AZL-43903 CVE-2023-25690 affecting package mod_http2 1.15.14-2

Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the...

DEBIAN-CVE-2023-25690

Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the...

ALPINE-CVE-2023-27522

HTTP Response Smuggling vulnerability in Apache HTTP Server via modproxyuwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client...

ALPINE-CVE-2023-25690

Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the...

UBUNTU-CVE-2023-25690

Some modproxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when modproxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the...

CLSA-2023-1678136793 httpd: Fix of CVE-2006-20001

CVE-2006-20001: moddav: out-of-bounds read/write...

CLSA-2023-1678136294 httpd: Fix of 2 CVEs

CVE-2022-37436: modproxy: HTTP response splitting - CVE-2006-20001: moddav: out-of-bounds read/write...

httpd: mod_dav: out-of-bounds read/write of zero byte

A flaw was found in the moddav module of httpd. A specially crafted "If:" request header can cause a memory read or write of a single zero byte due to a missing error check, resulting in a Denial of Service...

Unrestricted file upload

File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page...

CVE-2021-35290

CVE-2021-35290 is a file upload vulnerability in balerocms-src 0.8.3 that allows remote code execution via the rich text editor on the /admin/main/mod-blog page. Connected sources confirm the affected software and the root cause (unrestricted upload through the editor). Practical impact is arbitr...

balerocms-src 代码问题漏洞

balerocms-src is the source code for Balero CMS. A security vulnerability exists in balerocms-src version 0.8.3, which originates from a vulnerability that allows remote attackers to run arbitrary code via a rich text editor on the /admin/main/mod-blog page...

PT-2023-12257 · Unknown · Balerocms-Src

Name of the Vulnerable Software and Affected Versions: balerocms-src version 0.8.3 Description: The issue allows remote attackers to run arbitrary code via a rich text editor on the "/admin/main/mod-blog" page. This is a result of a File Upload vulnerability. Recommendations: For balerocms-src...

CVE-2021-35290: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page...

CVE-2023-25824 mod_gnutls contains Infinite Loop on request read timeout

Modgnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 including did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation, consuming CPU resources. This coul...

PT-2023-20329 · Apache · Apache Httpd

Name of the Vulnerable Software and Affected Versions: Mod gnutls versions 0.9.0 through 0.12.0 Description: Mod gnutls is a TLS module for Apache HTTPD based on GnuTLS. It did not properly fail blocking read operations on TLS connections when the transport hit timeouts, entering an endless loop...

httpd: mod_proxy: HTTP response splitting

A flaw was found in the modproxy module of httpd. A malicious backend can cause the response headers to be truncated because they are not cleaned when an error is found while reading them, resulting in some headers being incorporated into the response body and not being interpreted by a client...

SUSE-SU-2023:0431-1 Security update for apache2-mod_security2

This update for apache2-modsecurity2 fixes the following issues: - CVE-2023-24021: Fixed FILESTMPCONTENT missing complete content bsc1207379...

SUSE CVE-2004-0113

Memory leak in sslengineio.c for modssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service memory consumption via plain HTTP requests to the SSL port of an SSL-enabled server...

SUSE CVE-2004-0488

Stack-based buffer overflow in the sslutiluuencodebinary function in sslutil.c for Apache modssl, when modssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN...

SUSE CVE-2004-0490

cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code...