|
11
|
7.5
-
|
HIGH
Network
|
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.
Special characters in the origin response header c…
|
-
|
CVE-2023-27522
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.30
|
2.4.55
|
|
|
2024-11-21 16:53
2023-03-8
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
12
|
5.3
-
|
MEDIUM
Network
|
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers…
|
-
|
CVE-2022-37436
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.55
|
2024-11-21 16:14
2023-01-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
13
|
9.0
-
|
CRITICAL
Network
|
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards reque…
|
-
|
CVE-2022-36760
|
cpe:2.3:a:apache:http_server:*:*
|
2.4.0
|
|
|
2.4.55
|
2024-11-21 16:13
2023-01-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
14
|
7.5
-
|
HIGH
Network
|
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.
…
|
-
|
CVE-2006-20001
|
cpe:2.3:a:apache:http_server:*:*
|
|
|
|
2.4.55
|
2024-11-21 09:10
2023-01-18
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
15
|
9.8
7.5
|
CRITICAL
Network
|
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based auth…
|
CWE-345
Insufficient Verification of Data Authenticity
|
CVE-2022-31813
|
cpe:2.3:a:apache:http_server:*:*
|
|
2.4.53
|
|
|
2024-11-21 16:05
2022-06-10
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
16
|
7.5
5.0
|
HIGH
Network
|
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
|
NVD-CWE-Other
|
CVE-2022-30556
|
cpe:2.3:a:apache:http_server:*:*
|
|
2.4.53
|
|
|
2024-11-21 16:02
2022-06-10
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
17
|
7.5
5.0
|
HIGH
Network
|
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigg…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2022-30522
|
cpe:2.3:a:apache:http_server:2.4.53:*
|
|
|
|
|
2024-11-21 16:02
2022-06-10
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
18
|
7.5
5.0
|
HIGH
Network
|
In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2022-29404
|
cpe:2.3:a:apache:http_server:*:*
|
|
2.4.53
|
|
|
2024-11-21 15:59
2022-06-10
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
19
|
9.1
6.4
|
CRITICAL
Network
|
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed …
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2022-28615
|
cpe:2.3:a:apache:http_server:*:*
|
|
2.4.53
|
|
|
2024-11-21 15:57
2022-06-10
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
20
|
5.3
5.0
|
MEDIUM
Network
|
The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as w…
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2022-28614
|
cpe:2.3:a:apache:http_server:*:*
|
|
2.4.53
|
|
|
2024-11-21 15:57
2022-06-10
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|