CVE-2007-3303

CVE-2007-3303 affects Apache httpd 2.0.59 and 2.2.4 with the Prefork MPM. The described issue arises from certain code sequences executed in a worker process, which can either stop request processing by killing all workers and preventing replacements, or cause the master process to fork an arbitr...

CVE-2002-2103

CVE-2002-2103 affects Apache before 1.3.24. When writing to the log file, Apache may record a spoofed hostname from reverse DNS for an IP address, even if a double-reverse lookup fails, allowing remote attackers to hide the original source of activities. The provided documents do not include expl...

CVE-2026-34356

CVE-2026-34356 is a heap-based buffer overflow in Apache HTTP Server (affecting 2.4.0–2.4.67) involving malicious backend servers and ProxyPassReverseCookie. The issue could allow a crash or similar impact (per CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; base score 7.5). Fixed by upgrading to...

CVE-2003-0254

CVE-2003-0254 affects Apache 2.x before 2.0.47. When running on an IPv6 host, the FTP proxy component may fail to create an IPv6 socket, triggering a Denial of Service via an infinite loop. Public advisories reference Apache HTTP Server vulnerabilities and note this can be exploited by remote act...

CVE-2004-0173

CVE-2004-0173 describes a directory traversal vulnerability affecting Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier when run on Cygwin. An attacker can read arbitrary files by requesting a URL containing "..%5C" (dot dot encoded backslash) sequences, enabling partial confidentiality im...

CVE-2000-0868

The CVE-2000-0868 issue affects Apache 1.3.12 on SuSE Linux 6.4 where the default configuration exposes CGI script source code. The vulnerability arises because /cgi-bin/ requests can be rewritten to /cgi-bin-sdb/, which is an Alias of /cgi-bin, enabling remote attackers to disclose source code o...

CVE-2001-0730

CVE-2001-0730 affects Apache 1.3.x by a flaw in the split-logfile support: a crafted HTTP request with a slash in the Host header can cause the server to overwrite any file ending in ".log" on the system. Affected version in public reports centers on Apache 1.3.20 with the ability to write arbitr...

CVE-2002-2012

CVE-2002-2012 concerns an unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0. The connected documents provide a concrete context: remote attackers could trigger “unexpected results” by sending an HTTP request. The vulnerability impact is described as affecting availabili...

CVE-2004-0748

CVE-2004-0748 affects the Apache HTTP Server with mod_ssl

CVE-2004-2343

Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess restrictions defined in httpd.conf with directives like Deny From All by using an ErrorDocument directive. The Red Hat and CVE records confirm this is the same issue; vendor dispute noted that .htaccess applies to extern...

CVE-2000-1204

CVE-2000-1204 affects Apache 1.3.9, 1.3.11 and 1.3.12 via the mod_vhost_alias module. The issue allows remote attackers to obtain the source code of CGI programs if the cgi-bin directory is under the document root. Impact is partial confidentiality; no exploitation details are provided in the con...

CVE-2002-0257

CVE-2002-0257 affects MakeBid Auction Deluxe 3.30 and is a cross-site scripting vulnerability in Auction Deluxe’s auction.pl. The issue allows remote attackers to read other users’ data via multiple form fields (TITLE, DESCTIT, DESC, searchstring, ALIAS, EMAIL, ADDRESS1-3, PHONE1-4). The NASL ent...

CVE-2003-1580

The CVE-2003-1580 issue affects Apache HTTP Server 2.0.44 when DNS resolution is enabled for client IPs. The vulnerability arises from a logging format that does not indicate whether a dotted-quad IP address is unresolved, which can allow remote attackers to spoof IP addresses by sending crafted ...

CVE-2003-1581

CVE-2003-1581 affects Apache HTTP Server 2.0.44: when DNS resolution is enabled for client IPs, remote attackers can inject arbitrary text into log files via an HTTP request paired with a crafted DNS response, demonstrated as XSS sequences (Inverse Lookup Log Corruption). The connected sources co...

CVE-2000-0913

The CVE-2000-0913 issue affects the Apache web server module mod_rewrite. It enables a remote attacker to read arbitrary files when a RewriteRule directive expands to a filename containing a regular expression, as described for Apache 1.3.12 and earlier. Connected sources corroborate that this is...

