Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 48

Export CSV
CVE-2003-0083

security flaw

Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.

CVSS 2.0 · 5.0 Medium EPSS 19.2% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Linux Rhel Stronghold and 1 more
CVE-2003-0131

security flaw

The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack."

CVSS 2.0 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Linux and 1 more
CVE-2003-0147

security flaw

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal).

CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed
Vendors
Openpkg Openssl Redhat and 1 more
Products
Openpkg Openssl Enterprise Linux and 3 more
CVE-2003-0192

security flaw

Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.

CVSS 2.0 · 6.4 Medium EPSS 6.0% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Linux and 2 more
CVE-2003-0542

security flaw

Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.

CVSS 2.0 · 7.2 High EPSS 30.4% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Linux and 2 more
CVE-2003-0543

CAN-2003-0543/0544 OpenSSL ASN.1 protocol crashes

Integer overflow in OpenSSL 0.9.6 and 0.9.7 allows remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.

CVSS 2.0 · 5.0 Medium EPSS 27.4% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Linux and 1 more
CVE-2003-0544

CAN-2003-0543/0544 OpenSSL ASN.1 protocol crashes

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service (crash) via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.

CVSS 2.0 · 5.0 Medium EPSS 6.9% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Linux and 1 more
CVE-2004-0079

security flaw

The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference.

CVSS 3.1 · 7.5 High EPSS 9.5% KEV · Not listed
Vendors
4d Apple Avaya and 20 more
Products
Webstar Mac Os X Mac Os X Server and 64 more
CVE-2004-0081

security flaw

OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool.

CVSS 2.0 · 5.0 Medium EPSS 7.2% KEV · Not listed
Vendors
4d Apple Avaya and 20 more
Products
Webstar Mac Os X Mac Os X Server and 64 more
CVE-2004-0174

security flaw

Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."

CVSS 3.1 · 7.5 High EPSS 11.5% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Stronghold
CVE-2004-0488

mod_ssl ssl_util_uuencode_binary CA issue

Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.

CVSS 2.0 · 7.5 High EPSS 37.7% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Http Server Debian Linux Enterprise Linux and 5 more
CVE-2004-0594

security flaw

The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.

CVSS 2.0 · 5.1 Medium EPSS 54.9% KEV · Not listed
Vendors
Avaya Debian Hp and 4 more
Products
Converged Communications Server Debian Linux Hp-ux and 6 more
CVE-2004-0595

security flaw

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

CVSS 2.0 · 6.8 Medium EPSS 45.2% KEV · Not listed
Vendors
Avaya Php Redhat and 1 more
Products
Converged Communications Server Integrated Management S8300 and 8 more
CVE-2004-0700

mod_proxy hook format string

Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.

CVSS 2.0 · 7.5 High EPSS 5.8% KEV · Not listed
Vendors
Gentoo Mod Ssl Redhat
Products
Linux Mod Ssl Enterprise Linux and 2 more
CVE-2004-0885

mod_ssl SSLCipherSuite bypass

The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.

CVSS 2.0 · 7.5 High EPSS 15.4% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Network Proxy and 3 more
CVE-2004-0940

httpd mod_include SSI overflow

Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.

CVSS 3.1 · 7.8 High EPSS 4.8% KEV · Not listed
Vendors
Apache Hp Openpkg and 4 more
Products
Http Server Hp-ux Openpkg and 6 more
CVE-2004-1018

security flaw

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.

CVSS 2.0 · 10.0 Critical EPSS 16.2% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Enterprise Linux and 2 more
CVE-2004-1019

security flaw

The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.

CVSS 2.0 · 10.0 Critical EPSS 8.0% KEV · Not listed
Vendors
Openpkg Php Redhat and 2 more
Products
Openpkg Php Enterprise Linux and 4 more