19845 matches found
CVE-2025-12543 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...
CVE-2025-12543
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without...
CVE-2025-15472
A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The exploit has been published and may be...
RHSA-2026:0141 Red Hat Security Advisory: httpd security update
Bulletin has no description...
CVE-1999-0412
In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension...
CVE-1999-0881
Falcon web server allows remote attackers to read arbitrary files via a .. dot dot attack...
CVE-1999-0386
Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read files on the server by using a nonstandard URL...
CVE-1999-0283
The Java Web Server would allow remote users to obtain the source code for CGI programs...
CVE-1999-0175
The convert.bas program in the Novell web server allows a remote attackers to read any file on the system that is internally accessible by the web server...
CVE-1999-0882
Falcon web server allows remote attackers to determine the absolute path of the web root via long file names...
CVE-1999-0239
Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET...
CVE-1999-0222
Denial of service in Cisco IOS web server allows attackers to reboot the router using a long URL...
CVE-2019-16065
A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user...
PT-2026-2151
CVE-2026-22156 - Apache Apache HTTP Server Unvalidated User Input CVE ID : CVE-2026-22156 Published : Jan. 7, 2026, 12:17 p.m. | 3 hours, 59 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, a...
PT-2026-2152
CVE-2026-22157 - Apache HTTP Server Remote Code Execution Vulnerability CVE ID : CVE-2026-22157 Published : Jan. 7, 2026, 12:17 p.m. | 3 hours, 59 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products,...
PT-2026-2205
Name of the Vulnerable Software and Affected Versions affected versions not specified Description The credentials needed to access the device’s web server are transmitted in base64 within the HTTP headers. Base64 encoding is not a secure encryption method, allowing an attacker intercepting the we...
Unity Linux 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-000182)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000182 advisory. The aprwrite function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using...
Important: httpd
Issue Overview: Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to exec cmd="..." directives. CVE-2025-58098 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Serv...
Efacec QC 安全漏洞
Efacec QC is a series of electric vehicle charging posts from the Portuguese company Efacec. A security vulnerability exists in the Efacec QC that stems from the device web server access credentials being sent in Base64 encoding via the HTTP header, which is not a strong encryption algorithm, and...