CVE-2001-0729

CVE-2001-0729 concerns Apache HTTP Server on Windows (Win32) where a bug in Apache 1.3.20 can expose directory contents. The vulnerability arises when a client sends a very long URI composed of many forward slashes, allowing a remote attacker to bypass the default index page and cause directory l...

CVE-2003-0134

CVE-2003-0134 concerns Apache on OS/2 (versions 2.0–2.0.45) with a Denial of Service vulnerability in filestat.c related to device-name handling. Public details indicate the flaw could be triggered by specific requests involving device names, causing the running OS/2 worker process to fault. The ...

CVE-2003-0253

CVE-2003-0253 affects Apache 2.x with the prefork MPM before 2.0.47. A bug in handling accept() errors on rarely accessed ports could cause a temporary denial of service. The available connected documents consistently describe this as a DoS issue tied to the prefork MPM; remediation involves upgr...

CVE-2000-1205

CVE-2000-1205 covers cross-site scripting in Apache 1.3.0–1.3.11. The vulnerability allows remote attackers to execute script as other visitors via (1) printenv CGI (printenv.pl) output, (2) error pages generated by ap_send_error_response (e.g., default 404) that omit an explicit charset, or (3) ...

CVE-2002-2103

CVE-2002-2103 affects Apache before 1.3.24. When writing to the log file, Apache may record a spoofed hostname from reverse DNS for an IP address, even if a double-reverse lookup fails, allowing remote attackers to hide the original source of activities. The provided documents do not include expl...

CVE-2003-0017

Apache HTTP Server on Windows versions older than 2.0.44 is affected by CVE-2003-0017. A crafted HTTP request containing illegal characters (for example, ">") can cause the server to process a different filename and disclose certain files. This vulnerability is a remote-access issue with netwo...

CVE-2004-0751

Summary (grounded in provided docs): CVE-2004-0751 concerns the Apache httpd mod_ssl module. The issue arises when reverse proxying to an SSL server, where the char_buffer_read function can trigger a remote denial of service via a segmentation fault. Connected documents corroborate the vulnerabil...

CVE-2001-0730

CVE-2001-0730 affects Apache 1.3.x by a flaw in the split-logfile support: a crafted HTTP request with a slash in the Host header can cause the server to overwrite any file ending in ".log" on the system. Affected version in public reports centers on Apache 1.3.20 with the ability to write arbitr...

CVE-2003-0189

CVE-2003-0189 detail (from connected documents): The Apache HTTP Server 2.0.40–2.0.45 on Unix platforms fails to handle thread safety in the apr_password_validate() path when crypt_r/crypt is used, enabling remote attackers to trigger a denial-of-service by breaking Basic Authentication under a t...

CVE-2003-0460

Apache rotatelogs vulnerability CVE-2003-0460 affects Apache 1.3.x before 1.3.28 on Windows/OS/2, where rotatelogs does not ignore certain control characters received over the pipe, potentially allowing remote attackers to cause a denial of service. Documents from NVD and CERT note that this coul...

CVE-2002-1233

CVE-2002-1233 applies to Debian’s apache-ssl packages, where a regression in Apache 1.3.27 and earlier (Debian 2.2 before 1.3.9, Debian 3.0 before 1.3.26) allows local attackers to read or modify the Apache password file via a symlink attack when running htpasswd or htdigest. The issue reintroduc...

CVE-2007-3303

CVE-2007-3303 affects Apache httpd 2.0.59 and 2.2.4 with the Prefork MPM. The described issue arises from certain code sequences executed in a worker process, which can either stop request processing by killing all workers and preventing replacements, or cause the master process to fork an arbitr...

CVE-2002-1850

The CVE-2002-1850 issue affects Apache’s mod_cgi in versions 2.0.39 and 2.0.40. A CGI script that writes a large amount of data to stderr can trigger a read/write deadlock between httpd and the CGI script, allowing local users and possibly remote attackers to cause a denial of service (hang and m...

CVE-2003-0254

CVE-2003-0254 affects Apache 2.x before 2.0.47. When running on an IPv6 host, the FTP proxy component may fail to create an IPv6 socket, triggering a Denial of Service via an infinite loop. Public advisories reference Apache HTTP Server vulnerabilities and note this can be exploited by remote act...

CVE-2002-2012

CVE-2002-2012 concerns an unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0. The connected documents provide a concrete context: remote attackers could trigger “unexpected results” by sending an HTTP request. The vulnerability impact is described as affecting availabili...

CVE-2003-1580

The CVE-2003-1580 issue affects Apache HTTP Server 2.0.44 when DNS resolution is enabled for client IPs. The vulnerability arises from a logging format that does not indicate whether a dotted-quad IP address is unresolved, which can allow remote attackers to spoof IP addresses by sending crafted ...

CVE-2004-0173

CVE-2004-0173 describes a directory traversal vulnerability affecting Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier when run on Cygwin. An attacker can read arbitrary files by requesting a URL containing "..%5C" (dot dot encoded backslash) sequences, enabling partial confidentiality im...

CVE-2004-2343

Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess restrictions defined in httpd.conf with directives like Deny From All by using an ErrorDocument directive. The Red Hat and CVE records confirm this is the same issue; vendor dispute noted that .htaccess applies to extern...

CVE-2000-1204

CVE-2000-1204 affects Apache 1.3.9, 1.3.11 and 1.3.12 via the mod_vhost_alias module. The issue allows remote attackers to obtain the source code of CGI programs if the cgi-bin directory is under the document root. Impact is partial confidentiality; no exploitation details are provided in the con...

CVE-2026-73636

The Apache HTTP Server 2.4.x on all platforms is vulnerable to an authentication bypass via a capture-replay attack in the mod_auth_digest module. When AuthDigestNonceLifetime is set to 0 , a man-in-the-middle (MITM) attacker can replay captured digest authentication credentials by sending crafte...

CVE-2000-0868

The CVE-2000-0868 issue affects Apache 1.3.12 on SuSE Linux 6.4 where the default configuration exposes CGI script source code. The vulnerability arises because /cgi-bin/ requests can be rewritten to /cgi-bin-sdb/, which is an Alias of /cgi-bin, enabling remote attackers to disclose source code o...

CVE-2003-1581

CVE-2003-1581 affects Apache HTTP Server 2.0.44: when DNS resolution is enabled for client IPs, remote attackers can inject arbitrary text into log files via an HTTP request paired with a crafted DNS response, demonstrated as XSS sequences (Inverse Lookup Log Corruption). The connected sources co...

CVE-2004-0748

CVE-2004-0748 affects the Apache HTTP Server with mod_ssl

CVE-2000-0913

The CVE-2000-0913 issue affects the Apache web server module mod_rewrite. It enables a remote attacker to read arbitrary files when a RewriteRule directive expands to a filename containing a regular expression, as described for Apache 1.3.12 and earlier. Connected sources corroborate that this is...

CVE-2001-0766

CVE-2001-0766 affects Apache on MacOS X Client 10.0.3 with HFS+; a case-insensitive filesystem leads to bypassing URL-based access filters. The root cause is that Apache’s file access protection assumes a case-sensitive FS, so URLs with mixed case can bypass / restrictions, potentially exposing p...

CVE-2002-1592

CVE-2002-1592 affects Apache HTTP Server 2.0 through 2.0.35. When a CGI application encounters an error, ap_log_rerror may send error messages to the client that include the server’s full path, enabling information disclosure. The provided sources confirm the affected range and the leakage of int...

CVE-2001-1449

The CVE-2001-1449 issue affects Apache

CVE-2002-1156

CVE-2002-1156 affects Apache 2.0.42. The vulnerability allows remote attackers to view the source of a CGI script via a POST to a directory where both WebDAV and CGI are enabled. This yields partial confidentiality impact per the NVD metrics (CVSS v2: AV:N/AC:L/Au:N/C:P/I:N/A:N; base score 5.0). ...

CVE-2000-1206

CVE-2000-1206 describes a vulnerability in Apache httpd prior to 1.3.11 where mass virtual hosting using mod_rewrite or mod_vhost_alias (in Apache 1.3.9) can allow remote attackers to retrieve arbitrary files. The affected component is the httpd web server and its name-based hosting configuration...

CVE-2002-0257

CVE-2002-0257 affects MakeBid Auction Deluxe 3.30 and is a cross-site scripting vulnerability in Auction Deluxe’s auction.pl. The issue allows remote attackers to read other users’ data via multiple form fields (TITLE, DESCTIT, DESC, searchstring, ALIAS, EMAIL, ADDRESS1-3, PHONE1-4). The NASL ent...

CVE-2002-1593

CVE-2002-1593 affects the Apache httpd mod_dav component prior to version 2.0.42. The issue arises from improper handling of versioning hooks, which can trigger a null dereference in a child process and cause denial of service (CPU consumption) in a preforked multi-processing module. The risk is ...

CVE-1999-0926

Technical details beyond the minimal description are not publicly provided in the supplied documents. Monitor for updates on affected products, versions, and fixes.

CVE-2002-0249

CVE-2002-0249 affects PHP for Windows when used as a standalone CGI module on Apache 2.0.28 beta, where a crafted request with malformed arguments can disclose the physical path to php.exe in error messages. Affects PHP for Windows running under Apache CGI; the issue stems from error handling tha...

