HS
Web Server
HTTP Server
On CISA KEVExploited in the wildRansomware-linked
351
CVEs
5
On KEV
9.8
Max CVSS
20
New 30D
Severity mix
Critical 33High 93Medium 43Low 1
Watch
Add HTTP Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2007-1742 | – | Apr 13 | suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to… Affected: 2.2.3 |
| CVE-2007-1741 | – | Apr 13 | Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute… Affected: 2.2.3 |
| CVE-2007-0450 | – | Mar 16 | Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk),… Affected: All versions, or not specified |
| CVE-2007-0086 | – | Jan 5 | The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a… Affected: All versions, or not specified |
| CVE-2006-4154 | – | Oct 16 | Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not… Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.28; 2.0.32; +34 more |
| CVE-2006-4110 | – | Aug 14 | Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass… Affected: 2.0.58; 2.2.2; 2.2.3 |
| CVE-2006-3747 | – | Jul 28 | Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is… Affected: 1.3.28 before 1.3.37; 2.0.46 before 2.0.59; 2.2.0 before 2.2.3 |
| CVE-2006-3918 | – | Jul 28 | http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not… Affected: 1.3.3 before 1.3.35 |
| CVE-2005-3357 | – | Dec 31 | mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service… Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.32; 2.0.35; +20 more |
| CVE-2005-3352 | – | Dec 13 | Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject… Affected: before 1.3.35; 2.0 before 2.0.56; 2.2 |
| CVE-2005-2970 | – | Oct 25 | Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections,… Affected: 2.0.36 before 2.0.55 |
| CVE-2005-2700 | – | Sep 6 | ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require"… Affected: 2.0.35 before 2.0.55 |
| CVE-2005-2728 | – | Aug 30 | The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.32; 2.0.35; +18 more |
| CVE-2005-1268 | – | Aug 5 | Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of… Affected: 2.0.35 through 2.0.54 |
| CVE-2005-2088 | – | Jul 5 | The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall… Affected: 2.0.35 before 2.0.55 |
| CVE-2005-1344 | – | May 2 | Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument Affected: 2.0.52 |
| CVE-2004-0942 | – | Feb 9 | Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines… Affected: through 2.0.52 |
| CVE-2004-2343 | – | Dec 31 | Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an… Affected: through 2.0.47 |
| CVE-2004-1387 | – | Dec 31 | The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files Affected: 1.3.31 |
| CVE-2004-0811 | – | Dec 31 | Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the… Affected: 2.0.51 |
| CVE-2004-0263 | – | Nov 23 | PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different… Affected: 1.0; 1.0.2; 1.0.3; 1.0.5; 1.1; 1.1.1; +34 more |
| CVE-2004-0885 | – | Nov 3 | The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended… Affected: 2.0.35; 2.0.36; 2.0.37; 2.0.38; 2.0.39; 2.0.40; +12 more |
| CVE-2004-0786 | – | Oct 20 | The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as… Affected: 2.0.35 before 2.0.51 |
| CVE-2004-0748 | – | Oct 20 | mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child… Affected: 2.0.35 before 2.0.51 |
| CVE-2004-0751 | – | Oct 20 | The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service… Affected: 2.0.44 before 2.0.51 |
| CVE-2004-0809 | – | Sep 16 | The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location… Affected: 2.0.35 before 2.0.51 |
| CVE-2004-0493 | – | Aug 6 | The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error… Affected: 2.0.47; 2.0.48; 2.0.49 |
| CVE-2004-0492 | – | Aug 6 | Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute… Affected: 1.3.26; 1.3.27; 1.3.28; 1.3.29; 1.3.31 |
| CVE-2004-0488 | – | Jul 7 | Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote… Affected: 2.0.35 before 2.0.50 |
| CVE-2004-0173 | – | Apr 15 | Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL… Affected: 0.8.11; 0.8.14; 1.0; 1.0.2; 1.0.3; 1.0.5; +5 more |
| CVE-2004-0113 | – | Mar 29 | Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL… Affected: 2.0.35; 2.0.36; 2.0.37; 2.0.38; 2.0.39; 2.0.40; +8 more |
| CVE-2003-0993 | – | Mar 29 | mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow… Affected: 1.3; 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.7; +16 more |
| CVE-2004-1834 | – | Mar 20 | mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive… Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.32; 2.0.35; +14 more |
| CVE-2003-0987 | – | Mar 3 | mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret Affected: through 1.3.30 |
| CVE-2004-1082 | – | Feb 3 | mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials Affected: 1.3; 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.7; +16 more |
| CVE-2003-1418 | – | Dec 31 | Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2)… Affected: 1.3.22; 1.3.23; 1.3.24; 1.3.25; 1.3.26; 1.3.27 |
| CVE-2003-1307 | – | Dec 31 | The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file… Affected: 2.0; 2.0.9; 2.0.28; 2.0.28; 2.0.28; 2.0.32; +17 more |
| CVE-2003-0789 | – | Nov 3 | mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong… Affected: 2.0.35 before 2.0.48 |
| CVE-2003-0542 | – | Nov 3 | Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service… Affected: 1.3; 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.9; +30 more |
| CVE-2003-0460 | – | Aug 27 | The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could… Affected: through 1.3.27 |
| CVE-2003-0253 | – | Aug 18 | The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service Affected: 2.0; 2.0.28; 2.0.32; 2.0.35; 2.0.36; 2.0.37; +9 more |
| CVE-2003-0254 | – | Aug 18 | Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an… Affected: 2.0; 2.0.28; 2.0.32; 2.0.35; 2.0.36; 2.0.37; +9 more |
| CVE-2003-0192 | – | Aug 18 | Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive… Affected: 2.0; 2.0.28; 2.0.32; 2.0.35; 2.0.36; 2.0.37; +9 more |
| CVE-2003-0245 | – | Jun 9 | Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service… Affected: 2.0.37; 2.0.38; 2.0.39; 2.0.40; 2.0.41; 2.0.42; +3 more |
| CVE-2003-0189 | – | Jun 9 | The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers… Affected: 2.0.40; 2.0.41; 2.0.42; 2.0.43; 2.0.44; 2.0.45 |
| CVE-2003-0134 | – | Apr 11 | Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device… Affected: 2.0; 2.0.9; 2.0.28; 2.0.32; 2.0.35; 2.0.36; +9 more |
| CVE-2003-0132 | – | Apr 11 | A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache… Affected: 2.0.0 through 2.0.44 |
| CVE-2003-0083 | – | Apr 2 | Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert… Affected: 1.3.0 before 1.3.26; 2.0.0 before 2.0.46 |
| CVE-2003-0020 | – | Mar 18 | Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing… Affected: 1.3.0 before 1.3.31; 2.0.0 before 2.0.49 |
| CVE-2003-0017 | – | Feb 7 | Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes… Affected: 2.0.36; 2.0.37; 2.0.38; 2.0.39; 2.0.40; 2.0.41; +2 more |