Search for packages
| purl | pkg:rpm/redhat/rhpki-tks@7.3.0-13?arch=el4 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-18j8-kwdv-dyak
Aliases: CVE-2005-3510 GHSA-8f4w-jwqv-5cxc |
Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files. | There are no reported fixed by versions. |
|
VCID-1nh6-77uc-xbak
Aliases: CVE-2007-1863 |
A bug was found in the mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. | There are no reported fixed by versions. |
|
VCID-2jnv-segx-zkfd
Aliases: CVE-2006-3835 GHSA-wfj7-mhr5-pcwq |
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do. | There are no reported fixed by versions. |
|
VCID-3kyb-4yvt-f7e1
Aliases: CVE-2009-1955 |
A denial of service flaw was found in the bundled copy of the APR-util library Extensible Markup Language (XML) parser. A remote attacker could create a specially-crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine. | There are no reported fixed by versions. |
|
VCID-4rcx-xfn5-7kdb
Aliases: CVE-2009-0580 GHSA-w227-xcfx-3pj8 |
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. | There are no reported fixed by versions. |
|
VCID-6d43-sjqw-tbbp
Aliases: CVE-2009-3095 |
A flaw was found in the mod_proxy_ftp module. In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header, allowing the attacker to send arbitrary commands to the FTP server. | There are no reported fixed by versions. |
|
VCID-6epr-2hbd-skcz
Aliases: CVE-2005-2090 GHSA-f2gq-p6qv-ccw4 |
Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." | There are no reported fixed by versions. |
|
VCID-6p3e-4u8s-17ep
Aliases: CVE-2007-3385 GHSA-6j8f-66vh-39mj |
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. | There are no reported fixed by versions. |
|
VCID-7969-7a8h-zyhh
Aliases: CVE-2007-3382 GHSA-qff8-g48j-pwpw |
Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks. | There are no reported fixed by versions. |
|
VCID-7ftk-sajb-akh4
Aliases: CVE-2009-0023 |
A heap-based underwrite flaw was found in the way the bundled copy of the APR-util library created compiled forms of particular search patterns. An attacker could formulate a specially-crafted search keyword, that would overwrite arbitrary heap memory locations when processed by the pattern preparation engine. | There are no reported fixed by versions. |
|
VCID-87p8-zvvf-y7dm
Aliases: CVE-2007-0450 GHSA-4prh-gqw8-rgh5 |
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache. | There are no reported fixed by versions. |
|
VCID-88v7-kc2y-bfd7
Aliases: CVE-2007-5461 GHSA-v5p2-vg3c-pmrr |
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag. | There are no reported fixed by versions. |
|
VCID-95zk-suqh-j7e7
Aliases: CVE-2007-3847 |
A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. | There are no reported fixed by versions. |
|
VCID-9zzc-scyf-ckdb
Aliases: CVE-2007-1349 |
The mod_perl Apache module is vulnerable to a Denial of Service when processing regular expressions. | There are no reported fixed by versions. |
|
VCID-a9cu-fxqw-xkdg
Aliases: CVE-2008-1232 GHSA-q74x-qqhr-f8rx |
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method. | There are no reported fixed by versions. |
|
VCID-acmu-9eqb-fya5
Aliases: CVE-2008-2370 GHSA-m8h8-6rvg-f4mg |
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter. | There are no reported fixed by versions. |
|
VCID-dcrp-rae1-zfcm
Aliases: CVE-2009-0033 GHSA-5cw4-ggx9-36vg |
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. | There are no reported fixed by versions. |
|
VCID-dqkp-f1my-dbg9
Aliases: CVE-2007-5000 |
A flaw was found in the mod_imagemap module. On sites where mod_imagemap is enabled and an imagemap file is publicly available, a cross-site scripting attack is possible. | There are no reported fixed by versions. |
|
VCID-fn5k-e2jr-6ube
Aliases: CVE-2008-2364 |
A flaw was found in the handling of excessive interim responses from an origin server when using mod_proxy_http. A remote attacker could cause a denial of service or high memory usage. | There are no reported fixed by versions. |
|
VCID-g2pp-aahn-mfcd
Aliases: CVE-2008-2939 |
A flaw was found in the handling of wildcards in the path of a FTP URL with mod_proxy_ftp. If mod_proxy_ftp is enabled to support FTP-over-HTTP, requests containing globbing characters could lead to cross-site scripting (XSS) attacks. | There are no reported fixed by versions. |
|
VCID-h5vb-1c3n-gfbf
Aliases: CVE-2007-5116 |
A buffer overflow in the Regular Expression engine in Perl possibly allows for the execution of arbitrary code. | There are no reported fixed by versions. |
|
VCID-j3mb-97k1-uuh9
Aliases: CVE-2006-5752 |
A flaw was found in the mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available. | There are no reported fixed by versions. |
|
VCID-jvhf-ecm7-fbb8
Aliases: CVE-2007-4465 |
Multiple vulnerabilities have been discovered in Apache, possibly resulting in a Denial of Service or the disclosure of sensitive information. | There are no reported fixed by versions. |
|
VCID-kgpj-aexq-7kah
Aliases: CVE-2007-6388 |
