VYPR
← Apache

Vendor CVEs

Apache

All CVEs

3,418 total · sorted by risk
  • CVE-2008-2370Aug 4, 2008
    Apache
    Tomcat
    risk 0.07cvss —epss 0.53

    Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read…

  • CVE-2008-2168May 13, 2008
    Apache
    Apache
    risk 0.07cvss —epss 0.55

    Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.

  • CVE-2007-3101Jun 18, 2007
    Apache
    Myfaces Tomahawk
    risk 0.07cvss —epss 0.44

    Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.

  • CVE-2006-3835Jul 25, 2006
    Apache
    Tomcat
    risk 0.07cvss —epss 0.46

    Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.

  • CVE-2004-0942Feb 9, 2005
    Apache
    HTTP Server
    risk 0.07cvss —epss 0.55

    Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.

  • CVE-2003-0042Feb 7, 2003
    Apache
    Tomcat
    risk 0.07cvss —epss 0.46

    Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

  • CVE-2000-0869Nov 14, 2000
    Apache
    HTTP Server
    risk 0.07cvss —epss 0.51

    The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method.

  • CVE-2000-0505May 31, 2000
    Apache
    HTTP Server
    risk 0.07cvss —epss 0.47

    The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.

  • CVE-1999-0067Mar 20, 1996
    Apache
    HTTP Server
    risk 0.07cvss —epss 0.87

    phf CGI program allows remote command execution through shell metacharacters.

  • CVE-2022-23944CriJan 25, 2022
    Apache
    ShenYu
    risk 0.06cvss 9.1epss 0.79

    User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

  • CVE-2020-27223MedFeb 26, 2021
    Eclipse
    Jetty
    risk 0.06cvss 5.2epss 0.78

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU…

  • CVE-2011-4367Jun 19, 2014
    Apache
    Myfaces
    risk 0.06cvss —epss 0.33

    Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2)…

  • CVE-2013-2160Aug 19, 2013
    Apache
    Cxf
    risk 0.06cvss —epss 0.32

    The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs,…

  • CVE-2013-2088Jul 31, 2013
    Apache
    Subversion
    risk 0.06cvss —epss 0.31

    contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.

  • CVE-2012-0840Feb 10, 2012
    Apache
    Portable Runtime
    risk 0.06cvss —epss 0.43

    tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to…

  • CVE-2012-1007Feb 7, 2012
    Apache
    Struts
    risk 0.06cvss —epss 0.34

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or…

  • CVE-2011-1772May 13, 2011
    Apache
    Struts
    risk 0.06cvss —epss 0.33

    Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an…

  • CVE-2010-2103May 27, 2010
    Apache
    Axis2
    risk 0.06cvss —epss 0.35

    Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers…

  • CVE-2008-6504Mar 23, 2009
    Apache
    Struts
    risk 0.06cvss —epss 0.36

    ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language…

  • CVE-2007-6258Feb 19, 2008
    Apache
    mod_jk2
    risk 0.06cvss —epss 0.41

    Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.

  • CVE-2007-6388Jan 8, 2008
    Apache
    HTTP Server
    risk 0.06cvss —epss 0.76

    Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2007-6514Dec 21, 2007
    Apache
    HTTP Server
    risk 0.06cvss —epss 0.38

    Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType…

  • CVE-2007-3382Aug 14, 2007
    Apache
    Tomcat
    risk 0.06cvss —epss 0.38

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session…

  • CVE-2006-4110Aug 14, 2006
    Apache
    HTTP Server
    risk 0.06cvss —epss 0.39

    Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file…

  • CVE-2006-0254Jan 18, 2006
    Apache
    Geronimo
    risk 0.06cvss —epss 0.32

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log…

  • CVE-2003-0866Nov 17, 2003
    Apache
    Tomcat
    risk 0.06cvss —epss 0.33

    The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

  • CVE-2002-2007Dec 31, 2002
    Apache
    Tomcat
    risk 0.06cvss —epss 0.41

    The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3)…

  • CVE-1999-1412Jun 3, 1999
    Apache
    HTTP Server
    risk 0.06cvss —epss 0.35

    A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.

  • CVE-1999-0678Jan 17, 1999
    Apache
    Apache
    risk 0.06cvss —epss 0.31

    A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.

  • CVE-2013-5704Apr 15, 2014
    Apache
    HTTP Server
    risk 0.05cvss —epss 0.60

    The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as…

  • CVE-2013-0177Jan 30, 2014
    Apache
    Ofbiz
    risk 0.05cvss —epss 0.21

    Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1)…

  • CVE-2011-5057Jan 8, 2012
    Apache
    Struts
    risk 0.05cvss —epss 0.29

    Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that…

  • CVE-2011-0419May 16, 2011
    Apache
    HTTP Server
    risk 0.05cvss —epss 0.30

    Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris…

  • CVE-2010-0432Apr 15, 2010
    Apache
    Ofbiz
    risk 0.05cvss —epss 0.23

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to…

  • CVE-2009-1523May 5, 2009
    Apache
    Jetty
    risk 0.05cvss —epss 0.26

    Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.

  • CVE-2009-0796Apr 7, 2009
    Apache
    Mod Perl
    risk 0.05cvss —epss 0.30

    Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2005-4703Dec 31, 2005
    Apache
    Tomcat
    risk 0.05cvss —epss 0.26

    Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.

  • CVE-2005-3745Nov 22, 2005
    Apache
    Struts
    risk 0.05cvss —epss 0.26

    Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.

  • CVE-2003-1172Dec 31, 2003
    Apache
    Cocoon
    risk 0.05cvss —epss 0.31

    Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.

  • CVE-2002-1567Oct 6, 2003
    Apache
    Tomcat
    risk 0.05cvss —epss 0.27

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.

  • CVE-2002-2006Dec 31, 2002
    Apache
    Tomcat
    risk 0.05cvss —epss 0.31

    The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

  • CVE-2002-2029Dec 31, 2002
    PHP
    PHP
    risk 0.05cvss —epss 0.25

    PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.

  • CVE-2002-0936Oct 4, 2002
    Apache
    Tomcat
    risk 0.05cvss —epss 0.27

    The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).

  • CVE-2000-0759Oct 20, 2000
    Apache
    Tomcat
    risk 0.05cvss —epss 0.26

    Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.

  • CVE-1999-0448Jan 1, 1999
    Apache
    HTTP Server
    risk 0.05cvss —epss 0.25

    IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.

  • CVE-1999-0045Dec 10, 1996
    Netscape
    Enterprise Server
    risk 0.05cvss —epss 0.26

    List of arbitrary files on Web host via nph-test-cgi script.

  • CVE-2021-33035HigSep 23, 2021
    Apache
    Openoffice
    risk 0.04cvss 7.8epss 0.51

    Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document…

  • CVE-2021-33193HigAug 16, 2021
    Apache
    HTTP Server
    risk 0.04cvss 7.5epss 0.46

    A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

  • CVE-2014-0231Jul 20, 2014
    Apache
    HTTP Server
    risk 0.04cvss —epss 0.44

    The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.

  • CVE-2014-0114Apr 30, 2014
    Apache
    Struts
    risk 0.04cvss —epss 0.96

    Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader…

Page 54 of 69