PT-2025-49184

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.7 through 2.4.65 Description A flaw exists in Apache HTTP Server where a bypass of mod userdir+suexec is possible via the AllowOverride FileInfo functionality. Individuals with the ability to utilize the...

PT-2025-49183

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.65 Description An issue exists in Apache HTTP Server where improper neutralization of escape, meta, or control sequences can occur through environment variables set via the Apache configuration. Th...

CVE-2024-53703

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions modhttprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution...

CVE-2024-53703

CVE-2024-53703 affects SonicWall SMA100 SSLVPN firmware, specifically mod_httprp library loaded by Apache, causing a stack-based buffer overflow that can lead to remote code execution. Affected versions include 10.2.1.13-72sv and earlier; mitigation is to upgrade to the fixed release (e.g., 10.2....

SonicWALL SMA100 安全漏洞

The SonicWALL SMA100 is a secure access gateway device from SonicWALL, Inc. A security vulnerability exists in the SonicWALL SMA100 that stems from a flaw in the modhttprp library loaded by the Apache web server. Exploitation of this vulnerability by a remote attacker could cause a stack-based...

CLSA-2024-1732194710 httpd: Fix of 2 CVEs

CVE-2023-38709: faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses - CVE-2024-24795: HTTP response splitting in multiple modules allows an attacker that can inject malicious response headers into backend applications to...

httpd: HTTP response splitting

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers, resulting in an HTTP response splitting...

httpd: HTTP response splitting

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers, resulting in an HTTP response splitting...

OESA-2024-2101 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or...

CLSA-2024-1725382183 httpd: Fix of 2 CVEs

CVE-2023-38709: faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses - CVE-2024-24795: HTTP response splitting in multiple modules allows an attacker that can inject malicious response headers into backend applications to...

The vulnerability of the Apache HTTP Server’s kernel allows attackers to gain unauthorized access to protected information.

The vulnerability of the Apache HTTP Server’s kernel is related to the use of outdated configuration settings for handlers. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2024-14840 · Undefined · Undefined

"Source": "CVE FEED", "Title": "CVE-2023-5888 - Apache Web Server Remote Command Execution Vulnerability", "Content": "CVE ID : CVE-2023-5888 Published : Aug. 16, 2024, 7:15 p.m. | 38 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-7246...

PT-2024-12209 · Undefined · Undefined

"Source": "CVE FEED", "Title": "CVE-2023-2920 - Apache Web Server Remote Code Execution Vulnerability", "Content": "CVE ID : CVE-2023-2920 Published : Aug. 16, 2024, 6:15 p.m. | 37 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1503. Reaso...

httpd: Substitution encoding issue in mod_rewrite

A flaw was found in the modrewrite module of httpd. Due to a substitution encoding issue, specially crafted requests may allow an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant only to be execut...

httpd: NULL pointer dereference in mod_proxy

A flaw was found in the modproxy module of httpd. A NULL pointer dereference can be triggered when processing a specially crafted HTTP request, causing the httpd server to crash, and resulting in a denial of service...

httpd: Encoding problem in mod_proxy

A flaw was found in the modproxy module of httpd. Due to an encoding problem, specially crafted request URLs with incorrect encoding can be sent to backend services, potentially bypassing authentication...

httpd: CONTINUATION frames DoS

A vulnerability was found in how Apache httpd implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers,...

httpd: Potential SSRF in mod_rewrite

A flaw was found in the modrewrite module of httpd. A potential SSRF allows an attacker to cause unsafe rules used in the RewriteRule directive to unexpectedly set up URLs to be handled by the modproxy module...

PT-2024-37855 · Undefined · Undefined

"Source": "CVE FEED", "Title": "CVE-2024-6761 - CVE-2017-5618: Apache HTTP Server Cross-Site Scripting", "Content": "CVE ID : CVE-2024-6761 Published : July 29, 2024, 11:15 a.m. | 24 minutes ago Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering...

PT-2024-11759 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns a remote code execution vulnerability. No specific details about affected devices, real-world incidents, or technical exploitation details are provided...