CVSS: 7.5EPSS: 97%CPEs: 100EXPL: 7CVE-2011-3368 – Apache mod_proxy - Reverse Proxy Exposure
https://notcve.org/view.php?id=CVE-2011-3368
05 Oct 2011 — The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character. El módulo mod_proxy del servidor HTTP Apache 1.3.x hasta la versión 1.3.42, 2.0.x hasta la 2.0.64 y 2.2.x hasta la 2.2.21 no interac... • https://packetstorm.news/files/id/181059 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 49%CPEs: 4EXPL: 1CVE-2011-3348 – httpd: mod_proxy_ajp remote temporary DoS
https://notcve.org/view.php?id=CVE-2011-3348
19 Sep 2011 — The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request. El módulo mod_proxy_ajp en el Apache HTTP Server antes de v2.2.21, cuando se usa con mod_proxy_balancer en algunas configuraciones, permite a atacantes remotos provocar una denegación de servicio ("error state" temporal en el "back-end" del servidor) a t... • http://community.jboss.org/message/625307 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 97%CPEs: 16EXPL: 11CVE-2011-3192 – Apache - Denial of Service
https://notcve.org/view.php?id=CVE-2011-3192
29 Aug 2011 — The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. El filtro byterange en el Servidor Apache HTTP v1.3.x, v2.0.x hasta v2.0.64, y v2.2.x hasta v2.2.19 permite a tacantes remotos provocar una denegación de servicio (consumo de memo... • https://packetstorm.news/files/id/180517 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 5%CPEs: 3EXPL: 0CVE-2011-1928 – apr: DoS flaw in apr_fnmatch() due to fix for CVE-2011-0419
https://notcve.org/view.php?id=CVE-2011-1928
24 May 2011 — The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419. La implementación de fnmatch de apr_fnmatch.c de la l... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627182 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 96%CPEs: 13EXPL: 3CVE-2011-0419 – Apache 1.4/2.2.x - APR 'apr_fnmatch()' Denial of Service
https://notcve.org/view.php?id=CVE-2011-0419
16 May 2011 — Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. Vulnerabilidad de agotamie... • https://www.exploit-db.com/exploits/35738 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 82%CPEs: 45EXPL: 0CVE-2010-1623 – apr-util: high memory consumption in apr_brigade_split_line()
https://notcve.org/view.php?id=CVE-2010-1623
04 Oct 2010 — Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket. Pérdida de memoria en la función apr_brigade_split_line en buckets/apr_brigade.c en la biblioteca Apache Portable Runtime Utility (ta... • http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2010-2791 – httpd: Reverse proxy sends wrong responses after time-outs
https://notcve.org/view.php?id=CVE-2010-2791
05 Aug 2010 — mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions. mod_proxy en httpd del servidor HTTP Apache v2.2.9, cuando se ejecu... • http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 28%CPEs: 2EXPL: 0CVE-2010-1452 – mod_dav: DoS (httpd child process crash) by parsing URI structure with missing path segments
https://notcve.org/view.php?id=CVE-2010-1452
28 Jul 2010 — The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path. Los módulos (1) mod_cache y (2) mod_dav en el servidor Apache HTTP Server v2.2.x anteriores a v2.2.16 permiten a atacantes remotos provocar una denegación de servicio (caída del proceso) a través de una petición que carece de una ruta. • http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav •
CVSS: 7.5EPSS: 1%CPEs: 12EXPL: 0CVE-2010-2068 – (mod_proxy): Sensitive response disclosure due improper handling of timeouts
https://notcve.org/view.php?id=CVE-2010-2068
18 Jun 2010 — mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. mod_proxy_http.c en mod_proxy_http en el servidor Apache HTTP v2.2.9 hasta v2.2.15, v2.3.4-alpha, y 2.3.5-alpha en ... • http://httpd.apache.org/security/vulnerabilities_22.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2010-0434 – httpd: request header information leak
https://notcve.org/view.php?id=CVE-2010-0434
05 Mar 2010 — The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request. La funcion ap_read_request en server/protocol.c en Apache HTTP Server v2.2.x en versiones anterior... • http://httpd.apache.org/security/vulnerabilities_22.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •