Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
hackeroneBugs3raH1:66929
HistoryJun 09, 2015 - 5:47 p.m.

Marktplaats: Multiple Apache 2.2.22 Vulnerabilities (XSS/ Code Exec/ DoS)

2015-06-0917:47:58
bugs3ra
hackerone.com
4998

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.963 High

EPSS

Percentile

99.4%

JSON

Hello,

Your current version of apache 2.2.22 for http://aanbieding.marktplaats.com is vulnerable to many issues like DoS, XSS and Code Exec

  1. DoS
    Refer:
    http://www.cvedetails.com/cve/CVE-2014-0231/
    http://www.cvedetails.com/cve/CVE-2014-0098/
    http://www.cvedetails.com/cve/CVE-2013-6438/
    http://www.cvedetails.com/cve/CVE-2013-1896/

  2. XSS
    Refer:
    http://www.cvedetails.com/cve/CVE-2012-4558/
    http://www.cvedetails.com/cve/CVE-2012-3499/

  3. Code Exec
    Refer:
    http://www.cvedetails.com/cve/CVE-2013-1862/

POC: Not available as it is well Known and fixed in newer versions of apache.
Please update it as soon as possible

Related

suse 5
openvas 54
nessus 69
centos 3
amazon 5
oraclelinux 3
veracode 2
redhat 14
securityvulns 5
f5 3
freebsd 3
fedora 2
ubuntucve 2
slackware 2
ibm 3
kaspersky 2
ubuntu 3
mageia 1
threatpost 1
seebug 2
debian 3
osv 2
gentoo 2
altlinux 3
hackerone 1
httpd 1
prion 1
cve 1
debiancve 1
suse
suse
Security update for apache2 (important)
2014-09-02 21:04:17
Security update for apache2 (important)
2014-09-02 19:04:20
Security update for the Apache Web Server (important)
2014-08-07 01:04:17
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2014:1082-1)
2021-06-09 00:00:00
CentOS Update for httpd CESA-2013:0815 centos5
2013-05-17 00:00:00
Oracle: Security Advisory (ELSA-2013-0815)
2015-10-06 00:00:00
nessus
nessus
SUSE SLES10 Security Update : apache2 (SUSE-SU-2014:1082-1)
2015-05-20 00:00:00
RHEL 5 / 6 : httpd (RHSA-2013:0815)
2013-05-14 00:00:00
Oracle Linux 5 / 6 : httpd (ELSA-2013-0815)
2013-07-12 00:00:00
centos
centos
httpd, mod_ssl security update
2013-05-13 22:32:03
httpd, mod_ssl security update
2014-04-04 00:04:54
httpd, mod_ssl security update
2014-04-04 00:08:57
amazon
amazon
Medium: httpd
2013-05-24 13:56:00
Medium: httpd24
2013-05-24 13:57:00
Medium: httpd24
2013-03-26 21:29:00
oraclelinux
oraclelinux
httpd security update
2013-05-13 00:00:00
httpd security update
2014-04-03 00:00:00
httpd security update
2014-04-03 00:00:00
veracode
veracode
Arbitrary Code Injection
2019-05-02 04:44:51
Cross-site Scripting (XSS)
2019-01-15 08:52:43
redhat
redhat
(RHSA-2013:0815) Moderate: httpd security update
2013-05-13 00:00:00
(RHSA-2013:1134) Moderate: httpd security update
2013-08-05 15:32:30
(RHSA-2014:0369) Moderate: httpd security update
2014-04-03 00:00:00
securityvulns
securityvulns
[ MDVSA-2013:015 ] apache
2013-03-02 00:00:00
Apache security vulnerabilities
2013-03-02 00:00:00
Apache security vulnerabilities
2014-03-24 00:00:00
f5
f5
SOL15865 - Apache HTTP server vulnerability CVE-2012-4558
2014-11-25 00:00:00
SOL15900 - Apache HTTP server vulnerability CVE-2012-3499
2014-12-10 00:00:00
K15900 : Apache HTTP server vulnerability CVE-2012-3499
2014-12-11 00:00:00
