Sec Feed Reader

Navigation

Schnelluebersicht mit Zeitraum und Severity: Startseite
Erweiterte Filter und Listen: diese Seite (entries), inkl. Volltext/Titel-Suche wie unter Suche.

Erweiterte Filter

Quelle

Severity Kategorie CVE-ID

Suchbegriff

Suchbereich Suchmodus Von (Datum)

Bis (Datum)

Sortierung Reihenfolge

13292 Eintraege gefunden · 50 pro Seite · Seite 266 von 266.

Veroeffentlicht	Quelle	Titel	Severity	CVEs	Kategorie
2004-03-20 00:00	apache_httpd_sec	CVE-2004-1834: The experimental mod_disk_cache module stored client authentication credentials for cached objects such as proxy authentication credentials and Basic Authentication passwords on disk.	-	CVE-2004-1834	vendor_advisory
2004-03-18 00:00	apache_httpd_sec	CVE-2004-0174: A starvation issue on listening sockets occurs when a short-lived connection on a rarely-accessed listening socket will cause a child to hold the accept mutex and block out new connections until another connection arrives on that rarely-accessed listening socket. This issue is known to affect some versions of AIX, Solaris, and Tru64; it is known to not affect FreeBSD or Linux.	-	CVE-2004-0174	vendor_advisory
2004-02-20 00:00	apache_httpd_sec	CVE-2004-0113: A memory leak in mod_ssl allows a remote denial of service attack against an SSL-enabled server by sending plain HTTP requests to the SSL port.	-	CVE-2004-0113	vendor_advisory
2003-12-18 00:00	apache_httpd_sec	CVE-2003-0987: mod_digest does not properly verify the nonce of a client response by using a AuthNonce secret. This could allow a malicious user who is able to sniff network traffic to conduct a replay attack against a website using Digest protection. Note that mod_digest implements an older version of the MD5 Digest Authentication specification which is known not to work with modern browsers. This issue does not affect mod_auth_digest.	-	CVE-2003-0987	vendor_advisory
2003-10-27 00:00	apache_httpd_sec	CVE-2003-0789: A bug in mod_cgid mishandling of CGI redirect paths can result in CGI output going to the wrong client when a threaded MPM is used.	-	CVE-2003-0789	vendor_advisory
2003-10-27 00:00	apache_httpd_sec	CVE-2003-0542: By using a regular expression with more than 9 captures a buffer overflow can occur in mod_alias or mod_rewrite. To exploit this an attacker would need to be able to create a carefully crafted configuration file (.htaccess or httpd.conf)	-	CVE-2003-0542	vendor_advisory
2003-10-15 00:00	apache_httpd_sec	CVE-2003-0993: A bug in the parsing of Allow/Deny rules using IP addresses without a netmask on big-endian 64-bit platforms causes the rules to fail to match.	-	CVE-2003-0993	vendor_advisory
2003-07-18 00:00	apache_httpd_sec	CVE-2003-0460: The rotatelogs support program on Win32 and OS/2 would quit logging and exit if it received special control characters such as 0x1A.	-	CVE-2003-0460	vendor_advisory
2003-07-09 00:00	apache_httpd_sec	CVE-2003-0253: In a server with multiple listening sockets a certain error returned by accept() on a rarely access port can cause a temporary denial of service, due to a bug in the prefork MPM.	-	CVE-2003-0253	vendor_advisory
2003-07-09 00:00	apache_httpd_sec	CVE-2003-0254: When a client requests that proxy ftp connect to a ftp server with IPv6 address, and the proxy is unable to create an IPv6 socket, an infinite loop occurs causing a remote Denial of Service.	-	CVE-2003-0254	vendor_advisory
2003-07-09 00:00	apache_httpd_sec	CVE-2003-0192: A bug in the optional renegotiation code in mod_ssl included with Apache httpd can cause cipher suite restrictions to be ignored. This is triggered if optional renegotiation is used (SSLOptions +OptRenegotiate) along with verification of client certificates and a change to the cipher suite over the renegotiation.	-	CVE-2003-0192	vendor_advisory
2003-06-10 00:00	apache_httpd_sec	CVE-2004-0492: A buffer overflow was found in the Apache proxy module, mod_proxy, which can be triggered by receiving an invalid Content-Length header. In order to exploit this issue an attacker would need to get an Apache installation that was configured as a proxy to connect to a malicious site. This would cause the Apache child processing the request to crash, although this does not represent a significant Denial of Service attack as requests will continue to be handled by other Apache child processes. This issue may lead to remote arbitrary code execution on some BSD platforms.	-	CVE-2004-0492	vendor_advisory
