HS
Web Server
HTTP Server
On CISA KEVExploited in the wildRansomware-linked
351
CVEs
5
On KEV
9.8
Max CVSS
20
New 30D
Severity mix
Critical 33High 93Medium 43Low 1
Watch
Add HTTP Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2003-0016 | – | Feb 7 | Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP… Affected: 2.0.36; 2.0.37; 2.0.38; 2.0.39; 2.0.40; 2.0.41; +2 more |
| CVE-2002-2012 | – | Dec 31 | Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request Affected: 1.3.19 |
| CVE-2002-2272 | – | Dec 31 | Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP… Affected: 1.3; 1.3.0; 1.3.1; 1.3.2; 1.3.10; 1.3.11; +15 more |
| CVE-2002-2103 | – | Dec 31 | Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows… Affected: 1.3.9; 1.3.11; 1.3.12; 1.3.13; 1.3.14; 1.3.15; +7 more |
| CVE-2002-2029 | – | Dec 31 | PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an… Affected: 1.3.11; 1.3.12; 1.3.13; 1.3.14; 1.3.15; 1.3.16; +4 more |
| CVE-2002-1658 | – | Dec 31 | Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument Affected: 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.9; 1.3.11; +12 more |
| CVE-2002-1233 | – | Nov 4 | A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local… Affected: 1.3.17; 1.3.17; 1.3.18; 1.3.18; 1.3.19; 1.3.19; +13 more |
| CVE-2002-1156 | – | Oct 11 | Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled Affected: 2.0.42 |
| CVE-2002-0840 | – | Oct 11 | Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS… Affected: 1.3; 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.9; +23 more |
| CVE-2002-0843 | – | Oct 11 | Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of… Affected: 1.3; 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.9; +12 more |
| CVE-2002-0839 | – | Oct 11 | The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting… Affected: 1.3.0 before 1.3.27 |
| CVE-2002-1593 | – | Sep 25 | mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of… Affected: 2.0; 2.0.28; 2.0.32; 2.0.35; 2.0.36; 2.0.37; +4 more |
| CVE-2002-0654 | – | Sep 5 | Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the… Affected: 2.0; 2.0.28; 2.0.28; 2.0.28; 2.0.32; 2.0.32; +6 more |
| CVE-2002-0661 | – | Aug 12 | Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via Affected: 2.0; 2.0.28; 2.0.28; 2.0.28; 2.0.32; 2.0.32; +6 more |
| CVE-2002-0392 | – | Jul 3 | Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request… Affected: 1.2.2 through 1.3.24; 2.0.0 through 2.0.36 |
| CVE-2002-0257 | – | May 29 | Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields (1) TITLE, (2)… Affected: 1.3.17; 1.3.18; 1.3.19; 1.3.20; 1.3.22 |
| CVE-2002-0249 | – | May 29 | PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed… Affected: 2.0.28 |
| CVE-2002-0240 | – | May 29 | PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP… Affected: 2.0.28 |
| CVE-2002-1592 | – | May 6 | The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server,… Affected: 2.0; 2.0.28; 2.0.32; 2.0.35 |
| CVE-2002-0061 | – | Mar 21 | Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as… Affected: before 1.3.24; 2.0.0 before 2.0.34 |
| CVE-2001-1534 | – | Dec 31 | mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local… Affected: 1.3.11 through 1.3.20 |
| CVE-2001-1556 | – | Dec 31 | The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide… Affected: 1.3.0 before 1.3.31; 2.0.0 before 2.0.49 |
| CVE-2001-1449 | – | Nov 28 | The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of… Affected: 1.3; 1.3.1; 1.3.3; 1.3.4; 1.3.6; 1.3.9; +5 more |
| CVE-2001-0729 | – | Oct 30 | Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash) characters Affected: 1.3.20 |
| CVE-2001-0730 | – | Oct 30 | split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header Affected: 1.3.20 |
| CVE-2001-0731 | – | Oct 1 | Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string Affected: 1.3.20 |
| CVE-2001-1072 | – | Aug 31 | Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes… Affected: 1.3.14; 1.3.17; 1.3.19 |
| CVE-2001-1342 | – | May 12 | Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash)… Affected: 1.3.12; 1.3.14; 1.3.15; 1.3.16; 1.3.17; 1.3.18; +1 more |
| CVE-2001-0925 | – | Mar 12 | The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains… Affected: 1.3.11; 1.3.12; 1.3.14; 1.3.17 |
| CVE-2001-0131 | – | Mar 12 | htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack Affected: 1.3.14; 2.0 |
| CVE-2001-0042 | – | Feb 16 | PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified Affected: 1.3 |
| CVE-2000-0913 | – | Dec 19 | mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular… Affected: 0.8.11; 0.8.14; 1.0; 1.0.2; 1.0.3; 1.0.5; +4 more |
| CVE-2000-0869 | – | Nov 14 | The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP request method Affected: 1.3.12 |
| CVE-2000-0868 | – | Nov 14 | The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with… Affected: 1.3.12 |
| CVE-2000-1204 | – | Oct 13 | Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin… Affected: 1.3.9; 1.3.11; 1.3.12 |
| CVE-2000-0505 | – | May 31 | The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters Affected: 1.3.6; 1.3.9; 1.3.11; 1.3.12 |
| CVE-2000-1205 | – | Feb 1 | Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl),… Affected: 1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 1.3.5; +6 more |
| CVE-1999-1293 | – | Dec 31 | mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core Affected: through 1.2.5 |
| CVE-1999-0289 | – | Dec 12 | The Apache web server for Win32 may provide access to restricted files when a Affected: All versions, or not specified |
| CVE-1999-1053 | – | Sep 13 | guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when… Affected: 1.3.9 |
| CVE-1999-0926 | – | Sep 3 | Apache allows remote attackers to conduct a denial of service via a large number of MIME headers Affected: 1.2.5 |
| CVE-2000-1206 | – | Aug 20 | Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve… Affected: 1.3.9; 1.3.10 |
| CVE-1999-1237 | – | Jun 6 | Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary… Affected: All versions, or not specified |
| CVE-1999-1412 | – | Jun 3 | A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to… Affected: All versions, or not specified |
| CVE-1999-0678 | – | Jan 17 | A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server Affected: All versions, or not specified |
| CVE-1999-1199 | – | Aug 7 | Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the… Affected: through 1.3.1 |
| CVE-1999-0107 | – | Dec 30 | Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters Affected: 0.8.11; 0.8.14; 1.0; 1.0.2; 1.0.3; 1.0.5; +3 more |
| CVE-1999-0071 | – | Sep 1 | Apache httpd cookie buffer overflow for versions 1.1.1 and earlier Affected: 1.1.1 |
| CVE-1999-0045 | – | Dec 10 | List of arbitrary files on Web host via nph-test-cgi script Affected: 0.8.11; 0.8.14; 1.0; 1.0.2; 1.0.3; 1.0.5; +1 more |
| CVE-1999-0070 | – | Apr 1 | test-cgi program allows an attacker to list files on the server Affected: before 1.3.0 |