7290 matches found
mod_auth_openidc security update
An update is available for modauthopenidc. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for...
RLSA-2026:75581 Important: mod_auth_openidc security update
The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...
BIT-APACHE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow
Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...
BIT-APACHE-2026-79768 Apache HTTP Server: mod_userdir information disclosure
Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...
BIT-APACHE-2026-73637 Apache HTTP Server: mod_auth_digest DoS attack
Use after free in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifeti...
BIT-APACHE-2026-73636 Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in modauthdigest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle MITM attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's share...
BIT-APACHE-2026-63686 Apache HTTP Server: mod_xml2enc crash on charset conversion failure
A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails. Users are recommended to...
BIT-APACHE-2026-63292 Apache HTTP Server: mod_vhost_alias stack overflow
Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...
BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...
BIT-APACHE-2026-59797 Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
Improper Privilege Management vulnerability in Apache HTTP Server's modssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
BIT-APACHE-2026-59685 Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
BIT-APACHE-2026-58415 Apache HTTP Server: mod_dav_fs property database read access
Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...
BIT-APACHE-2026-57941 Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
BIT-APACHE-2026-56449 Apache HTTP Server: mod_proxy_html: crash in dump_content
Out-of-bounds Write vulnerability in Apache HTTP Server's modproxyhtml with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
BIT-APACHE-2026-56154 Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
Use After Free vulnerability in Apache HTTP Server's modrewrite when using lookahead %LA-U:HTTP:... This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2021-42013
CVE-2021-42013 — PoC: modcgi के माध्यम से Path Traversal + RCE पैच बायपास केवल नियंत्रित और अपने स्वयं के वातावरण में उपयोग के लिए। बिना प्राधिकरण के सिस्टम के खिलाफ उपयोग न करें। विवरण यह PoC Apache HTTP Server 2.4.50 में मौजूद CVE-2021-42013 को प्रदर्शित करने के लिए विकसित की गई है। यह CVE,...
CVE-2021-41773
CVE-2021-41773 — PoC: Path Traversal + RCE via modcgi Apenas para uso em ambientes controlados e próprios. Não usar contra sistemas sem autorização. Descrição PoC desenvolvida para demonstrar e entender a vulnerabilidade CVE-2021-41773 , presente no Apache HTTP Server 2.4.49. A falha reside na...
CVE-2021-41773-Apache-Lab
CVE-2021-41773 — Laboratório Apache HTTP Server 2.4.49 Reprodução do CVE-2021-41773 , uma vulnerabilidade de path traversal no Apache HTTP Server 2.4.49. Este projeto utiliza Docker para criar um ambiente vulnerável isolado e um PoC em Python para demonstrar a divulgação controlada de arquivos...
CVE-2021-41773-PoC
CVE-2021-41773 Vulnerabilidade de path traversal e divulgação de arquivos no Apache HTTP Server 2.4.49 Este script testa o Apache HTTP Server 2.4.49 Uso: CVE-2021-41773.py opções Apenas para um IP: python CVE-2021-41773.py IPaddress Opção -f Para lista de IPs em arquivo Exemplo: python...