Astra Linux – Vulnerability in Apache2

An integer overflow occurs when attempting to renew an ACME certificate. After several attempts approximately 30 days under default configurations, the backoff timer becomes 0. Subsequent attempts to renew the certificate are repeated without delay until success is achieved. This issue affects th...

Astra Linux – Vulnerability in Apache2

When an HTTP/2 stream is reset by a client via an RST frame, there is a time window during which the memory resources associated with the request are not immediately reclaimed. Instead, the deallocation of these resources is delayed until after the connection is closed. This allows clients to...

Astra Linux – Vulnerability in Apache2

The aprwrite function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large inputs using aprwrite or aprputs. This issue can occur, for example, when using the modluas r:puts function. Modules that are compiled and distribute...

Astra Linux – Vulnerability in Apache2

Splitting HTTP responses across multiple modules in the Apache HTTP Server allows an attacker who can inject malicious response headers into backend applications to carry out an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue...

Astra Linux – Vulnerability in Apache2

Buffer Over-read vulnerability in Apache HTTP Server due to outbound OCSP requests sent to an attacker-controlled OCSP server This issue affects Apache HTTP Server versions 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which addresses this vulnerability...

BIT-APACHE-2026-56153 Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char

Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-48005 Apache HTTP Server: mod_auth_digest reauthentication attack

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

BIT-APACHE-2026-47360 Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

BIT-APACHE-2026-46729 Apache HTTP Server: mod_heartmonitor denial of service

NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

BIT-APACHE-2026-42528 Apache HTTP Server: mod_dav shared lock overflow

A memory calculation bug in moddav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes. Users are recommended to upgrade to version 2.4.69, which fixes this issue...

BIT-APACHE-2026-42356 Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to Resource Exhaustion. The vulnerability is due to improper handling of type size/count, where excessive memory allocation can occur and a pre-authentication attacker can trigger it to cause a denial of service...

cve-2021-41773

Cve-2021-41773-grabber Vulnerabilidad de path traversal y divulgación de archivos en Apache HTTP Server 2.4.49 Este script obtiene servidores vulnerables para cve 2021-41773 desde shodan Cómo usar : usa python 3 instala el módulo shodan: pip install shodan cambia la palabra clave en el script por...

apche_unomi_rce

CVE-2020-13942 Original blog post about the vulnerability: https://www.checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered/ There are two RCE vectors: through MVEL injection and through OGNL injection. Both vectors target different code though the payloads look relativel...

Security Bulletin: Multiple Security Vulnerabilities Addressed in IBM Tivoli Netcool Configuration Manager(ITNCM) Version 6.4.2 Fix Pack 25 (6.4.2.25).

Summary Multiple security vulnerabilities have been addressed in IBM Tivoli Netcool Configuration ManagerITNCM Version 6.4.2 Fix Pack 25 6.4.2.25. The vulnerabilities affect components including Apache Log4j, Eclipse OpenJ9, Java SE, Apache Ant, and SSH implementations. Vulnerability Details...

Missing Authorization

Apache HBase is vulnerable to Missing Authorization. The vulnerability is due to missing owner checks in the fetch and close steps, where the server uses the scanner ID returned by the open step to identify scanner instances but fails to verify that the ID belongs to the requesting user, allowing...

CVE-2020-24186

chmod +x CVE-2020-24186 ./CVE-2020-24186...

SSP-Assignment-3-RCEYouLater

CVE-2023-46604: Prueba de Concepto de RCE en Apache ActiveMQ Asignación: SSP Assignment 3 Equipo: RCE You Later Miembros: Banica Horia Alexandru, Comarlau Vlad-Constantin Enlace de video del uso del repositorio para realizar la PoC:https://www.youtube.com/watch?v=vum4qTF4ygU 🚨 Descripción general...

Unsafe Reflection

Apache IoTDB is vulnerable to Unsafe Reflection. The vulnerability is due to the pipe processor instantiating an externally supplied class name using Class.forName.newInstance without validation or allowlisting, allowing an attacker to instantiate arbitrary classes...

Configuration Bypass

Apache Kyuubi is vulnerable to configuration bypass. The vulnerability is due to an incomplete security fix, where client‑controlled unprefixed Spark config aliases can bypass the server‑side kyuubi.session.local.dir.allowlist setting and attackers can exploit it by accessing the Kyuubi Server vi...