CVSS: 5.3EPSS: 57%CPEs: 16EXPL: 1CVE-2012-0053 – Apache - httpOnly Cookie Disclosure
https://notcve.org/view.php?id=CVE-2012-0053
28 Jan 2012 — protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script. protocol.c en Apache HTTP Server v2.2.x hasta la v2.2.21 no limita adecuadamente la información de cabecera durante la construcción de mensajes de error Bad Request (errores 400)... • https://www.exploit-db.com/exploits/18442 •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 2CVE-2012-0031 – Apache 2.2 - Scoreboard Invalid Free On Shutdown
https://notcve.org/view.php?id=CVE-2012-0031
18 Jan 2012 — scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function. scoreboard.c en Apache HTTP Server v2.2.21 y anteriores puede permitir a usuarios locales provocar una denegación de servicio (caída del demonio durante el apagado) o posiblemente, tener un impacto no e... • https://www.exploit-db.com/exploits/41768 •
CVSS: 9.8EPSS: 1%CPEs: 117EXPL: 1CVE-2007-6750 – Gentoo Linux Security Advisory 201309-12
https://notcve.org/view.php?id=CVE-2007-6750
27 Dec 2011 — The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15. El servidor HTTP Apache 1.x y 2.x permite a atacantes remotos provocar una denegación de servicio (caída del demonio) a través de una petición HTTP parcial, tal como se ha demostrado por Slowloris, relacionado con la falta del módulo mod_reqtimeout en versiones anteriores a ... • https://github.com/Jeanpseven/slowl0ris • CWE-399: Resource Management Errors •
CVSS: 5.9EPSS: 1%CPEs: 76EXPL: 1CVE-2011-3639 – Apache 2.2.15 mod_proxy - Reverse Proxy Security Bypass
https://notcve.org/view.php?id=CVE-2011-3639
30 Nov 2011 — The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368... • https://www.exploit-db.com/exploits/36663 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 90%CPEs: 100EXPL: 3CVE-2011-4317 – Apache 7.0.x mod_proxy - Reverse Proxy Security Bypass
https://notcve.org/view.php?id=CVE-2011-4317
30 Nov 2011 — The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an i... • https://www.exploit-db.com/exploits/36352 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 55EXPL: 4CVE-2011-3607 – Apache < 2.0.64 / < 2.2.21 mod_setenvif - Integer Overflow
https://notcve.org/view.php?id=CVE-2011-3607
08 Nov 2011 — Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow. Desbordamiento de entero en la función en ap_pregsub / util.c en el servidor HTTP Apache v2.0.x hasta la v2.0.64 y la v2.2.x hasta la v2.2.21, cuando e... • https://www.exploit-db.com/exploits/41769 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 55EXPL: 3CVE-2011-4415 – Apache < 2.0.64 / < 2.2.21 mod_setenvif - Integer Overflow
https://notcve.org/view.php?id=CVE-2011-4415
08 Nov 2011 — The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a diffe... • https://www.exploit-db.com/exploits/41769 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 97%CPEs: 100EXPL: 7CVE-2011-3368 – Apache mod_proxy - Reverse Proxy Exposure
https://notcve.org/view.php?id=CVE-2011-3368
05 Oct 2011 — The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character. El módulo mod_proxy del servidor HTTP Apache 1.3.x hasta la versión 1.3.42, 2.0.x hasta la 2.0.64 y 2.2.x hasta la 2.2.21 no interac... • https://packetstorm.news/files/id/181059 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 97%CPEs: 16EXPL: 11CVE-2011-3192 – Apache - Denial of Service
https://notcve.org/view.php?id=CVE-2011-3192
29 Aug 2011 — The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. El filtro byterange en el Servidor Apache HTTP v1.3.x, v2.0.x hasta v2.0.64, y v2.2.x hasta v2.2.19 permite a tacantes remotos provocar una denegación de servicio (consumo de memo... • https://packetstorm.news/files/id/180517 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 96%CPEs: 13EXPL: 3CVE-2011-0419 – Apache 1.4/2.2.x - APR 'apr_fnmatch()' Denial of Service
https://notcve.org/view.php?id=CVE-2011-0419
16 May 2011 — Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. Vulnerabilidad de agotamie... • https://www.exploit-db.com/exploits/35738 • CWE-770: Allocation of Resources Without Limits or Throttling •