CVSS: 9.8EPSS: 29%CPEs: 6EXPL: 2CVE-2009-1956 – apr-util single NULL byte buffer overflow
https://notcve.org/view.php?id=CVE-2009-1956
06 Jun 2009 — Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input. Error de superación de límite (off-by-one) en la función apr_brigade_vprintf de Apache APR-util anterior a v1.3.5 en plataformas big-endian, permite a atacantes remotos obtener información sensible o provocar una denegación de servicio (caída de la aplicación) a través de una en... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 33%CPEs: 13EXPL: 1CVE-2009-1955 – Apache mod_dav / svn - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2009-1955
06 Jun 2009 — The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564. El parseador XML en el interfaz apr_xml_* en xml/apr_xml.c en Apache APR-util anteriores a v1.3.7 tal y como es... • https://www.exploit-db.com/exploits/8842 • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 7.5EPSS: 7%CPEs: 22EXPL: 0CVE-2009-0023 – apr-util heap buffer underwrite
https://notcve.org/view.php?id=CVE-2009-0023
06 Jun 2009 — The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow. La función apr_strmatch_pr... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 9EXPL: 2CVE-2009-1195 – httpd: AllowOverride Options=IncludesNoExec allows Options Includes
https://notcve.org/view.php?id=CVE-2009-1195
28 May 2009 — The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file. El Servidor HTTP de Apache v2.2.11 y anteriores a versiones 2.2 no maneja adecuadamente Options=IncludesNOEXEC en la directiva AllowOverride, lo que permite a usuarios ... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-16: Configuration •
CVSS: 7.5EPSS: 4%CPEs: 5EXPL: 0CVE-2009-1191 – httpd mod_proxy_ajp information disclosure
https://notcve.org/view.php?id=CVE-2009-1191
23 Apr 2009 — mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request. mod_proxy_ajp.c en el módulo mod_proxy_ajp en el servidor HTTP Apache v2.2.11 permite a atacantes remotos obtener datos de respuesta sensibles, lo que esta previsto para un cliente que envío una petición POST temprana sin cuerpo de petición, a través de una petición HTTP. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html •
CVSS: 9.8EPSS: 0%CPEs: 60EXPL: 0CVE-2008-2384 – mod_auth_mysql: character encoding SQL injection flaw
https://notcve.org/view.php?id=CVE-2008-2384
22 Jan 2009 — SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request. Vulnerabilidad de inyección SQL en mod_auth_mysql.c en el módulo mod-auth-mysql (alias libapache2-mod-auth-mysql) para Apache HTTP Server 2.x, permite a ataca... • http://klecker.debian.org/~white/mod-auth-mysql/CVE-2008-2384_mod-auth-mysql.patch • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 10%CPEs: 9EXPL: 0CVE-2008-2939 – httpd: mod_proxy_ftp globbing XSS
https://notcve.org/view.php?id=CVE-2008-2939
06 Aug 2008 — Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI. Vulnerabilidad de XSS en proxy_ftp.c en el módulo mod_proxy_ftp en Apache 2.0.63 y en versiones anteriores y mod_proxy_ftp.c en el módulo mod_proxy_ftp en Apache 2.2.9... • http://lists.apple.com/archives/security-announce/2009/May/msg00002.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 22%CPEs: 18EXPL: 0CVE-2008-2364 – httpd: mod_proxy_http DoS via excessive interim responses from the origin server
https://notcve.org/view.php?id=CVE-2008-2364
13 Jun 2008 — The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses. La función ap_proxy_http_process_response en mod_proxy_http.c en el modulo mod_proxy en el Servidor HTTP Apache 2.0.63 y 2.2.8 no limita el número de respuestas de desvío provisionales, lo que permit... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.1EPSS: 11%CPEs: 49EXPL: 2CVE-2008-2168 – Microsoft Internet Explorer 2 - UTF-7 HTTP Response Handling
https://notcve.org/view.php?id=CVE-2008-2168
13 May 2008 — Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page. La vulnerabilidad de tipo cross-site-scripting (XSS) en Apache versión 2.2.6 y anteriores, permite a los atacantes remotos inyectar scripts web o HTML arbitrarios por medio de direcciones URL codificadas UTF-7 que no se manejan apropiadamente cuando se muestra la página de error 4... • https://www.exploit-db.com/exploits/31759 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 67%CPEs: 9EXPL: 5CVE-2008-0455 – Apache 2.2.6 mod_negotiation - HTML Injection / HTTP Response Splitting
https://notcve.org/view.php?id=CVE-2008-0455
25 Jan 2008 — Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a req... • https://www.exploit-db.com/exploits/31052 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •