Overview 162 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 38 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
2
1.2%
No exploit published
0
0.0%
Outside Waratek scope
12
7.4%
Not applicable
148
91.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
162
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
162
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 22 / year
19962
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
19974
Not applicable4
High3
Medium1
not blocked4
Working exploit published4
19980
19998
Not applicable8
High5
Medium3
not blocked8
Working exploit published8
20004
Not applicable4
Medium4
not blocked4
Working exploit published4
200113
Outside Waratek scope1
Not applicable12
Critical1
High4
Medium8
not blocked13
Working exploit published13
200222
Mitigation candidate1
Outside Waratek scope3
Not applicable18
Critical1
High14
Medium7
not blocked22
Working exploit published22
200312
Not applicable12
Critical1
High2
Medium9
not blocked12
Working exploit published12
200413
Not applicable13
High2
Medium11
not blocked13
Working exploit published13
20058
Not applicable8
High3
Medium5
not blocked8
Working exploit published8
20068
Not applicable8
High2
Medium6
not blocked8
Working exploit published8
200718
Outside Waratek scope1
Not applicable17
High5
Medium13
not blocked18
Working exploit published18
20087
Outside Waratek scope1
Not applicable6
High2
Medium5
not blocked7
Working exploit published7
20098
Not applicable8
High4
Medium4
not blocked8
Working exploit published8
20106
Outside Waratek scope1
Not applicable5
Critical1
High2
Medium3
not blocked6
Working exploit published6
20117
Not applicable7
Medium6
Low1
not blocked7
Working exploit published7
20123
Outside Waratek scope2
Not applicable1
Medium3
not blocked3
Working exploit published3
20131
Not applicable1
High1
not blocked1
Working exploit published1
20144
Outside Waratek scope1
Not applicable3
Critical1
High2
Medium1
not blocked4
Working exploit published4
20150
20161
Not applicable1
High1
not blocked1
Working exploit published1
20170
20184
Not applicable4
Medium4
not blocked4
Working exploit published4
20192
Outside Waratek scope1
Not applicable1
Critical1
Medium1
not blocked2
Working exploit published2
20200
20212
Mitigation candidate1
Outside Waratek scope1
Critical1
High1
not blocked2
Working exploit published2
20221
Not applicable1
High1
not blocked1
Working exploit published1
20230
20242
Not applicable2
High2
not blocked2
Working exploit published2
20251
Not applicable1
High1
not blocked1
Working exploit published1
20261
Not applicable1
High1
not blocked1
Working exploit published1
19961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-23918 | High | 2026-05-04 | Not applicable | Working exploit published | Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue. |
| CVE-2025-64500 | High | 2025-11-12 | Not applicable | Working exploit published | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption. Starting in versions 5.4.50, 6.4.29, and 7.3.7, the `Request` class now ensures that URL paths always start with a `/`. |
| CVE-2024-38473 | High | 2024-07-01 | Not applicable | Working exploit published | Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue. |
| CVE-2024-38472 | High | 2024-07-01 | Not applicable | Working exploit published | SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing. |
| CVE-2022-35507 | High | 2022-12-04 | Not applicable | Working exploit published | A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3. |
| CVE-2021-44790 | Critical | 2021-12-20 | Outside Waratek scope | Working exploit published | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier. |
| CVE-2021-42697 | High | 2021-11-02 | Mitigation candidate | Working exploit published | Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments. |
| CVE-2013-4743 | Critical | 2019-12-27 | Not applicable | Working exploit published | Static HTTP Server 1.0 has a Local Overflow |
| CVE-2019-10092 | Medium | 2019-09-26 | Outside Waratek scope | Working exploit published | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed. |
| CVE-2018-18778 | Medium | 2018-10-29 | Not applicable | Working exploit published | ACME mini_httpd before 1.30 lets remote users read arbitrary files. |
| CVE-2018-16134 | Medium | 2018-08-29 | Not applicable | Working exploit published | Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI. |
| CVE-2018-16133 | Medium | 2018-08-29 | Not applicable | Working exploit published | Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI. |
| CVE-2016-4975 | Medium | 2018-08-14 | Not applicable | Working exploit published | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31). |
| CVE-2016-8740 | High | 2016-12-05 | Not applicable | Working exploit published | The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request. |
| CVE-2014-7226 | High | 2014-10-10 | Not applicable | Working exploit published | The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols. |
| CVE-2014-4927 | High | 2014-07-24 | Not applicable | Working exploit published | Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 routers allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request. |
| CVE-2014-0226 | Medium | 2014-07-20 | Outside Waratek scope | Working exploit published | Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c. |
| CVE-2014-2323 | Critical | 2014-03-14 | Not applicable | Working exploit published | SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname. |
| CVE-2013-5019 | High | 2013-07-31 | Not applicable | Working exploit published | Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resource name in an HTTP request. |
| CVE-2012-5533 | Medium | 2012-11-24 | Not applicable | Working exploit published | The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header. |
