Apache
Page 36 of 36 — Apache CVEs from a corpus of 3575, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2003-0017 | | 2003-02-07 | Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such… | |
CVE-2003-0016 | | 2003-02-07 | Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary… | |
CVE-2002-1394 | | 2003-01-17 | Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or b… | |
CVE-2002-2272 | | 2002-12-31 | Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communi… | |
CVE-2002-2103 | | 2002-12-31 | Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fail… | |
CVE-2002-2029 | | 2002-12-31 | PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbit… | |
CVE-2002-2012 | | 2002-12-31 | Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request. | |
CVE-2002-2009 | | 2002-12-31 | Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which… | |
CVE-2002-2008 | | 2002-12-31 | Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which… | |
CVE-2002-2007 | | 2002-12-31 | The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web ro… | |
CVE-2002-2006 | | 2002-12-31 | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive sys… | |
CVE-2002-1895 | | 2002-12-31 | The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash… | |
CVE-2002-1850 | High | 7.5 | 2002-12-31 | mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CG… |
CVE-2002-1658 | | 2002-12-31 | Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normal… | |
CVE-2002-1233 | | 2002-11-04 | A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and e… | |
CVE-2002-1156 | | 2002-10-11 | Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled. | |
CVE-2002-1148 | | 2002-10-11 | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server… | |
CVE-2002-0843 | | 2002-10-11 | Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cau… | |
CVE-2002-0840 | | 2002-10-11 | Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and supp… | |
CVE-2002-0839 | | 2002-10-11 | The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any proces… | |
CVE-2002-0936 | | 2002-10-04 | The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPr… | |
CVE-2002-0935 | | 2002-10-04 | Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large numb… | |
CVE-2002-1593 | | 2002-09-25 | mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and… | |
CVE-2002-0654 | | 2002-09-05 | Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file… | |
CVE-2002-0661 | | 2002-08-12 | Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute command… | |
CVE-2002-0493 | | 2002-08-12 | Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass i… | |
CVE-2002-0682 | | 2002-07-23 | Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ m… | |
CVE-2002-0392 | | 2002-07-03 | Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-… | |
CVE-2002-0257 | | 2002-05-29 | Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fie… | |
CVE-2002-0249 | | 2002-05-29 | PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a requ… | |
CVE-2002-0240 | | 2002-05-29 | PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server… | |
CVE-2002-0185 | | 2002-05-16 | mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attac… | |
CVE-2002-1592 | | 2002-05-06 | The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full pa… | |
CVE-2000-1210 | | 2002-03-22 | Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument… | |
CVE-2002-0061 | | 2002-03-21 | Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe characte… | |
CVE-2001-1563 | | 2001-12-31 | Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the ve… | |
CVE-2001-1556 | | 2001-12-31 | The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote a… | |
CVE-2001-1534 | | 2001-12-31 | mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID… | |
CVE-2001-0829 | | 2001-12-06 | A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Jav… | |
CVE-2001-1449 | | 2001-11-28 | The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directo… | |
CVE-2001-0917 | | 2001-11-22 | Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension. | |
CVE-2001-0730 | | 2001-10-30 | split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the… | |
CVE-2001-0729 | | 2001-10-30 | Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash… | |
CVE-2001-0766 | Critical | 9.8 | 2001-10-18 | Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose c… |
CVE-2001-0731 | | 2001-10-01 | Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string. | |
CVE-2001-1072 | | 2001-08-31 | Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested… | |
CVE-2001-0590 | | 2001-08-02 | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request… | |
CVE-2001-1342 | | 2001-05-12 | Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large… | |
CVE-2001-0925 | | 2001-03-12 | The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a… | |
CVE-2001-0131 | | 2001-03-12 | htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. | |
CVE-2001-0042 | | 2001-02-16 | PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequence… | |
CVE-2000-0913 | | 2000-12-19 | mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose nam… | |
CVE-2000-0869 | | 2000-11-14 | The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary directories via the PROPFIND HTTP… | |
CVE-2000-0868 | | 2000-11-14 | The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requ… | |
CVE-2000-0760 | | 2000-10-20 | The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp… | |
CVE-2000-0759 | | 2000-10-20 | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message t… | |
CVE-2000-1204 | | 2000-10-13 | Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI progr… | |
CVE-2000-0672 | | 2000-07-20 | The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly c… | |
CVE-2000-0505 | | 2000-05-31 | The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / charac… | |
CVE-2000-1205 | | 2000-02-01 | Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CG… | |
CVE-1999-1293 | | 1999-12-31 | mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core. | |
CVE-1999-0289 | | 1999-12-12 | The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL. | |
CVE-1999-1053 | | 1999-09-13 | guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary comma… | |
CVE-1999-0926 | | 1999-09-03 | Apache allows remote attackers to conduct a denial of service via a large number of MIME headers. | |
CVE-2000-1206 | | 1999-08-20 | Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote atta… | |
CVE-1999-1237 | | 1999-06-06 | Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to ex… | |
CVE-1999-1412 | | 1999-06-03 | A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTT… | |
CVE-1999-0678 | | 1999-01-17 | A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire ser… | |
CVE-1999-1199 | | 1998-08-07 | Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same… | |
CVE-1999-0107 | | 1997-12-30 | Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number… | |
CVE-1999-0071 | | 1997-09-01 | Apache httpd cookie buffer overflow for versions 1.1.1 and earlier. | |
CVE-1999-0236 | High | 7.5 | 1997-01-01 | ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs. |
CVE-1999-0045 | | 1996-12-10 | List of arbitrary files on Web host via nph-test-cgi script. | |
CVE-1999-0070 | | 1996-04-01 | test-cgi program allows an attacker to list files on the server. | |
CVE-1999-0067 | | 1996-03-20 | phf CGI program allows remote command execution through shell metacharacters. |