CVE-2001-1072

CVE-2001-1072 affects Apache with mod_rewrite enabled on UNIX systems. The vulnerability arises when an attacker can insert extra / characters into the requested path, causing the RewriteRule’s regular expression to fail and allowing the path to bypass RewriteRules. The affected component is mod_...

CVE-1999-1293

CVE-1999-1293 concerns Apache’s mod_proxy in version 1.2.5 and earlier. The vulnerability allows remote attackers to trigger a denial of service by sending malformed FTP commands, which causes Apache to dump core. The available public description states the impact as a complete denial of service ...

CVE-2026-56153

The Apache HTTP Server versions 2.4.0 through 2.4.68 are vulnerable to a heap-based buffer overflow (out-of-bounds write) within the mod_charset_lite module. The flaw exists in the finish_partial_char function during character set conversions. A remote attacker can exploit this by sending special...

CVE-2026-63718

Apache HTTP Server (versions 2.4.30 through 2.4.68 ) is vulnerable to an HTTP response smuggling vulnerability in the mod_proxy_uwsgi module. This issue occurs when the server processes a crafted uWSGI response containing a Transfer-Encoding header, allowing a remote attacker to desynchronize HTT...

CVE-2001-1342

Apache httpd before 1.3.20 on Windows and OS/2 is vulnerable to a denial-of-service via a crafted URI containing many slashes or other characters, which causes dereferencing of a NULL pointer in certain functions. The issue leads to a General Protection Fault in a child process when handling the ...

CVE-1999-0107

CVE-1999-0107 is a buffer overflow in Apache 1.2.5 and earlier that allows a remote attacker to cause a denial of service by issuing a high volume of GET requests containing a large number of / characters. The connected Red Hat, SUSE, and PT-Security entries corroborate the issue and describe the...

CVE-2002-0240

CVE-2002-0240 affects PHP when deployed with Apache and configured to serve index.php by default. The vulnerability allows remote attackers to learn the server’s full pathname via the HTTP OPTIONS method, leaking a partial confidentiality breach (PARTIAL) without impact to integrity/availability,...

CVE-2026-59685

Apache HTTP Server (versions 2.4.0 through 2.4.68 ) contains an Out-of-bounds Write vulnerability when deployed on Windows environments. The flaw occurs in the ap_directory_walk() function during Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM while processing paths with 8.3 names that expand bey...

CVE-2001-0042

The CVE-2001-0042 entry affects PHP 3.x running on Apache 1.3.6 . It describes a remote file-read vulnerability via a modified “..” path traversal that can include encoded backslash sequences ("%5c") to disclose arbitrary files. The description indicates the root cause is a dot-dot traversal vuln...

CVE-2004-1387

The CVE-2004-1387 entry concerns the apache-utils package, specifically the check_forensic script (version 1.3.31). The vulnerability allows a local user to overwrite or create arbitrary files via a symlink attack on temporary files, with the underlying root cause being improper handling of tempo...

CVE-2026-46729

Apache HTTP Server versions 2.4.0 through 2.4.68 are vulnerable to a NULL Pointer Dereference within the mod_heartmonitor module. The flaw occurs over a unicast listener , which can lead to a denial of service (DoS) condition. While the vulnerability is confirmed to impact availability, specific ...

CVE-2026-48005

The Apache Software Foundation Apache HTTP Server (versions before 2.4.69 ) on all platforms is vulnerable to a denial of service (forced re-authentication) via a missing authentication check in mod_auth_digest . An unauthenticated remote client can trigger this by sending forged Authorization he...

CVE-2026-63045

The Apache HTTP Server (versions through 2.4.68 ) is vulnerable to an improper validation of the FTP PASV reply address within the mod_proxy_ftp module. When configured as a forward proxy, an untrusted FTP server can provide a crafted PASV response, forcing the proxy to establish a data connectio...

CVE-2026-73637

The Apache Software Foundation Apache HTTP Server (versions before 2.4.69 ) is vulnerable to a use-after-free flaw in the mod_auth_digest module. An unauthenticated remote client can cause authentication state corruption by submitting concurrent Digest authentication requests. This vulnerability ...

CVE-2026-47360

The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability within the mod_session_cookie module. The root cause is that when the SessionCookieRemove directive changes across internal redirects, the session c...

CVE-2026-56449

The Apache HTTP Server is vulnerable to an Out-of-bounds Write vulnerability within the mod_proxy_html module. This issue can be triggered by processing crafted HTTP response bodies , specifically leading to a crash in the dump_content function. The vulnerability affects versions 2.4.0 through 2....

CVE-2026-63686

The Apache HTTP Server (versions before 2.4.69 ) is vulnerable to a NULL pointer dereference within the mod_xml2enc module. An untrusted backend server can trigger a Denial of Service (DoS) by returning a crafted response with a character set that partially succeeds and then fails during conversi...