CVSS: 7.5EPSS: 1%CPEs: 20EXPL: 2CVE-2013-4484 – Varnish Cache Denial of Service
https://notcve.org/view.php?id=CVE-2013-4484
31 Oct 2013 — Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI. Vulnerablilidad en Varnish antes de 3.0.5 permite a atacantes remotos provocar una denegación de servicio (caída del proceso hijo y corte de caché temporal) a través de una solicitud GET con espacios en blanco finales y sin URI. If Varnish receives a certain illegal request, and the subroutine 'vcl_error{}' restarts the... • https://packetstorm.news/files/id/123867 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 68%CPEs: 20EXPL: 4CVE-2009-2936 – Varnish Cache CLI Interface - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2936
05 Apr 2010 — The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via... • https://packetstorm.news/files/id/180959 • CWE-287: Improper Authentication •