A flaw was found in the mod_status module. On sites where mod_status is enabled and the status pages were publicly accessible, a cross-site scripting attack is possible. Note that the server-status page is not enabled by default and it is best practice to not make this publicly available. | There are no reported fixed by versions. |
|
VCID-me4r-1qb6-dqdf
Aliases: CVE-2006-3918 |
A flaw in the handling of invalid Expect headers. If an attacker can influence the Expect header that a victim sends to a target site they could perform a cross-site scripting attack. It is known that some versions of Flash can set an arbitrary Expect header which can trigger this flaw. Not marked as a security issue for 2.0 or 2.2 as the cross-site scripting is only returned to the victim after the server times out a connection. | There are no reported fixed by versions. |
|
VCID-mnf8-t3ew-4fgb
Aliases: CVE-2008-5515 GHSA-9737-qmgc-hfr9 |
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. | There are no reported fixed by versions. |
|
VCID-nhce-b7j4-huaa
Aliases: CVE-2008-1927 |
A double free vulnerability was discovered in Perl, possibly resulting in the execution of arbitrary code and a Denial of Service. | There are no reported fixed by versions. |
|
VCID-pdj3-4txb-vych
Aliases: CVE-2009-1891 |
A denial of service flaw was found in the mod_deflate module. This module continued to compress large files until compression was complete, even if the network connection that requested the content was closed before compression completed. This would cause mod_deflate to consume large amounts of CPU if mod_deflate was enabled for a large file. | There are no reported fixed by versions. |
|
VCID-phbq-79xp-4fe1
Aliases: CVE-2009-4901 |
pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages | There are no reported fixed by versions. |
|
VCID-pj4f-awuq-73g6
Aliases: CVE-2009-1956 |
An off-by-one overflow flaw was found in the way the bundled copy of the APR-util library processed a variable list of arguments. An attacker could provide a specially-crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive information or a denial of service. | There are no reported fixed by versions. |
|
VCID-qdck-q54n-rkcv
Aliases: CVE-2008-0128 |
The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. | There are no reported fixed by versions. |
|
VCID-qxkf-4ddv-j3b7
Aliases: CVE-2007-1358 GHSA-xmc9-6p56-3c4v |
Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616". | There are no reported fixed by versions. |
|
VCID-srxw-jjvr-p3d5
Aliases: CVE-2007-3304 |
The Apache HTTP server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the HTTP server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service. | There are no reported fixed by versions. |
|
VCID-ss79-kcpu-mqd5
Aliases: CVE-2008-0005 |
A workaround was added in the mod_proxy_ftp module. On sites where mod_proxy_ftp is enabled and a forward proxy is configured, a cross-site scripting attack is possible against Web browsers which do not correctly derive the response character set following the rules in RFC 2616. | There are no reported fixed by versions. |
|
VCID-umuk-3n1q-3qet
Aliases: CVE-2009-2412 |
A flaw in apr_palloc() in the bundled copy of APR could cause heap overflows in programs that try to apr_palloc() a user controlled size. The Apache HTTP Server itself does not pass unsanitized user-provided sizes to this function, so it could only be triggered through some other application which uses apr_palloc() in a vulnerable way. | There are no reported fixed by versions. |
|
VCID-v94p-bxm3-akfd
Aliases: CVE-2007-5333 GHSA-cww4-vj5r-rx57 |
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385. | There are no reported fixed by versions. |
|
VCID-wycq-jwzz-q7hf
Aliases: CVE-2010-0434 |
A flaw in the core subrequest process code was fixed, to always provide a shallow copy of the headers_in array to the subrequest, instead of a pointer to the parent request's array as it had for requests without request bodies. This meant all modules such as mod_headers which may manipulate the input headers for a subrequest would poison the parent request in two ways, one by modifying the parent request, which might not be intended, and second by leaving pointers to modified header fields in memory allocated to the subrequest scope, which could be freed before the main request processing was finished, resulting in a segfault or in revealing data from another request on threaded servers, such as the worker or winnt MPMs. | There are no reported fixed by versions. |
|
VCID-y29n-egjs-tqby
Aliases: CVE-2010-0407 |
pcsc-lite: Privilege escalation via specially-crafted client to PC/SC Smart Card daemon messages | There are no reported fixed by versions. |
|
VCID-zkbr-1m2z-ufe7
Aliases: CVE-2009-3094 |
A NULL pointer dereference flaw was found in the mod_proxy_ftp module. A malicious FTP server to which requests are being proxied could use this flaw to crash an httpd child process via a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||