Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 58

Export CSV
CVE-2021-41773

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Cloud Backup and 1 more
CVE-2019-0211

httpd: privilege escalation from modules scripts

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

CVSS 3.1 · 7.8 High EPSS 65.0% KEV · Listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 25 more
CVE-2021-42013

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

CVSS 3.1 · 9.8 Critical EPSS 100.0% KEV · Listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Cloud Backup and 3 more
CVE-2019-0227

axis: Hard coded domain name in example web service named “StockQuoteService.jws” leading to remote code execution.

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

CVSS 3.1 · 7.5 High EPSS 91.9% KEV · Not listed
Vendors
Apache Oracle
Products
Axis Agile Engineering Data Management Agile Product Lifecycle Management and 34 more
CVE-2020-11993

httpd: mod_http2 concurrent pool usage

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

CVSS 3.1 · 7.5 High EPSS 56.6% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 13 more
CVE-2021-39275

ap_escape_quotes buffer overflow

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVSS 3.1 · 9.8 Critical EPSS 39.4% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 4 more
Products
Http Server Debian Linux Fedora and 11 more
CVE-2021-44790

Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

CVSS 3.1 · 9.8 Critical EPSS 96.8% KEV · Not listed
Vendors
Apache Apple Debian and 5 more
Products
Http Server Mac Os X Macos and 17 more
CVE-2016-5425

tomcat: Local privilege escalation via systemd-tmpfiles service

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

CVSS 3.1 · 7.8 High EPSS 3.8% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Tomcat Instantis Enterprisetrack Linux and 7 more
CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 27.0% KEV · Not listed
Vendors
Apache Apple Canonical and 9 more
Products
Http Server Traffic Server Mac Os X and 25 more
CVE-2021-44224

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

CVSS 3.1 · 8.2 High EPSS 82.3% KEV · Not listed
Vendors
Apache Apple Debian and 4 more
Products
Http Server Mac Os X Macos and 12 more
CVE-2021-41524

null pointer dereference in h2 fuzzing

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

CVSS 3.1 · 7.5 High EPSS 25.8% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 2 more
Products
Http Server Fedora Cloud Backup and 2 more
CVE-2021-33503

python-urllib3: ReDoS in the parsing of authority part of URL

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Oracle Python and 1 more
Products
Fedora Enterprise Manager Ops Center Instantis Enterprisetrack and 7 more
CVE-2021-31618

NULL pointer dereference on specially crafted HTTP/2 request

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited to DoS the server. This issue affected mod_http2 1.15.17 and Apache HTTP Server version 2.4.47 only. Apache HTTP Server 2.4.47 was never released.

CVSS 3.1 · 7.5 High EPSS 52.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 1 more
Products
Http Server Debian Linux Fedora and 3 more
CVE-2021-26691

Apache HTTP Server mod_session response handling heap overflow

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVSS 3.1 · 9.8 Critical EPSS 68.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Http Server Debian Linux Fedora and 7 more
CVE-2021-26690

mod_session NULL pointer dereference

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

CVSS 3.1 · 7.5 High EPSS 65.1% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Http Server Debian Linux Fedora and 5 more