CVE-2006-3747

Off-by-one error in the ldap scheme handling in the Rewrite module modrewrite in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via...

CVE-2005-3357

CVE-2005-3357 affects mod_ssl in Apache 2.0 up to 2.0.55; when using an SSL vhost with access control and a custom 400 error page, a non-SSL request to an SSL port can trigger a NULL pointer dereference, causing a denial of service. Remediation/version is not specified in the provided documents.

CVE-2005-3357

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

GLSA-200508-15 : Apache 2.0: Denial of Service vulnerability

The remote host is affected by the vulnerability described in GLSA-200508-15 Apache 2.0: Denial of Service vulnerability Filip Sneppe discovered that Apache improperly handles byterange requests to CGI scripts. Impact : A remote attacker may access vulnerable scripts in a malicious way, exhaustin...

CVE-2002-1592

The aplogrerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information...

Hijacking Apache 2 via mod_perl

Product: modperl Versions: 1.9909 / apache 2.0.47 URL: http://perl.apache.org Impact: Daemon Hijacking Bug class: Leaked Descriptor Vendor notified: Yes Fix available: No Date: 01/21/04 Issue: ====== Modperl under apache 2.0.x leaks critical file descriptors that can be used to takeover hijack th...

CVE-2003-0132

A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service memory consumption via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed...

CVE-2003-0132

A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service memory consumption via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed...

Apache 2 Cross-Site Scripting

This is being submitted without an update to Apache, but I am expecting an Apache Update Announcement shortly. The CVE has already assigned a candidate to this it is currently reserved, and CERT has assigned VU240329, but has not created a write-up yet. The reason for the ugly mail2web .sig is...

Apache 2.0.(39|40) DOS (PHP!)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -==--==--==- I put PHP in the title so I know this message will reach the "sekur1ty c0mmun1ty", that knows that PHP is bad, because it's easy to write insecure applications, unlike C. - -==--==--==- Problem: o Apache 2.0 .39 and .40 tested on Linuxx...

Apache 2.0 - Full Path Disclosure

Apache 2.0 - Full Path Disclosure source: https://www.securityfocus.com/bid/5485/info A path disclosure vulnerability has been reported in Apache 2.0.x. It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files such as error documents that hav...

DEBIAN-CVE-2002-0661

Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. dot dot sequences containing \ backslash characters...

DEBIAN-CVE-2002-0392

Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size...

CVE-2002-1592

The aplogrerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information...

CVE-2002-0249

PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message...