Search for packages
| purl | pkg:apache/httpd@2.4.28 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2017-15710
|
mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's … |
Vulnerable |
|
CVE-2017-15715
|
The expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only … |
Vulnerable |
|
CVE-2018-11763
|
By sending continous SETTINGS frames of maximum size an ongoing HTTP/2 connection could be kept busy and would never time … |
Vulnerable |
|
CVE-2018-1283
|
When mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user … |
Vulnerable |
|
CVE-2018-1301
|
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.33, due to an out of … |
Vulnerable |
|
CVE-2018-1302
|
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.33 could have written … |
Vulnerable |
|
CVE-2018-1303
|
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.33 due to an … |
Vulnerable |
|
CVE-2018-1312
|
When generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a … |
Vulnerable |
|
CVE-2018-1333
|
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a … |
Vulnerable |
|
CVE-2018-17189
|
By sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied … |
Vulnerable |
|
CVE-2018-17199
|
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This … |
Vulnerable |
|
CVE-2019-0196
|
Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparision when determining … |
Vulnerable |
|
CVE-2019-0211
|
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child … |
Vulnerable |
|
CVE-2019-0217
|
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server … |
Vulnerable |
|
CVE-2019-0220
|
When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must … |
Vulnerable |
|
CVE-2019-10081
|
HTTP/2 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's … |
Vulnerable |
|
CVE-2019-10082
|
Using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown. |
Vulnerable |
|
CVE-2019-10092
|
A limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the … |
Vulnerable |
|
CVE-2019-10098
|
Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to … |
Vulnerable |
|
CVE-2019-17567
|
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin … |
Vulnerable |
|
CVE-2019-9517
|
A malicious client could perform a DoS attack by flooding a connection with requests and basically never reading responses on … |
Vulnerable |
|
CVE-2020-11993
|
In Apache HTTP Server versions 2.4.20 to 2.4.43, when trace/debug was enabled for the HTTP/2 module and on certain traffic … |
Not vulnerable |
|
CVE-2020-13938
|
Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows |
Vulnerable |
|
CVE-2020-1927
|
In Apache HTTP Server versions 2.4.0 to 2.4.41 some mod_rewrite configurations vulnerable to open redirect. |
Not vulnerable |
|
CVE-2020-1934
|
in Apache HTTP Server versions 2.4.0 to 2.4.41, mod_proxy_ftp use of uninitialized value with malicious FTP backend. |
Not vulnerable |
|
CVE-2020-35452
|
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There … |
Vulnerable |
|
CVE-2020-9490
|
In Apache HTTP Server versions 2.4.20 to 2.4.43, a specially crafted value for the 'Cache-Digest' header in a HTTP/2 request … |
Not vulnerable |
|
CVE-2021-26690
|
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer … |
Vulnerable |
|
CVE-2021-26691
|
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted SessionHeader sent by an origin server could cause a heap … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2017-9798
|
When an unrecognized HTTP Method is given in an <Limit {method}> directive in an .htaccess file, and that .htaccess file … |