CVSS: 7.5EPSS: 24%CPEs: 45EXPL: 0CVE-2010-1623 – apr-util: high memory consumption in apr_brigade_split_line()
https://notcve.org/view.php?id=CVE-2010-1623
04 Oct 2010 — Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket. Pérdida de memoria en la función apr_brigade_split_line en buckets/apr_brigade.c en la biblioteca Apache Portable Runtime Utility (ta... • http://blogs.sun.com/security/entry/cve_2010_1623_memory_leak • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 6%CPEs: 2EXPL: 0CVE-2010-2791 – httpd: Reverse proxy sends wrong responses after time-outs
https://notcve.org/view.php?id=CVE-2010-2791
05 Aug 2010 — mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions. mod_proxy en httpd del servidor HTTP Apache v2.2.9, cuando se ejecu... • http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 23%CPEs: 2EXPL: 0CVE-2010-1452 – mod_dav: DoS (httpd child process crash) by parsing URI structure with missing path segments
https://notcve.org/view.php?id=CVE-2010-1452
28 Jul 2010 — The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path. Los módulos (1) mod_cache y (2) mod_dav en el servidor Apache HTTP Server v2.2.x anteriores a v2.2.16 permiten a atacantes remotos provocar una denegación de servicio (caída del proceso) a través de una petición que carece de una ruta. • http://blogs.sun.com/security/entry/cve_2010_1452_mod_dav •
CVSS: 7.5EPSS: 8%CPEs: 12EXPL: 0CVE-2010-2068 – (mod_proxy): Sensitive response disclosure due improper handling of timeouts
https://notcve.org/view.php?id=CVE-2010-2068
18 Jun 2010 — mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. mod_proxy_http.c en mod_proxy_http en el servidor Apache HTTP v2.2.9 hasta v2.2.15, v2.3.4-alpha, y 2.3.5-alpha en ... • http://httpd.apache.org/security/vulnerabilities_22.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 87%CPEs: 59EXPL: 3CVE-2010-0425 – Apache 2.2.14 mod_isapi - Dangling Pointer Remote SYSTEM
https://notcve.org/view.php?id=CVE-2010-0425
05 Mar 2010 — modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers." El archivo modules/arch/win32/mod_isapi.c en la función mod_isapi en el servidor H... • https://packetstorm.news/files/id/180533 •
CVSS: 7.5EPSS: 2%CPEs: 6EXPL: 0CVE-2010-0434 – httpd: request header information leak
https://notcve.org/view.php?id=CVE-2010-0434
05 Mar 2010 — The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request. La funcion ap_read_request en server/protocol.c en Apache HTTP Server v2.2.x en versiones anterior... • http://httpd.apache.org/security/vulnerabilities_22.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 25%CPEs: 12EXPL: 0CVE-2010-0408 – httpd: mod_proxy_ajp remote temporary DoS
https://notcve.org/view.php?id=CVE-2010-0408
05 Mar 2010 — The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code. La función ap_proxy_ajp_request en mod_proxy_ajp.c en mod_proxy_ajp en the Apache HTTP Server v2.2.x en versiones anteriores a ... • http://httpd.apache.org/security/vulnerabilities_22.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2003-1580
https://notcve.org/view.php?id=CVE-2003-1580
05 Feb 2010 — The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue. El servidor Apache HTTP v2.0.44, cuando la resolución DNS es activada para direcciones... • http://www.securityfocus.com/archive/1/313867 • CWE-189: Numeric Errors •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2003-1581
https://notcve.org/view.php?id=CVE-2003-1581
05 Feb 2010 — The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue. El servidor Apache HTTP v2.0.44, cuando la resolución DNS es activada para direcciónes IP de clientes, permite a atacantes remotos inyectar texto de su elección a través de peticiones HTTP en c... • http://www.securityfocus.com/archive/1/313867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 47%CPEs: 46EXPL: 3CVE-2010-0010
https://notcve.org/view.php?id=CVE-2010-0010
02 Feb 2010 — Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow. Desbordamiento de enteros en la función ap_proxy_send_fb en proxy/proxy_util.c en mod_proxy en el servidor HTTP Apache anterior a v1.3.42 en plataformas de 64 bits permite a los servidores de ... • http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0589.html • CWE-189: Numeric Errors •