Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:14163
HistoryMay 02, 2019 - 4:44 a.m.

Arbitrary Code Injection

2019-05-0204:44:51
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

The Apache HTTP Server is a popular web server. Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module’s manager web interface. If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user’s manager interface session. (CVE-2012-4558) It was found that mod_rewrite did not filter terminal escape sequences from its log file. If mod_rewrite was configured with the RewriteLog directive, a remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the mod_rewrite log file. If a victim viewed the log file with a terminal emulator, it could result in arbitrary command execution with the privileges of that user. (CVE-2013-1862) Cross-site scripting (XSS) flaws were found in the mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp modules. An attacker could possibly use these flaws to perform XSS attacks if they were able to make the victim’s browser generate an HTTP request with a specially-crafted Host header. (CVE-2012-3499) All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

References

Related

nessus 56
oraclelinux 1
openvas 31
redhat 8
amazon 4
centos 1
f5 8
freebsd 2
fedora 1
securityvulns 7
ubuntucve 3
slackware 1
debian 2
osv 1
hackerone 3
altlinux 3
ubuntu 2
seebug 3
prion 3
veracode 2
cve 3
httpd 6
debiancve 3
checkpoint_advisories 3
ibm 6
cisco 1
mageia 1
kaspersky 2
gentoo 1
suse 1
oracle 1
nessus
nessus
Amazon Linux AMI : httpd (ALAS-2013-193)
2013-09-04 00:00:00
CentOS 5 / 6 : httpd (CESA-2013:0815)
2013-05-14 00:00:00
RHEL 5 / 6 : httpd (RHSA-2013:0815)
2013-05-14 00:00:00
oraclelinux
oraclelinux
httpd security update
2013-05-13 00:00:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2013-193)
2015-09-08 00:00:00
CentOS Update for httpd CESA-2013:0815 centos6
2013-05-17 00:00:00
CentOS Update for httpd CESA-2013:0815 centos5
2013-05-17 00:00:00
redhat
redhat
(RHSA-2013:0815) Moderate: httpd security update
2013-05-13 00:00:00
(RHSA-2013:1207) Moderate: Red Hat JBoss Enterprise Application Platform 6.1.1 update
2013-09-04 00:00:00
(RHSA-2013:1208) Moderate: Red Hat JBoss Enterprise Application Platform 6.1.1 update
2013-09-04 00:00:00
amazon
amazon
Medium: httpd24
2013-05-24 13:57:00
Medium: httpd
2013-05-24 13:56:00
Medium: httpd24
2013-03-26 21:29:00
centos
centos
httpd, mod_ssl security update
2013-05-13 22:32:03
f5
f5
SOL15865 - Apache HTTP server vulnerability CVE-2012-4558
2014-11-25 00:00:00
SOL15900 - Apache HTTP server vulnerability CVE-2012-3499
2014-12-10 00:00:00
K15900 : Apache HTTP server vulnerability CVE-2012-3499
2014-12-11 00:00:00
freebsd
freebsd
apache22 -- several vulnerabilities
2012-10-07 00:00:00
apache22 -- several vulnerabilities
2013-06-21 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: httpd-2.4.4-2.fc18
2013-04-01 03:30:25
securityvulns
securityvulns
[ MDVSA-2013:015 ] apache
2013-03-02 00:00:00
Apache security vulnerabilities
2013-03-02 00:00:00
Apache security vulnerabilities
2013-07-15 00:00:00
ubuntucve
ubuntucve
CVE-2012-4558
2013-02-26 00:00:00
CVE-2012-3499
2013-02-26 00:00:00
CVE-2013-1862
2013-06-10 00:00:00
slackware
slackware
httpd
2013-03-03 15:02:33
debian
debian
[SECURITY] [DSA 2637-1] apache2 security update
2013-03-04 21:34:32
[SECURITY] [DSA 2637-1] apache2 security update
2013-03-04 21:34:32
osv
osv
apache2 - several
2013-03-04 00:00:00
hackerone
hackerone
Marktplaats: Multiple Apache 2.2.22 Vulnerabilities (XSS/ Code Exec/ DoS)
2015-06-09 17:47:58
Pornhub: SSRF & XSS (W3 Total Cache)
2016-05-14 01:22:59
U.S. Dept Of Defense: Out-of-date Version (Apache)
2016-11-24 15:09:27
altlinux
altlinux
Security fix for the ALT Linux 10 package apache2 version 2.2.24-alt1
2013-04-14 00:00:00
Security fix for the ALT Linux 9 package apache2 version 2.2.24-alt1
2013-04-14 00:00:00
Security fix for the ALT Linux 8 package apache2 version 2.2.24-alt1
2013-04-14 00:00:00
ubuntu
ubuntu
Apache HTTP Server vulnerabilities
2013-03-18 00:00:00
Apache HTTP Server vulnerabilities
2013-07-15 00:00:00
seebug
seebug
Apache HTTP Server多个模块主机名和URI跨站脚本漏洞
2013-02-28 00:00:00
Apache HTTP Server balancer_handler函数跨站脚本漏洞(CVE-2012-4558)
2013-02-28 00:00:00
Apache HTTP Server日志内终端转义序列命令注入漏洞
2013-05-17 00:00:00
prion
prion
Cross site scripting
2013-02-26 16:55:00
Cross site scripting
2013-02-26 16:55:00
Command injection
2013-06-10 17:55:00
veracode
veracode
Cross-site Scripting (XSS)
2019-01-15 08:52:43
Remote Code Execution (RCE)
2019-01-15 08:57:06
cve
cve
CVE-2012-3499
2013-02-26 16:55:00
CVE-2012-4558
2013-02-26 16:55:00
CVE-2013-1862
2013-06-10 17:55:00
httpd
httpd
Apache Httpd < 2.4.4 : XSS due to unescaped hostnames
2012-07-11 00:00:00
Apache Httpd < 2.2.24 : XSS due to unescaped hostnames
2012-07-11 00:00:00
Apache Httpd < 2.4.4 : XSS in mod_proxy_balancer
2012-10-07 00:00:00
debiancve
debiancve
CVE-2012-4558
2013-02-26 16:55:00
CVE-2012-3499
2013-02-26 16:55:00
CVE-2013-1862
2013-06-10 17:55:00
checkpoint_advisories
checkpoint_advisories
Apache HTTPD mod_proxy_balancer Cross Site Scripting (CVE-2012-4558)
2013-03-24 00:00:00
Apache HTTP Server mod_rewrite RewriteLog Command Execution (CVE-2013-1862)
2013-09-09 00:00:00
Apache HTTP Server mod_rewrite RewriteLog Command Execution - Ver2 (CVE-2013-1862)
2015-03-26 00:00:00
ibm
ibm
Security Bulletin: Potential Security exposure in IBM HTTP Server CVE-2013-1862 PM87808
2022-09-25 23:13:40
Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.7
2022-09-25 21:06:56
Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.31
2018-06-15 06:59:10
cisco
cisco
Apache HTTP Server mod_rewrite Log File Manipulation Vulnerability
2013-05-30 19:48:16
mageia
mageia
Updated apache packages fix security vulnerabilities
2013-06-19 14:11:42
kaspersky
kaspersky
KLA10068 Multiple vulnerabilities in Apache httpd
2013-07-22 00:00:00
KLA10065 Multiple vulnerabilities in Apache httpd
2013-07-22 00:00:00
gentoo
gentoo
Apache HTTP Server: Multiple vulnerabilities
2013-09-23 00:00:00
suse
suse
Security update for apache2 (important)
2014-09-02 21:04:17
oracle
oracle
Oracle Critical Patch Update - January 2014
2014-01-14 00:00:00

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON
Related for VERACODE:14163
nessus56oraclelinux1openvas31redhat8amazon4centos1f58freebsd2fedora1securityvulns7ubuntucve3slackware1debian2osv1hackerone3altlinux3ubuntu2seebug3prion3veracode2cve3httpd6debiancve3checkpoint_advisories3ibm6cisco1mageia1kaspersky2gentoo1suse1oracle1