2003-05-28 00:00	apache_httpd_sec	CVE-2003-0189: A build system problem in Apache 2.0.40 through 2.0.45 allows remote attackers to cause a denial of access to authenticated content when a threaded server is used.	-	CVE-2003-0189	vendor_advisory
2003-05-28 00:00	apache_httpd_sec	CVE-2003-0245: A vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.	-	CVE-2003-0245	vendor_advisory
2003-03-31 00:00	apache_httpd_sec	CVE-2003-0134: Apache on OS2 up to and including Apache 2.0.45 have a Denial of Service vulnerability caused by device names.	-	CVE-2003-0134	vendor_advisory
2003-02-24 00:00	apache_httpd_sec	CVE-2003-0083: Apache did not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.	-	CVE-2003-0083	vendor_advisory
2003-02-24 00:00	apache_httpd_sec	CVE-2003-0020: Apache does not filter terminal escape sequences from error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.	-	CVE-2003-0020	vendor_advisory
2003-01-20 00:00	apache_httpd_sec	CVE-2003-0017: On Windows platforms Apache could be forced to serve unexpected files by appending illegal characters such as '<' to the request URL	-	CVE-2003-0017	vendor_advisory
2003-01-20 00:00	apache_httpd_sec	CVE-2003-0016: On Windows platforms Apache did not correctly filter MS-DOS device names which could lead to denial of service attacks or remote code execution.	-	CVE-2003-0016	vendor_advisory
2002-10-03 00:00	apache_httpd_sec	CVE-2002-0839: The permissions of the shared memory used for the scoreboard allows an attacker who can execute under the Apache UID to send a signal to any process as root or cause a local denial of service attack.	-	CVE-2002-0839	vendor_advisory
2002-10-03 00:00	apache_httpd_sec	CVE-2002-0843: Buffer overflows in the benchmarking utility ab could be exploited if ab is run against a malicious server	-	CVE-2002-0843	vendor_advisory
2002-10-02 00:00	apache_httpd_sec	CVE-2002-0840: Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header.	-	CVE-2002-0840	vendor_advisory
2002-09-19 00:00	apache_httpd_sec	CVE-2002-1593: A flaw was found in handling of versioning hooks in mod_dav. An attacker could send a carefully crafted request in such a way to cause the child process handling the connection to crash. This issue will only result in a denial of service where a threaded process model is in use.	-	CVE-2002-1593	vendor_advisory
2002-08-09 00:00	apache_httpd_sec	CVE-2002-0661: Certain URIs would bypass security and allow users to invoke or access any file depending on the system configuration. Affects Windows, OS2, Netware and Cygwin platforms only.	-	CVE-2002-0661	vendor_advisory
2002-08-09 00:00	apache_httpd_sec	CVE-2002-0654: A path-revealing exposure was present in multiview type map negotiation (such as the default error documents) where a module would report the full path of the typemapped .var file when multiple documents or no documents could be served. Additionally a path-revealing exposure in cgi/cgid when Apache fails to invoke a script. The modules would report "couldn't create child process /path-to-script/script.pl" revealing the full path of the script.	-	CVE-2002-0654	vendor_advisory
2002-06-17 00:00	apache_httpd_sec	CVE-2002-0392: Malicious requests can cause various effects ranging from a relatively harmless increase in system resources through to denial of service attacks and in some cases the ability to execute arbitrary remote code.	-	CVE-2002-0392	vendor_advisory
2002-04-22 00:00	apache_httpd_sec	CVE-2002-1592: In some cases warning messages could get returned to end users in addition to being recorded in the error log. This could reveal the path to a CGI script for example, a minor security exposure.	-	CVE-2002-1592	vendor_advisory
2001-09-28 00:00	apache_httpd_sec	CVE-2001-0729: A vulnerability was found in the Win32 port of Apache 1.3.20. A client submitting a very long URI could cause a directory listing to be returned rather than the default index page.	-	CVE-2001-0729	vendor_advisory
2001-09-28 00:00	apache_httpd_sec	CVE-2001-0730: A vulnerability was found in the split-logfile support program. A request with a specially crafted Host: header could allow any file with a .log extension on the system to be written to.	-	CVE-2001-0730	vendor_advisory
