CVE-2021-41773-L-

CVE-2021-41773 🐛 ثغرة اجتياز المسار وكشف الملفات في Apache HTTP Server 2.4.49 تم اكتشاف خلل في تغيير أُجري على تطبيع المسار في Apache HTTP Server 2.4.49. يمكن للمهاجم استخدام هجوم اجتياز المسار لربط عناوين URL بملفات خارج الدلائل التي تم تكوينها عبر توجيهات شبيهة بـ Alias. إذا لم تكن الملفات خارج...

CVE-2021-41773

CVE-2021-41773 — استغلال اجتياز المسار وتنفيذ الأوامر عن بُعد في Apache تقرير عن غرفة "Modern Web Stacks" في TryHackMe، يركز على استغلال CVE-2021-41773 ، وهي ثغرة اجتياز مسار في خادم Apache HTTP Server 2.4.49 تؤدي إلى تنفيذ الأوامر عن بُعد عند تفعيل modcgi. ملخص العنصر| التفاصيل ---|--- الثغرة|...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. id: CVE-2019-10098 info: name: Apache HTTP server v2.4.0 to v2.4.39 - Open...

[SECURITY] Fedora 44 Update: httpd-2.4.69-1.fc44

The Apache HTTP Server is a powerful, efficient, and extensible web server...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791392163)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791392163 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2026:77371)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77371 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Conne...

PT-2026-107564

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791391794)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791391794 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791396690)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791396690 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache...

CVE-2026-23918-poc

CVE-2026-23918 — التحرير المزدوج في Apache modhttp2 المتأثر: خادم Apache HTTP 2.4.66 مع modhttp2 + Event MPM تم الإصلاح في: Apache 2.4.67 modh2 v2.0.37 CVSS 3.1: 8.8 عالي — تنفيذ تعليمات برمجية عن بُعد غير مصادق عليه ممكن CWE: CWE-415 تحرير مزدوج ما هي الثغرة يحتوي modhttp2 في Apache 2.4.66 على...

CVE-2023-46604-RCE

CVE-2023-46604-RCE Implémentation Python de l'exécution de code à distance non authentifiée Apache ActiveMQ Configuration et exploitation nc -lvnp 4444 - Démarrer le listener python3 -m http.server 8080 - Héberger poc.xml contenant votre charge utile python3 CVE-2023-46604-RCE.py -i -p -u...

CVE-2026-49975

CVE-2026-49975 قنبلة HTTP/2 ★ CVE-2026-49975 إثبات المفهوم لقنبلة HTTP/2 ★ نظرة عامة CVE-2026-49975 هو ثغرة حرمان من الخدمة DoS في خادم Apache HTTP. تحدث الثغرة في مسار معالجة طلبات HTTP/2، حيث يمكن دمج حقول cookie المتعددة دون أن تُحتسب بشكل صحيح ضمن LimitRequestFields. من خلال إرسال طلب HTTP/2...

CVE-2019-0211-exploit

CVE-2019-0211 — تصعيد محلي للامتيازات في Apache HTTP Server CARPE DIEM الوصف CVE-2019-0211 هي ثغرة تصعيد امتيازات محلي تؤثر على Apache HTTP Server بين الإصدارين 2.4.17 و2.4.38 مع modprefork وmodphp أو PHP-FPM. تتيح هذه الثغرة لمهاجم يملك شل shell بصلاحيات www-data تصعيد الصلاحيات إلى root عبر مزي...

CVE-2019-10092

CVE-2019-10092: برمجة نصية عبر المواقع محدودة من خلال صفحة "خطأ الوكيل" في خادم Apache HTTP في Apache HTTP Server 2.4.0-2.4.39، تم الإبلاغ عن مشكلة برمجة نصية عبر المواقع محدودة تؤثر على صفحة خطأ modproxy. يمكن للمهاجم التسبب في أن يكون الرابط على صفحة الخطأ مشوّهًا وأن يشير بدلاً من ذلك إلى صفحة...

RLSA-2026:75581 Important: mod_auth_openidc security update

The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fixes: modauthopenidc: modauthopenidc: Denial of Service via malformed state cookie parsi...

mod_auth_openidc security update

An update is available for modauthopenidc. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The modauthopenidc is an OpenID Connect authentication module for...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...

BIT-APACHE-2026-93546 Apache HTTP Server: mod_dav_fs namespace overflow

Integer overflow in moddavfs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces...

BIT-APACHE-2026-79768 Apache HTTP Server: mod_userdir information disclosure

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...