1241 matches found
PT-2022-1920
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.52 and earlier Description The issue is related to the improper handling of HTTP requests, which can allow a remote attacker to perform an HTTP Request Smuggling attack. This occurs when the server fails to clos...
VulnCheck KEV: CVE-2019-10097
In Apache HTTP Server 2.4.32-2.4.39, when modremoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted...
VulnCheck KEV: CVE-2020-11984
Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE...
VulnCheck KEV: CVE-2018-11763
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol...
VulnCheck KEV: CVE-2017-15715
In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the...
Exposure of Sensitive Information to an Unauthorized Actor in fgribreau/node-request-retry
Exposure of Sensitive Information to an Unauthorized Actor in FGRibreau/node-request-retry Reported on Feb 10 2022 | Timothee Desurmont Vulnerability type: CWE-200 Bug Cookies are leaked to external sites. Description js request$mysite/redirect.php?url=$attacker/, options When fetching a Redirect...
httpd: mod_lua: Possible buffer overflow when parsing multipart content
A buffer overflow flaw in httpd's lua module could allow an out-of-bounds write. An attacker who is able to submit a crafted request to an httpd instance that is using the lua module may be able to cause an impact to confidentiality, integrity, and/or availability...
USN-5212-1 apache2 vulnerabilities
It was discovered that the Apache HTTP Server incorrectly handled certain forward proxy requests. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly perform a Server Side Request Forgery attack. CVE-2021-44224 It was discovered that...
The vulnerability of the Apache HTTP server, related to the manipulation of requests on the server side, allows attackers to perform SSRF attacks.
The vulnerability of the Apache HTTP server is related to the manipulation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack by sending specially crafted HTTP requests...
ALPINE-CVE-2021-44790
A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier...
UBUNTU-CVE-2021-44224
A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint Server Side Request Forgery...
The vulnerability of the mod_proxy_uwsgi function in the Apache HTTP Server allows a hacker to cause a service failure.
The vulnerability of the modproxyuwsgi function in the Apache HTTP Server is related to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow a malicious actor to cause a service failure for an application through a uri-path request...
httpd: mod_session: Heap overflow via a crafted SessionHeader value
A heap overflow flaw was found In Apache httpd modsession. The highest threat from this vulnerability is to system availability...
WordPress Backup And Restore 1.0.3 Arbitrary File Deletion
Exploit Title: WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion Date: 11/07/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: https://www.miniorange.com/ Software Link: https://wordpress.org/plugins/backup-and-restore-for-wp/ Version: 1.0.3 Tested on : Window...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Poc CVE-2021-41773 - Apache 2.4.49...
Server-Side Request Forgery (SSRF) in pimcore/pimcore
Description Your demo server is running in a vulnerable Apache server Apache/2.4.38. The attacker can easily exploit SSRF vulnerability just by visiting a crafted URL. The vulnerability has been discovered few days ago and it relies on modproxy module. I know that this vulnerability is not direct...
OESA-2021-1387 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: apescapequotes may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apach...
TextPattern CMS 4.8.7 - Remote Command Execution (RCE) (Authenticated)
Exploit Title: TextPattern CMS 4.8.7 - Remote Command Execution RCE Authenticated Date: 2021/09/06 Exploit Author: Mert Daş [email protected] Software Link: https://textpattern.com/filedownload/113/textpattern-4.8.7.zip Software web: https://textpattern.com/ Tested on: Server: Xampp First of...
Apache HTTP Server vulnerable to directory traversal
Overview Apache HTTP Server provided by The Apache Software Foundation contains a directory traversal vulnerability CWE-22. Shungo Kumasaka of Internet Initiative Japan Inc. reported this vulnerability to the developer, and also to IPA in order to notify users of its solution through JVN. JPCERT/...
