CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-38161 – Not validating origin TLS certificate
https://notcve.org/view.php?id=CVE-2021-38161
Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8. Una vulnerabilidad de Autenticación inapropiada en la verificación de origen TLS de Apache Traffic Server permite realizar ataques de tipo man in the middle. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 8.0.8 • https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164 https://www.debian.org/security/2022/dsa-5153 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-37149 – Request Smuggling - multiple attacks
https://notcve.org/view.php?id=CVE-2021-37149
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0. Una vulnerabilidad de Comprobación de entrada inapropiada en el análisis de encabezados de Apache Traffic Server permite a un atacante colar peticiones. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 8.1.2 y 9.0.0 a 9.1.0 • https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164 https://www.debian.org/security/2022/dsa-5153 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-37148 – Request Smuggling - transfer encoding validation
https://notcve.org/view.php?id=CVE-2021-37148
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1. Una vulnerabilidad de comprobación de entrada inapropiada en el análisis de encabezados de Apache Traffic Server permite a un atacante contrabandear peticiones. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 8.1.2 y 9.0.0 a 9.0.1 • https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164 https://www.debian.org/security/2022/dsa-5153 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-37147 – Request Smuggling - LF line ending
https://notcve.org/view.php?id=CVE-2021-37147
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0. Una vulnerabilidad de comprobación de entrada inapropiada en el análisis de encabezados de Apache Traffic Server permite a un atacante contrabandear peticiones. Este problema afecta a Apache Traffic Server versiones 8.0.0 a 8.1.2 y 9.0.0 a 9.1.0 • https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164 https://www.debian.org/security/2022/dsa-5153 • CWE-20: Improper Input Validation CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-35474 – Dynamic stack buffer overflow in cachekey plugin
https://notcve.org/view.php?id=CVE-2021-35474
Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1. Una vulnerabilidad de desbordamiento del búfer en la región stack de la memoria en el plugin cachekey de Apache Traffic Server. Este problema afecta a Apache Traffic Server 7.0.0 a 7.1.12, 8.0.0 a 8.1.1, 9.0.0 a 9.0.1 • https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E https://www.debian.org/security/2021/dsa-4957 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •