CVE-2011-3607

httpd: ap_pregsub Integer overflow to buffer overflow

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

CVSS 2.0 · 4.4 Medium EPSS 4.9% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Jboss Enterprise Web Server

CVE-2011-3375

tomcat: information disclosure due to improper response and request object recycling

Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.

CVSS 2.0 · 5.0 Medium EPSS 6.3% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Jboss Enterprise Web Server

CVE-2011-3368

httpd: reverse web proxy vulnerability

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

CVSS 2.0 · 5.0 Medium EPSS 90.7% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Jboss Enterprise Web Server

CVE-2011-3348

httpd: mod_proxy_ajp remote temporary DoS

The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.

CVSS 2.0 · 4.3 Medium EPSS 22.4% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Enterprise Linux Jboss Enterprise Web Server

CVE-2011-3192

httpd: multiple ranges DoS

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

CVSS 2.0 · 7.8 High EPSS 98.9% KEV · Not listed

Vendors

Apache Canonical Opensuse and 2 more

Products

Http Server Ubuntu Linux Opensuse and 7 more

CVE-2011-3190

tomcat: authentication bypass and information disclosure

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

CVSS 2.0 · 7.5 High EPSS 15.2% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server

CVE-2011-2729

jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed

Vendors

Apache Linux Redhat

Products

Apache Commons Daemon Tomcat Linux Kernel and 1 more

CVE-2011-2526

tomcat: security manager restrictions bypass

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Communications Platform and 6 more

CVE-2011-2204

tomcat: password disclosure vulnerability

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server

CVE-2011-1184

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.

CVSS 2.0 · 5.0 Medium EPSS 8.2% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Communications Platform and 6 more

CVE-2011-0534

tomcat: remote DoS via NIO connector

Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.

CVSS 2.0 · 5.0 Medium EPSS 7.9% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server

CVE-2011-0419

apr: unconstrained recursion in apr_fnmatch

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.

CVSS 2.0 · 4.3 Medium EPSS 30.4% KEV · Not listed

Vendors

Apache Apple Debian and 7 more

Products

Http Server Portable Runtime Mac Os X and 9 more

CVE-2011-0013

tomcat: XSS vulnerability in HTML Manager interface

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.

CVSS 2.0 · 4.3 Medium EPSS 10.0% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server

CVE-2010-4476

JDK Double.parseDouble Denial-Of-Service

The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.

CVSS 2.0 · 5.0 Medium EPSS 23.5% KEV · Not listed

Vendors

Redhat Sun

Products

Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Portal Platform and 9 more

CVE-2010-4180

openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

CVSS 2.0 · 4.3 Medium EPSS 9.5% KEV · Not listed

Vendors

Canonical Debian F5 and 5 more

Products

Ubuntu Linux Debian Linux Nginx and 8 more

CVE-2010-4172

tomcat: cross-site-scripting vulnerability in the manager application

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.

CVSS 2.0 · 4.3 Medium EPSS 42.0% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server

CVE-2010-3718

tomcat: file permission bypass flaw

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.

CVSS 2.0 · 1.2 Low EPSS 1.3% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Web Server

CVE-2010-2227

tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

CVSS 2.0 · 6.4 Medium EPSS 54.8% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2010-2086

MyFaces: XSS via state view

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

CVSS 2.0 · 4.0 Medium EPSS 2.1% KEV · Not listed

Vendors

Apache Redhat

Products

Myfaces Jboss Enterprise Web Server

CVE-2010-2068

(mod_proxy): Sensitive response disclosure due improper handling of timeouts

mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.

CVSS 2.0 · 5.0 Medium EPSS 16.0% KEV · Not listed

Vendors

Apache Ibm Microsoft and 2 more

Products

Http Server Os2 Windows and 2 more