2001-07-09 00:00	apache_httpd_sec	CVE-2001-0731: A vulnerability was found when Multiviews are used to negotiate the directory index. In some configurations, requesting a URI with a QUERY_STRING of M=D could return a directory listing rather than the expected index page.	-	CVE-2001-0731	vendor_advisory
2000-09-29 00:00	apache_httpd_sec	CVE-2000-0913: The Rewrite module, mod_rewrite, can allow access to any file on the web server. The vulnerability occurs only with certain specific cases of using regular expression references in RewriteRule directives: If the destination of a RewriteRule contains regular expression references then an attacker will be able to access any file on the server.	-	CVE-2000-0913	vendor_advisory
	apache_httpd_sec	CVE-2005-2970: A memory leak in the worker MPM would allow remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections. This issue was downgraded in severity to low (from moderate) as sucessful exploitation of the race condition would be difficult.	-	CVE-2005-2970	vendor_advisory
	apache_httpd_sec	CVE-2000-1204: A security problem for users of the mass virtual hosting module, mod_vhost_alias, causes the source to a CGI to be sent if the cgi-bin directory is under the document root. However, it is not normal to have your cgi-bin directory under a document root.	-	CVE-2000-1204	vendor_advisory
	apache_httpd_sec	CVE-1999-1199: A serious problem exists when a client sends a large number of headers with the same header name. Apache uses up memory faster than the amount of memory required to simply store the received data itself. That is, memory use increases faster and faster as more headers are received, rather than increasing at a constant rate. This makes a denial of service attack based on this method more effective than methods which cause Apache to use memory at a constant rate, since the attacker has to send less data.	-	CVE-1999-1199	vendor_advisory
	apache_httpd_sec	CVE-2001-0925: The default installation can lead mod_negotiation and mod_dir or mod_autoindex to display a directory listing instead of the multiview index.html file if a very long path was created artificially by using many slashes.	-	CVE-2001-0925	vendor_advisory
	apache_httpd_sec	CVE-2000-1206: A security problem can occur for sites using mass name-based virtual hosting (using the new mod_vhost_alias module) or with special mod_rewrite rules.	-	CVE-2000-1206	vendor_advisory
	apache_httpd_sec	CVE-2000-1205: Apache was vulnerable to cross site scripting issues. It was shown that malicious HTML tags can be embedded in client web requests if the server or script handling the request does not carefully encode all information displayed to the user. Using these vulnerabilities attackers could, for example, obtain copies of your private cookies used to authenticate you to other sites.	-	CVE-2000-1205	vendor_advisory
	apache_httpd_sec	CVE-2000-0505: A security hole on Apache for Windows allows a user to view the listing of a directory instead of the default HTML page by sending a carefully constructed request.	-	CVE-2000-0505	vendor_advisory
	apache_httpd_sec	CVE-2002-0061: Apache for Win32 before 1.3.24 and 2.0.34-beta allows remote attackers to execute arbitrary commands via parameters passed to batch file CGI scripts.	-	CVE-2002-0061	vendor_advisory
	apache_httpd_sec	CVE-2022-28614: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the "ap_rputs" function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.	-	CVE-2022-28614	vendor_advisory
	apache_httpd_sec	CVE-2002-1156: In Apache 2.0.42 only, for a location where both WebDAV and CGI were enabled, a POST request to a CGI script would reveal the CGI source to a remote user.	-	CVE-2002-1156	vendor_advisory
	apache_httpd_sec	CVE-2001-1342: A vulnerability was found in the Win32 and OS2 ports of Apache 1.3. A client submitting a carefully constructed URI could cause a General Protection Fault in a child process, bringing up a message box which would have to be cleared by the operator to resume operation. This vulnerability introduced no identified means to compromise the server other than introducing a possible denial of service.	-	CVE-2001-1342	vendor_advisory