Apache Security

CVE-2019-17567
Latest security vulnerabilities Apache Http Server Jun 10, 2021 | 00:00 am
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with[…]
Read more...
CVE-2020-13950
Latest security vulnerabilities Apache Http Server Jun 10, 2021 | 00:00 am
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service (CVSS:5.0) (Last Update:2021-06-16)
Read more...
CVE-2020-35452
Latest security vulnerabilities Apache Http Server Jun 10, 2021 | 00:00 am
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular[…]
Read more...
CVE-2020-9490
Latest security vulnerabilities Apache Http Server Aug 7, 2020 | 00:00 am
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via[…]
Read more...
CVE-2020-11984
Latest security vulnerabilities Apache Http Server Aug 7, 2020 | 00:00 am
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE (CVSS:7.5) (Last Update:2021-06-06)
Read more...
CVE-2020-11985
Latest security vulnerabilities Apache Http Server Aug 7, 2020 | 00:00 am
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server[…]
Read more...
CVE-2020-11993
Latest security vulnerabilities Apache Http Server Aug 7, 2020 | 00:00 am
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2[…]
Read more...
CVE-2020-1927
Latest security vulnerabilities Apache Http Server Apr 2, 2020 | 00:00 am
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. (CVSS:5.8) (Last Update:2021-06-14)
Read more...
CVE-2020-1934
Latest security vulnerabilities Apache Http Server Apr 1, 2020 | 00:00 am
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. (CVSS:5.0) (Last Update:2021-06-06)
Read more...
CVE-2020-2530
Latest security vulnerabilities Apache Http Server Jan 15, 2020 | 00:00 am
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.[…]
Read more...