HS
Product
Http Server
On CISA KEVExploited in the wildRansomware-linked
111
CVEs
4
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 25High 36Medium 20Low 4
Watch
Add Http Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1967 | 7.5 | Apr 21 | Segmentation fault in SSL_check_chain Affected: 12.2.1.4.0 |
| CVE-2018-20843 | 7.5 | Jun 24 | In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources… Affected: 12.1.3.0; 12.2.1.4.0 |
| CVE-2019-0217 | 7.5 | Apr 8 | In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate… Affected: 12.2.1.3.0 |
| CVE-2018-16890 | 7.5 | Feb 6 | libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read Affected: 12.2.1.3.0 |
| CVE-2019-3823 | 7.5 | Feb 6 | libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP Affected: 12.2.1.3.0 |
| CVE-2009-1955 | 7.5 | Jun 8 | The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows… Affected: All versions, or not specified |
| CVE-2019-10097 | 7.2 | Sep 26 | In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could… Affected: 12.2.1.4.0 |
| CVE-2022-21593 | 7.1 | Oct 18 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans) Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2021-43818 | 7.1 | Dec 13 | lxml is a library for processing XML and HTML in the Python language Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2021-35940 | 7.1 | Aug 23 | An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613) Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2021-41617 | 7.0 | Sep 26 | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as… Affected: 12.2.1.2.0; 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2022-25313 | 6.5 | Feb 18 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2020-24977 | 6.5 | Sep 3 | GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2020-2952 | 6.5 | Apr 15 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener) Affected: 11.1.1.9.0 |
| CVE-2020-2530 | 6.1 | Jan 15 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener) Affected: 11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0 |
| CVE-2021-35666 | 5.9 | Oct 20 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module) Affected: 11.1.1.9.0 |
| CVE-2020-1971 | 5.9 | Dec 8 | The X.509 GeneralName type is a generic type for representing different types of names Affected: 12.2.1.4.0 |
| CVE-2019-2751 | 5.9 | Jul 23 | Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OHS Config MBeans) Affected: 12.1.3.0.0; 12.2.1.3.0 |
| CVE-2018-2760 | 5.9 | Apr 19 | Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module) Affected: 12.1.3; 12.2.1.2 |
| CVE-2013-2566 | 5.9 | Mar 15 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via… Affected: 11.1.1.7.0; 11.1.1.9.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0 |
| CVE-2022-21375 | 5.5 | Jan 19 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel) Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2021-4183 | 5.5 | Dec 30 | Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2021-2315 | 5.4 | Apr 22 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener) Affected: 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2025-21498 | 5.3 | Jan 21 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core) Affected: 12.2.1.4.0 |
| CVE-2024-20991 | 5.3 | Apr 16 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener) Affected: 12.2.1.4.0 |
| CVE-2022-21271 | 5.3 | Jan 19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries) Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2021-25219 | 5.3 | Oct 27 | In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0… Affected: 12.2.1.3.0; 12.2.1.4.0 |
| CVE-2020-2545 | 5.3 | Jan 15 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module) Affected: 11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0 |
| CVE-2018-2561 | 5.3 | Jan 18 | Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener) Affected: 11.1.1.7.0; 11.1.1.9.0; 12.1.3.0.0; 12.2.1.2.0; 12.2.1.3.0 |
| CVE-2015-3195 | 5.3 | Dec 6 | The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors… Affected: 11.5.10.2 |
| CVE-2019-0197 | 4.2 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38 Affected: 12.2.1.3.0 |
| CVE-2021-2480 | 3.7 | Oct 20 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener) Affected: 11.1.1.9.0 |
| CVE-2016-3482 | 3.7 | Jul 21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 and 12.1.3.0 allows remote attackers to affect confidentiality via vectors… Affected: 11.1.1.9; 12.1.3.0 |
| CVE-2016-0671 | 3.7 | Apr 21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via vectors related to OSSL… Affected: 12.1.2.0 |
| CVE-2015-2808 | 3.7 | Apr 1 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for… Affected: 11.1.1.7.0; 11.1.1.9.0; 12.1.3.0.0; 12.2.1.1.0; 12.2.1.2.0 |
| CVE-2014-0226 | – | Jul 20 | Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly… Affected: 10.1.3.5.0; 11.1.1.7.0; 12.1.2.0; 12.1.3.0 |
| CVE-2013-5704 | – | Apr 15 | The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent… Affected: 10.1.3.5.0; 11.1.1.7.0; 12.1.2.0; 12.1.3.0 |
| CVE-2014-0098 | – | Mar 18 | The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation… Affected: 10.1.3.5.0; 11.1.1.7.0; 12.1.2.0; 12.1.3.0 |
| CVE-2013-6438 | – | Mar 18 | The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections,… Affected: 10.1.3.5.0; 11.1.1.7.0; 12.1.2.0; 12.1.3.0 |
| CVE-2013-1862 | – | Jun 10 | mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow… Affected: 10.1.3.5.0; 11.1.1.7.0; 12.1.2.0; 12.1.3.0 |
| CVE-2012-2751 | – | Jul 22 | ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a… Affected: 11.1.1.6.0 |
| CVE-2010-0425 | – | Mar 5 | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure… Affected: 10.1.3.5.0 |
| CVE-2007-5000 | – | Dec 13 | Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the… Affected: 10.1.3.5.0 |
| CVE-2007-0279 | – | Jan 17 | Multiple unspecified vulnerabilities in Oracle HTTP Server 9.2.0.8 and Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, aka (1) OHS01,… Affected: 9.2.0.8 |
| CVE-2007-0280 | – | Jan 17 | Unspecified vulnerability in Oracle HTTP Server 9.0.1.5, Application Server 9.0.4.3, 10.1.2.0.0, 10.1.2.0.2, and 10.1.2.2; and Collaboration Suite 9.0.4.2 and 10.1.2; has unknown… Affected: 9.0.1.5 |
| CVE-2007-0281 | – | Jan 17 | Multiple unspecified vulnerabilities in Oracle HTTP Server 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.0, 10.1.2.0.1, 10.1.2.0.2, 10.1.2.1, and… Affected: 9.0.1.5 |
| CVE-2007-0282 | – | Jan 17 | Unspecified vulnerability in Oracle HTTP Server 9.0.1.5, Application Server 9.0.4.2 and 10.1.2.0.0, and Collaboration Suite 9.0.4.2 has unknown impact and attack vectors related… Affected: 9.0.1.5 |
| CVE-2006-5348 | – | Oct 18 | Unspecified vulnerability in Oracle HTTP Server 9.2.0.7, Oracle Collaboration Suite 9.0.4.2, and Oracle E-Business Suite and Applications 11.5.10CU2 has unknown impact and remote… Affected: 9.2.0.7 |
| CVE-2006-5347 | – | Oct 18 | Unspecified vulnerability in Oracle HTTP Server 9.2.0.7 and Oracle Collaboration Suite 9.0.4.2 has unknown impact and remote attack vectors related to HTTPS and SSL, aka Vuln#… Affected: 9.2.0.7 |
| CVE-2006-5346 | – | Oct 18 | Unspecified vulnerability in Oracle HTTP Server 9.2.0.7, as used in Oracle Collaboration Suite 9.0.4.2 and Oracle E-Business Suite and Applications 11.5.10CU2, has unknown impact… Affected: 9.2.0.7 |