freebsd
freebsd
apache22 -- several vulnerabilities
2012-10-07 00:00:00
apache22 -- several vulnerabilities
2013-06-21 00:00:00
apache -- several vulnerabilities
2014-02-25 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: httpd-2.4.4-2.fc18
2013-04-01 03:30:25
[SECURITY] Fedora 19 Update: httpd-2.4.9-1.fc19
2014-04-23 04:33:29
ubuntucve
ubuntucve
CVE-2012-4558
2013-02-26 00:00:00
CVE-2012-3499
2013-02-26 00:00:00
slackware
slackware
httpd
2013-03-03 15:02:33
[slackware-security] httpd
2014-03-28 22:54:00
ibm
ibm
Security Bulletin: Network Intrusion Prevention System is affected by multiple Apache web server vulnerabilities (CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231)
2022-02-23 19:21:55
Security Bulletin: Vulnerabilities in Apache affect the IBM Flex System Manager (FSM): (CVE-2013-6438, CVE-2014-0098, CVE-2014-0226, CVE-2014-0231)
2019-01-31 01:35:01
Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, and 2050 are affected by the following Apache Tomcat vulnerabilities: CVE-2014-0098 and CVE-2013-6438
2018-06-16 13:57:53
kaspersky
kaspersky
KLA10067 DoS vulnerabilities in Apache httpd
2014-03-26 00:00:00
KLA10068 Multiple vulnerabilities in Apache httpd
2013-07-22 00:00:00
ubuntu
ubuntu
Apache HTTP Server vulnerabilities
2013-07-15 00:00:00
Apache HTTP Server vulnerabilities
2014-03-24 00:00:00
Apache HTTP Server vulnerabilities
2013-03-18 00:00:00
mageia
mageia
Updated apache packages fix security vulnerabilities
2014-03-19 21:40:14
threatpost
threatpost
Apache Update Resolves Security Vulnerabilities
2014-03-18 12:51:25
seebug
seebug
Apache HTTP Server多个拒绝服务漏洞
2014-03-20 00:00:00
Apache HTTP Server多个模块主机名和URI跨站脚本漏洞
2013-02-28 00:00:00
debian
debian
[SECURITY] [DSA 2637-1] apache2 security update
2013-03-04 21:34:32
[SECURITY] [DSA 2637-1] apache2 security update
2013-03-04 21:34:32
[SECURITY] [DLA 66-1] apache2 security update
2014-09-29 13:40:41
osv
osv
apache2 - several
2013-03-04 00:00:00
apache2 - security update
2014-09-29 00:00:00
gentoo
gentoo
Apache HTTP Server: Multiple vulnerabilities
2014-08-29 00:00:00
Apache HTTP Server: Multiple vulnerabilities
2013-09-23 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package apache2 version 2.2.24-alt1
2013-04-14 00:00:00
Security fix for the ALT Linux 8 package apache2 version 2.2.24-alt1
2013-04-14 00:00:00
Security fix for the ALT Linux 10 package apache2 version 2.2.24-alt1
2013-04-14 00:00:00
hackerone
hackerone
U.S. Dept Of Defense: Out-of-date Version (Apache)
2016-11-24 15:09:27
httpd
httpd
Apache Httpd < 2.4.4 : XSS due to unescaped hostnames
2012-07-11 00:00:00
prion
prion
Cross site scripting
2013-02-26 16:55:00
cve
cve
CVE-2012-3499
2013-02-26 16:55:00
debiancve
debiancve
CVE-2012-3499
2013-02-26 16:55:00

5.1 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

0.963 High

EPSS

Percentile

99.4%

JSON
Related for H1:66929
suse5openvas54nessus69centos3amazon5oraclelinux3veracode2redhat14securityvulns5f53freebsd3fedora2ubuntucve2slackware2ibm3kaspersky2ubuntu3mageia1threatpost1seebug2debian3osv2gentoo2altlinux3hackerone1httpd1prion1cve1debiancve1