The researcher discovered a vulnerable WordPress plugin. The plugin suffers from a server-side request forgery vulnerability that can be exploited in several ways.

The researcher was successful in doing the following:

Accessing a private server-status URL exposing a monitoring tool.
Running a Flash app in pornhub.com’s context to perform an XSS-like attack.

seebug 1

httpd 4

prion 2

f5 4

veracode 5

cve 2

ubuntucve 3

debiancve 2

zdi 1

ibm 5

packetstorm 1

checkpoint_advisories 1

zdt 1

nessus 61

openvas 50

freebsd 3

securityvulns 4

slackware 2

amazon 6

fedora 3

oraclelinux 3

debian 5

osv 3

centos 3

redhat 8

mageia 2

gentoo 2

ubuntu 2

altlinux 3

suse 5

hackerone 2

seebug

Apache HTTP Server多个模块主机名和URI跨站脚本漏洞

2013-02-28 00:00:00

httpd

Apache Httpd < 2.4.4 : XSS due to unescaped hostnames

2012-07-11 00:00:00

Apache Httpd < 2.2.24 : XSS due to unescaped hostnames

2012-07-11 00:00:00

Apache Httpd < 2.2.29 : mod_status buffer overflow

2014-05-30 00:00:00

prion

Cross site scripting

2013-02-26 16:55:00

Race condition

2014-07-20 11:12:00

SOL15900 - Apache HTTP server vulnerability CVE-2012-3499

2014-12-10 00:00:00

K15900 : Apache HTTP server vulnerability CVE-2012-3499

2014-12-11 00:00:00

SOL15865 - Apache HTTP server vulnerability CVE-2012-4558

2014-11-25 00:00:00

veracode

Cross-site Scripting (XSS)

2019-01-15 08:52:43

Arbitrary Code Injection

2019-05-02 04:44:51

Denial Of Service (DoS)

2019-05-02 05:03:41

cve

CVE-2012-3499

2013-02-26 16:55:00

CVE-2014-0226

2014-07-20 11:12:00

ubuntucve

CVE-2012-3499

2013-02-26 00:00:00

CVE-2014-0226

2014-07-20 00:00:00

CVE-2012-4558

2013-02-26 00:00:00

debiancve

CVE-2012-3499

2013-02-26 16:55:00

CVE-2014-0226

2014-07-20 11:12:00

zdi

Apache httpd mod_status Heap Buffer Overflow Remote Code Execution Vulnerability

2014-07-16 00:00:00

ibm

Security Bulletin: IBM Tealeaf Customer Experience may be affected by a vulnerability in the Apache HTTP server (CVE-2014-0226).

2018-06-16 19:43:49

Security Bulletin: IBM API Connect is affected by an Apache HTTP Server vulnerability (CVE-2014-0226)

2018-06-15 07:09:10

Security Bulletin: Vulnerabilities in httpd affect IBM SmartCloud Provisioning 2.1 for Software Virtual Appliance

2018-06-17 22:30:11

packetstorm

Apache Scoreboard / Status Race Condition

2014-07-21 00:00:00

checkpoint_advisories

Apache HTTP Server mod_status Heap Buffer Overflow (CVE-2014-0226)

2014-08-06 00:00:00

zdt

Apache 2.4.7 httpd mod_status Heap Buffer Overflow Vulnerability

2014-07-20 00:00:00

nessus

SuSE 11.2 Security Update : Apache (SAT Patch Number 7570)

2013-04-10 00:00:00

Fedora 18 : httpd-2.4.4-2.fc18 (2013-4541)

2013-04-01 00:00:00

Apache 2.4.x < 2.4.4 Multiple XSS Vulnerabilities

2019-01-09 00:00:00

openvas

Fedora Update for httpd FEDORA-2013-4541

2013-04-02 00:00:00

Fedora Update for httpd FEDORA-2013-4541

2013-04-02 00:00:00

Slackware: Security Advisory (SSA:2013-062-01)

2022-04-21 00:00:00

freebsd

apache22 -- several vulnerabilities

2012-10-07 00:00:00

apache22 -- several vulnerabilities

2014-07-19 00:00:00

apache24 -- several vulnerabilities

2014-07-15 00:00:00

securityvulns

[ MDVSA-2013:015 ] apache

2013-03-02 00:00:00

Apache security vulnerabilities

2013-03-02 00:00:00

Apache multiple security vulnerabilities

2014-07-28 00:00:00

slackware

httpd

2013-03-03 15:02:33

[slackware-security] httpd

2014-07-24 01:35:41

amazon

Medium: httpd

2013-03-26 21:25:00

Medium: httpd24

2013-03-26 21:29:00

Medium: httpd

2013-05-24 13:56:00

fedora

[SECURITY] Fedora 18 Update: httpd-2.4.4-2.fc18

2013-04-01 03:30:25

[SECURITY] Fedora 19 Update: httpd-2.4.10-1.fc19

2014-08-15 02:47:11

[SECURITY] Fedora 20 Update: httpd-2.4.10-1.fc20

2014-07-25 10:03:52

oraclelinux

httpd security update

2013-05-13 00:00:00

httpd security update

2014-07-23 00:00:00

httpd security update

2014-07-23 00:00:00

debian

[SECURITY] [DSA 2637-1] apache2 security update

2013-03-04 21:34:32

[SECURITY] [DSA 2637-1] apache2 security update

2013-03-04 21:34:32

[SECURITY] [DSA 2989-1] apache2 security update

2014-07-24 22:19:45

osv

apache2 - several

2013-03-04 00:00:00

apache2 - security update

2014-07-24 00:00:00

apache2 - security update

2014-09-29 00:00:00

centos

httpd, mod_ssl security update

2013-05-13 22:32:03

httpd, mod_ssl security update

2014-07-23 15:12:33

httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

2014-07-23 15:36:55

redhat

(RHSA-2013:0815) Moderate: httpd security update

2013-05-13 00:00:00

(RHSA-2014:0920) Important: httpd security update

2014-07-23 00:00:00

(RHSA-2013:1012) Moderate: Red Hat JBoss Web Server 2.0.1 update

2013-07-03 15:40:17

mageia

Updated apache package fixes security vulnerabilities

2014-07-30 01:30:55

Updated apache package fixes security vulnerabilities

2014-07-30 01:30:55

gentoo

Apache HTTP Server: Multiple vulnerabilities

2014-08-29 00:00:00

Apache: Multiple vulnerabilities

2015-04-11 00:00:00

ubuntu

Apache HTTP Server vulnerabilities

2013-03-18 00:00:00

Apache HTTP Server vulnerabilities

2014-07-23 00:00:00

altlinux

Security fix for the ALT Linux 9 package apache2 version 2.2.24-alt1

2013-04-14 00:00:00

Security fix for the ALT Linux 8 package apache2 version 2.2.24-alt1

2013-04-14 00:00:00

Security fix for the ALT Linux 10 package apache2 version 2.2.24-alt1

2013-04-14 00:00:00

suse

Security update for apache2 (important)

2014-09-02 19:04:20

Security update for the Apache Web Server (important)

2014-08-07 01:04:17

Security update for apache2 (important)

2014-09-02 20:04:23

hackerone

Boozt Fashion AB: Instance of Apache Vulnerable to Several Issues

2016-09-08 15:44:15

Marktplaats: Multiple Apache 2.2.22 Vulnerabilities (XSS/ Code Exec/ DoS)

2015-06-09 17:47:58

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

JSON

Related for H1:138721