USN-3627-1: Apache HTTP Server vulnerabilities

Alex Nichols and Jakob Hirsch discovered that the Apache HTTP Server modauthnzldap module incorrectly handled missing charset encoding headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. CVE-2017-15710 Elar Lang discovered that...

CVE-2018-2760

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware subcomponent: OSSL Module. Supported versions that are affected are 12.1.3 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server...

CVE-2018-2760

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware subcomponent: OSSL Module. Supported versions that are affected are 12.1.3 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server...

CVE-2018-2760

The CVE-2018-2760 entry concerns Oracle Fusion Middleware’s Oracle HTTP Server, specifically the OSSL Module subcomponent. Affected versions are 12.1.3 and 12.2.1.2. The vulnerability is described as difficult to exploit and allows an unauthenticated attacker who can reach the server over HTTPS t...

openSUSE Security Update : mercurial (openSUSE-2018-349)

This update for mercurial fixes the following issue : - CVE-2018-1000132: Remote attackers may bypass HTTP server permissions via batch wire protocol commands bsc1085211 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

[SECURITY] Fedora 27 Update: php-7.1.16-1.fc27

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

[SECURITY] Fedora 26 Update: php-7.1.16-1.fc26

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Fedora 27 : httpd (2018-375e3244b6)

This update includes the latest upstream release of the Apache HTTP Server, version 2.4.33. A number of security vulnerabilities are fixed in this release : - Low: Possible out of bound read in modcachesocache CVE-2018-1303 - Low: Possible out of bound access after failure in reading the HTTP...

[SECURITY] Fedora 27 Update: httpd-2.4.33-2.fc27

The Apache HTTP Server is a powerful, efficient, and extensible web server...

Apache HTTP Server Denial of Service Vulnerability-02 (Apr 2018) - Windows

Apache HTTP Server is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache HTTP Server Multiple Vulnerabilities (Apr 2018) - Windows

Apache HTTP Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:httpserver"; if...

Apache HTTP Server Denial of Service Vulnerability (Apr 2018) - Linux

Apache HTTP Server is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[ASA-201804-4] apache: multiple issues

Arch Linux Security Advisory ASA-201804-4 ========================================= Severity: Medium Date : 2018-04-04 CVE-ID : CVE-2017-15710 CVE-2017-15715 CVE-2018-1283 CVE-2018-1301 CVE-2018-1302 CVE-2018-1303 CVE-2018-1312 Package : apache Type : multiple issues Remote : Yes Link :...

Apache HTTP Server Multiple Vulnerabilities (Apr 2018) - Linux

Apache HTTP Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:httpserver"; if...

Apache HTTP Server Denial of Service Vulnerability-02 (Apr 2018) - Linux

Apache HTTP Server is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Debian DSA-4164-1 : apache2 - security update

Several vulnerabilities have been found in the Apache HTTPD server. - CVE-2017-15710 Alex Nichols and Jakob Hirsch reported that modauthnzldap, if configured with AuthLDAPCharsetConfig, could cause an out of bound write if supplied with a crafted Accept-Language header. This could potentially be...

CVE-2017-17742

Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick...

Microsoft IIS 7.0 Vulnerabilities (uncredentialed) (PCI/DSS)

According to the HTTP server banner the remote server is IIS 7.0. The server may be vulnerable to a number of vulnerabilities including a couple of remote code execution vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108808; scriptversion"1.8";...

Apache HTTP Server Denial of Service Vulnerability (Apr 2018) - Windows

Apache HTTP Server is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2018-9157

An issue was discovered on AXIS M1033-W IP camera Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server modinclude...