HS
Web Server
HTTP Server
On CISA KEVExploited in the wildRansomware-linked
351
CVEs
5
On KEV
9.8
Max CVSS
20
New 30D
Severity mix
Critical 33High 93Medium 43Low 1
Watch
Add HTTP Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-3639 | – | Nov 30 | The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of… Affected: 2.0.11; 2.0.12; 2.0.13; 2.0.14; 2.0.15; 2.0.16; +34 more |
| CVE-2011-4415 | – | Nov 8 | The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the… Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.32; 2.0.32; +34 more |
| CVE-2011-3607 | – | Nov 8 | Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled,… Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.32; 2.0.32; +34 more |
| CVE-2011-3368 | – | Oct 5 | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2)… Affected: 1.3; 1.3.0; 1.3.1; 1.3.1.1; 1.3.2; 1.3.3; +34 more |
| CVE-2011-3348 | – | Sep 20 | The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service… Affected: 2.2.12 through 2.2.20 |
| CVE-2011-3192 | – | Aug 29 | The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU… Affected: 2.0.35 before 2.0.65; 2.2.0 before 2.2.20 |
| CVE-2011-1928 | – | May 24 | The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a… Affected: 2.2.18 |
| CVE-2011-0419 | – | May 16 | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18,… Affected: 2.0.0 through 2.0.65; 2.2.0 through 2.2.18 |
| CVE-2010-1623 | – | Oct 4 | Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.17 |
| CVE-2010-2791 | – | Aug 5 | mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent… Affected: 2.2.9 |
| CVE-2010-1452 | – | Jul 28 | The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.16 |
| CVE-2010-2068 | – | Jun 18 | mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving… Affected: 2.2.9; 2.2.10; 2.2.11; 2.2.12; 2.2.13; 2.2.14; +3 more |
| CVE-2010-1151 | – | Apr 20 | Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to… Affected: All versions, or not specified |
| CVE-2010-0434 | – | Mar 5 | The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.15 |
| CVE-2010-0425 | – | Mar 5 | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure… Affected: 2.0.37 before 2.0.64; 2.2.0 before 2.2.15; 2.3.0 before 2.3.7 |
| CVE-2010-0408 | – | Mar 5 | The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client… Affected: 2.2; 2.2.0; 2.2.2; 2.2.3; 2.2.4; 2.2.6; +6 more |
| CVE-2003-1581 | – | Feb 5 | The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in… Affected: 2.0.44 |
| CVE-2003-1580 | – | Feb 5 | The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved… Affected: 2.0.44 |
| CVE-2010-0010 | – | Feb 2 | Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to… Affected: through 1.3.41; 0.8.11; 0.8.14; 1.0; 1.0.3; 1.0.5; +34 more |
| CVE-2009-3560 | – | Dec 4 | The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.17 |
| CVE-2009-3720 | – | Nov 3 | The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.17 |
| CVE-2009-3095 | – | Sep 8 | The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.14 |
| CVE-2009-3094 | – | Sep 8 | The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.14 |
| CVE-2009-1891 | – | Jul 10 | The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.12 |
| CVE-2009-1890 | – | Jul 5 | The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an… Affected: 2.2.0 before 2.2.12 |
| CVE-2009-1956 | – | Jun 8 | Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a… Affected: 2.2.0 before 2.2.12 |
| CVE-2009-0023 | – | Jun 8 | The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted… Affected: 2.2.0 before 2.2.12 |
| CVE-2009-1195 | – | May 28 | The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.7; +3 more |
| CVE-2009-1191 | – | Apr 23 | mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier… Affected: 2.2.11 |
| CVE-2008-2939 | – | Aug 6 | Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9… Affected: through 2.0.63; 2.2.0 through 2.2.9 |
| CVE-2008-2364 | – | Jun 13 | The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim… Affected: 2.0.35 before 2.0.64; 2.2.0 before 2.2.9 |
| CVE-2008-2168 | – | May 13 | Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly… Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.32; 2.0.32; +34 more |
| CVE-2008-0455 | – | Jan 25 | Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and… Affected: 2.2.0 before 2.2.23; 2.4.1 before 2.4.3 |
| CVE-2008-0456 | – | Jan 25 | CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and… Affected: 2.2.0 before 2.2.12 |
| CVE-2007-6423 | – | Jan 12 | Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a… Affected: 2.2.2; 2.2.3; 2.2.4; 2.2.6 |
| CVE-2007-6420 | – | Jan 12 | Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via… Affected: 2.2.0; 2.2.2; 2.2.3; 2.2.4; 2.2.5; 2.2.6; +1 more |
| CVE-2008-0005 | – | Jan 12 | mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site… Affected: 2.0.35 before 2.0.63; 2.2.0 before 2.2.8 |
| CVE-2007-6421 | – | Jan 8 | Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web… Affected: 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.6 |
| CVE-2007-6422 | – | Jan 8 | The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated… Affected: 2.2; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.6 |
| CVE-2007-6388 | – | Jan 8 | Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page… Affected: 1.3.2 through 1.3.39; 2.0.35 through 2.0.61; 2.2.0 through 2.2.6 |
| CVE-2007-6514 | – | Dec 21 | Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files… Affected: 2.2.6; 2.2.6 |
| CVE-2007-5000 | – | Dec 13 | Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the… Affected: 1.3.0 through 1.3.39; 2.0.35 through 2.0.61; 2.2.0 through 2.2.6 |
| CVE-2007-6203 | – | Dec 3 | Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error… Affected: 2.0.46; 2.0.47; 2.0.48; 2.0.49; 2.0.50; 2.0.51; +19 more |
| CVE-2007-3847 | – | Aug 23 | The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching… Affected: 2.0.35 before 2.0.61; 2.2.0 before 2.2.6 |
| CVE-2006-5752 | – | Jun 27 | Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is… Affected: 1.3.2 before 1.3.39; 2.0.0 before 2.0.61; 2.2.0 before 2.2.6 |
| CVE-2007-1863 | – | Jun 27 | cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause… Affected: 2.0.37 before 2.0.61; 2.2.0 before 2.2.6 |
| CVE-2007-3304 | – | Jun 20 | Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to… Affected: 1.3.0 before 1.3.39; 2.0.0 before 2.0.61; 2.2.0 before 2.2.6 |
| CVE-2007-3303 | – | Jun 20 | Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop… Affected: 2.0.59; 2.2.4 |
| CVE-2007-1862 | – | Jun 4 | The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously… Affected: 2.2.4 |
| CVE-2007-1743 | – | Apr 13 | suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities… Affected: 2.2.3 |