor HTTP Apache versiones 2.4.0 hasta 2.4.39, los Redireccionamientos configurados con mod_rewrite que fueron previstos a estar auto referenciados podrían ser engañados por nuevas líneas codificadas y redireccionadas a una URL inesperada dentro de la URL de la petición. A vulnera... • https://www.exploit-db.com/exploits/47689 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 42%CPEs: 24EXPL: 1CVE-2019-0217 – httpd: mod_auth_digest: access control bypass due to race condition
https://notcve.org/view.php?id=CVE-2019-0217
03 Apr 2019 — In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. En Apache HTTP Server 2.4 versión 2.4.38 y anteriores, una condición de carrera en mod_auth_digest cuando se ejecuta en un servidor multihilo podría permitir a un usuario con credenciales válidas autenticarse usando otro nombre de usuario, evitando las restr... • https://github.com/savsch/PoC_CVE-2019-0217 • CWE-284: Improper Access Control CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.3EPSS: 18%CPEs: 12EXPL: 0CVE-2019-0220 – httpd: URL normalization inconsistency
https://notcve.org/view.php?id=CVE-2019-0220
03 Apr 2019 — A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them. Se descubrió una vulnerabilidad en Apache HTTP Server 2.4.0 hasta 2.4.38. Cuando el componente del recorrido de la solicitud de la URL contiene múltiples barras diagonales consecutivas... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html • CWE-41: Improper Resolution of Path Equivalence CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 7.5EPSS: 5%CPEs: 10EXPL: 0CVE-2018-17199 – httpd: mod_session_cookie does not respect expiry time
https://notcve.org/view.php?id=CVE-2018-17199
23 Jan 2019 — In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded. En Apache HTTP Server 2.4, en sus distribuciones 2.4.37 y anteriores, mod_session comprueba el tiempo de caducidad de la sesión antes de descodificarla. Esto provoca que se ignore el tiempo de caducidad de la sesión para sesiones mod_session_cookie,... • http://www.securityfocus.com/bid/106742 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: 6.1EPSS: 78%CPEs: 41EXPL: 0CVE-2016-4975 – mod_userdir CRLF injection
https://notcve.org/view.php?id=CVE-2016-4975
14 Aug 2018 — Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31). Posible inyección CRLF que permite ataques de separación de respuesta HTTP para los sitios que emplean mod_userdir. • http://www.securityfocus.com/bid/105093 • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •
CVSS: 8.1EPSS: 94%CPEs: 16EXPL: 1CVE-2017-15715 – httpd: <FilesMatch> bypass with a trailing newline in the file name
https://notcve.org/view.php?id=CVE-2017-15715
26 Mar 2018 — In Apache httpd 2.4.0 to 2.4.29, the expression specified in