WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Enterprise Manager / Networking (Apache HTTP Server)✕
Overview 8 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 4 EPSS ≥ 0.5
8matches 0in Waratek scope0.0% 0protected0.0% 1exploited12.5% 0CISA KEV0.0% 1public PoC12.5% 4EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 3 37.5% Not applicable 5 62.5% Withdrawn CVE 0 0.0%
Critical 4 50.0% High 2 25.0% Medium 2 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 3 37.5% No public exploit 4 50.0%
split by peak 5 / quarter
Not applicable: 5Outside Waratek scope: 3 Medium: 2High: 2Critical: 4 not blocked: 8 No public exploit: 4Forecast only: 3Exploited: 1
Q2 201 Outside Waratek scope1 Medium1 not blocked1 Forecast only1 Q3 200 Q4 200 Q1 210 Q2 211 Outside Waratek scope1 Critical1 not blocked1 Forecast only1 Q3 210 Q4 210 Q1 221 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 Q2 220 Q3 220 Q4 220 Q1 235 Not applicable5 Critical2 High2 Medium1 not blocked5 Exploited1 Forecast only1 No public exploit3
Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22Q1 23
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-27522 High 2023-03-07 Not applicable No public exploit HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
CVE-2023-25690 Critical 2023-03-07 Not applicable Exploited Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.
CVE-2022-37436 Medium 2023-01-17 Not applicable Forecast only Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
CVE-2022-36760 Critical 2023-01-17 Not applicable No public exploit Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
CVE-2006-20001 High 2023-01-17 Not applicable No public exploit A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.
CVE-2022-22721 Critical 2022-03-14 Outside Waratek scope No public exploit If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
CVE-2021-26691 Critical 2021-06-10 Outside Waratek scope Forecast only In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
CVE-2020-1934 Medium 2020-04-01 Outside Waratek scope Forecast only In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.