CVE-2002-1156

CVE-2002-1156 affects Apache 2.0.42. The vulnerability allows remote attackers to view the source of a CGI script via a POST to a directory where both WebDAV and CGI are enabled. This yields partial confidentiality impact per the NVD metrics (CVSS v2: AV:N/AC:L/Au:N/C:P/I:N/A:N; base score 5.0). ...

CVE-2002-1592

CVE-2002-1592 affects Apache HTTP Server 2.0 through 2.0.35. When a CGI application encounters an error, ap_log_rerror may send error messages to the client that include the server’s full path, enabling information disclosure. The provided sources confirm the affected range and the leakage of int...

CVE-2001-0766

CVE-2001-0766 affects Apache on MacOS X Client 10.0.3 with HFS+; a case-insensitive filesystem leads to bypassing URL-based access filters. The root cause is that Apache’s file access protection assumes a case-sensitive FS, so URLs with mixed case can bypass / restrictions, potentially exposing p...

CVE-1999-0926

Technical details beyond the minimal description are not publicly provided in the supplied documents. Monitor for updates on affected products, versions, and fixes.

CVE-1999-1293

CVE-1999-1293 concerns Apache’s mod_proxy in version 1.2.5 and earlier. The vulnerability allows remote attackers to trigger a denial of service by sending malformed FTP commands, which causes Apache to dump core. The available public description states the impact as a complete denial of service ...

CVE-2000-1206

CVE-2000-1206 describes a vulnerability in Apache httpd prior to 1.3.11 where mass virtual hosting using mod_rewrite or mod_vhost_alias (in Apache 1.3.9) can allow remote attackers to retrieve arbitrary files. The affected component is the httpd web server and its name-based hosting configuration...

CVE-2001-1072

CVE-2001-1072 affects Apache with mod_rewrite enabled on UNIX systems. The vulnerability arises when an attacker can insert extra / characters into the requested path, causing the RewriteRule’s regular expression to fail and allowing the path to bypass RewriteRules. The affected component is mod_...

CVE-2002-1593

CVE-2002-1593 affects the Apache httpd mod_dav component prior to version 2.0.42. The issue arises from improper handling of versioning hooks, which can trigger a null dereference in a child process and cause denial of service (CPU consumption) in a preforked multi-processing module. The risk is ...

CVE-2002-0249

CVE-2002-0249 affects PHP for Windows when used as a standalone CGI module on Apache 2.0.28 beta, where a crafted request with malformed arguments can disclose the physical path to php.exe in error messages. Affects PHP for Windows running under Apache CGI; the issue stems from error handling tha...

CVE-2001-1449

The CVE-2001-1449 issue affects Apache

CVE-2001-1342

Apache httpd before 1.3.20 on Windows and OS/2 is vulnerable to a denial-of-service via a crafted URI containing many slashes or other characters, which causes dereferencing of a NULL pointer in certain functions. The issue leads to a General Protection Fault in a child process when handling the ...

CVE-1999-0107

CVE-1999-0107 is a buffer overflow in Apache 1.2.5 and earlier that allows a remote attacker to cause a denial of service by issuing a high volume of GET requests containing a large number of / characters. The connected Red Hat, SUSE, and PT-Security entries corroborate the issue and describe the...

CVE-2002-0240

CVE-2002-0240 affects PHP when deployed with Apache and configured to serve index.php by default. The vulnerability allows remote attackers to learn the server’s full pathname via the HTTP OPTIONS method, leaking a partial confidentiality breach (PARTIAL) without impact to integrity/availability,...

CVE-2004-1387

The CVE-2004-1387 entry concerns the apache-utils package, specifically the check_forensic script (version 1.3.31). The vulnerability allows a local user to overwrite or create arbitrary files via a symlink attack on temporary files, with the underlying root cause being improper handling of tempo...

CVE-2001-0042

The CVE-2001-0042 entry affects PHP 3.x running on Apache 1.3.6 . It describes a remote file-read vulnerability via a modified “..” path traversal that can include encoded backslash sequences ("%5c") to disclose arbitrary files. The description indicates the root cause is a dot-dot traversal vuln...