WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Virtualization / Web Server (Apache HTTP Server)✕
Overview 5 matches · 0 in Waratek scope · 0 protected · 3 exploited · 1 CISA KEV · 2 public PoC · 3 EPSS ≥ 0.5
5matches 0in Waratek scope0.0% 0protected0.0% 3exploited60.0% 1CISA KEV20.0% 2public PoC40.0% 3EPSS ≥ 0.560.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 4 80.0% Not applicable 1 20.0% Withdrawn CVE 0 0.0%
Critical 2 40.0% High 2 40.0% Medium 1 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 60.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 40.0%
split by peak 2 / quarter
Not applicable: 1Outside Waratek scope: 4 Medium: 1High: 2Critical: 2 not blocked: 5 No public exploit: 2Exploited: 3
Q2 171 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 Q3 172 Outside Waratek scope1 Not applicable1 High2 not blocked2 Exploited1 No public exploit1 Q4 170 Q1 180 Q2 180 Q3 181 Outside Waratek scope1 Medium1 not blocked1 Exploited1 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 211 Outside Waratek scope1 Critical1 not blocked1 Exploited1
Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-40438 Critical 2021-09-16 Outside Waratek scope Exploited A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2018-11763 Medium 2018-09-25 Outside Waratek scope Exploited In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVE-2017-9798 High 2017-09-18 Not applicable Exploited Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
CVE-2016-8743 High 2017-07-27 Outside Waratek scope No public exploit Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
CVE-2017-3167 Critical 2017-06-20 Outside Waratek scope No public exploit In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.