CVE-2021-39275: Out-of-bounds Write

apescapequotes may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier...

Apache Httpd < 2.4.49 : ap_escape_quotes buffer overflow

apescapequotes may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier...

Apache HTTP Server code-related vulnerabilities

Apache HTTP Server is an open source web server from the Apache Foundation. Apache HTTP Server in version 2.4.48 and earlier is vulnerable to server-side request forgery, which stems from a failure of the modproxy module to properly validate user input and can be exploited to forward requests to ...

Apache HTTP Server buffer error vulnerability

Apache HTTP Server is an open source web server from the Apache Foundation. Apache HTTP Server versions 2.4.30 to 2.4.48 contain a denial-of-service vulnerability that stems from a network system or product that does not properly validate incoming data. An attacker could exploit this vulnerabilit...

PT-2021-1392

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.48 and earlier Description: A crafted request uri-path can cause mod proxy to forward the request to an origin server chosen by the remote user. This issue is related to insufficient validation of incoming...

CVE-2021-40438: Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier...

CVE-2021-36160: Out-of-bounds Read

A carefully crafted request uri-path can cause modproxyuwsgi to read above the allocated memory and crash DoS. This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 inclusive...

Apache Httpd < 2.4.49 : NULL pointer dereference in httpd core

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier...

Apache HTTP Server code-related vulnerabilities

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A security vulnerability exists in Apache HTTP Server version 2.4.48 and earlier, which stems from a malformed request that could...

CVE-2021-34798: NULL Pointer Dereference

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2021-2381)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Wallarm API Firewall outperforms Nginx in a production environment

Wallarm API Firewall is a free light-weighted API Firewall that protects your API endpoints in cloud-native environments with API schema validation. Wallarm API Firewall relies on a positive security model allowing calls that match a predefined API specification, while rejecting everything else...

vulhub

This repository is an offensive tool for creating pre-built vulnerable environments based on Docker-Compose. It is a collection of vulnerable applications and services that can be used for testing and training purposes. The repository includes a variety of vulnerable applications, such as CouchDB...

com.barchart.http:barchart-http-handlers (>=1.0.6, <=1.0.7), com.barchart.http:barchart-http-server (>=1.0.6, <=1.0.7) potentially affected by CVE-2021-37137 via io.netty:netty (4.0.0.alpha6)

io.netty:netty MAVEN version 4.0.0.alpha6 is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - com.barchart.http:barchart-http-handlers =1.0.6, =1.0.6, =1.0.7 Source cves: CVE-2021-37137 Source advisory:...

com.barchart.http:barchart-http-handlers (>=1.0.6, <=1.0.7), com.barchart.http:barchart-http-server (>=1.0.6, <=1.0.7) +14 more potentially affected by CVE-2021-37136 via io.netty:netty (>=4.0.0.alpha1, <=4.0.0.alpha8)

io.netty:netty MAVEN version =4.0.0.alpha1, =1.0.6, =1.0.6, =0.3, =0.3, =0.2, =1.3.0, =1.0.0.alpha1, =1.0.0.alpha2 and more Source cves: CVE-2021-37136 Source advisory: GHSA-GRG4-WF29-R9VV...

com.barchart.http:barchart-http-handlers (>=1.0.6, <=1.0.7), com.barchart.http:barchart-http-server (>=1.0.6, <=1.0.7) potentially affected by CVE-2021-37136 via io.netty:netty (4.0.0.alpha6)

io.netty:netty MAVEN version 4.0.0.alpha6 is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - com.barchart.http:barchart-http-handlers =1.0.6, =1.0.6, =1.0.7 Source cves: CVE-2021-37136 Source advisory:...

openSUSE 15 Security Update : apache2 (openSUSE-SU-2021:1234-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1234-1 advisory. - A crafted method sent through HTTP/2 will bypass validation and be forwarded by modproxy, which can lead to request splitting or cache poisoning...

SUSE SLED15: apache2 / apache2-devel / apache2-doc / apache2-event / etc (SUSE-SU-2021:2954-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2954-1 advisory. - CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and modproxy bsc1189387. Tenable has extracted the preceding description...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2021-2333)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-39191 URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of modauthopenidc was reported to ...