| CVE-2012-0053 | Medium | 2012-01-28 | Outside Waratek scope | Working exploit published | protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script. |
| CVE-2012-0031 | Medium | 2012-01-18 | Outside Waratek scope | Working exploit published | scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function. |
| CVE-2011-4362 | Medium | 2011-12-24 | Not applicable | Working exploit published | Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index. |
| CVE-2011-4317 | Medium | 2011-11-30 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368. |
| CVE-2011-3639 | Medium | 2011-11-30 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368. |
| CVE-2011-4415 | Low | 2011-11-08 | Not applicable | Working exploit published | The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607. |
| CVE-2011-3607 | Medium | 2011-11-08 | Not applicable | Working exploit published | Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow. |
| CVE-2011-3368 | Medium | 2011-10-05 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character. |
| CVE-2011-0419 | Medium | 2011-05-16 | Not applicable | Working exploit published | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. |
| CVE-2010-2435 | Medium | 2010-06-24 | Not applicable | Working exploit published | Weborf HTTP Server 0.12.1 and earlier allows remote attackers to cause a denial of service (crash) via Unicode characters in a Connection HTTP header, and possibly other headers. |
| CVE-2010-1544 | Medium | 2010-04-26 | Not applicable | Working exploit published | micro_httpd on the RCA DCM425 cable modem allows remote attackers to cause a denial of service (device reboot) via a long string to TCP port 80. |
| CVE-2009-4769 | High | 2010-04-20 | Not applicable | Working exploit published | Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component. |
| CVE-2010-0425 | High | 2010-03-05 | Outside Waratek scope | Working exploit published | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers." |
| CVE-2010-0295 | Medium | 2010-02-03 | Not applicable | Working exploit published | lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to cause a denial of service (memory consumption) by breaking a request into small pieces that are sent at a slow rate. |
| CVE-2009-4491 | Critical | 2010-01-13 | Not applicable | Working exploit published | thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. |
| CVE-2009-4531 | Medium | 2009-12-31 | Not applicable | Working exploit published | httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) character to the URI. |
| CVE-2009-3586 | High | 2009-12-08 | Not applicable | Working exploit published | Off-by-one error in src/http.c in CoreHTTP 0.5.3.1 and earlier allows remote attackers to cause a denial of service or possibly execute arbitrary code via an HTTP request with a long first line that triggers a buffer overflow. NOTE: this vulnerability reportedly exists because of an incorrect fix for CVE-2007-4060. |
| CVE-2009-4086 | Medium | 2009-11-29 | Not applicable | Working exploit published | CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. NOTE: some of these details are obtained from third party information. |
| CVE-2009-3902 | Medium | 2009-11-06 | Not applicable | Working exploit published | Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL. |
| CVE-2009-3711 | High | 2009-10-16 | Not applicable | Working exploit published | Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request. |
| CVE-2009-3663 | High | 2009-10-11 | Not applicable | Working exploit published | Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the Host header. |
| CVE-2008-7014 | Medium | 2009-08-19 | Not applicable | Working exploit published | fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an invalid character after the Basic value. |
| CVE-2009-1955 | High | 2009-06-08 | Not applicable | Working exploit published | The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564. |
| CVE-2008-2168 | Medium | 2008-05-13 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page. |
| CVE-2008-1647 | High | 2008-04-02 | Not applicable | Working exploit published | The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0, and earlier in ChilkatHttp ActiveX expose the unsafe SaveLastError method, which allows remote attackers to overwrite arbitrary files. NOTE: some of these details are obtained from third party information. |
| CVE-2008-1270 | Medium | 2008-03-10 | Not applicable | Working exploit published | mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory. |
| CVE-2008-0406 | Medium | 2008-01-29 | Not applicable | Working exploit published | HTTP File Server (HFS) before 2.2c, when account names are used as log filenames, allows remote attackers to cause a denial of service (daemon crash) via a long account name. |
| CVE-2008-0455 | Medium | 2008-01-25 | Outside Waratek scope | Working exploit published | Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file. |
| CVE-2008-0338 | Medium | 2008-01-17 | Not applicable | Working exploit published | Directory traversal vulnerability in the mwGetLocalFileName function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to read arbitrary files and list arbitrary directories via a (1) .%2e (partially encoded dot dot) or (2) %2e%2e (encoded dot dot) in the URI. |
| CVE-2008-0337 | High | 2008-01-17 | Not applicable | Working exploit published | Heap-based buffer overflow in the _mwProcessReadSocket function in http.c in MiniWeb HTTP Server 0.8.19 allows remote attackers to execute arbitrary code via a long URI. |
| CVE-2007-6514 | Medium | 2007-12-21 | Not applicable | Working exploit published | Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive. |
| CVE-2007-6453 | High | 2007-12-20 | Not applicable | Working exploit published | Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ulang parameter. |
| CVE-2007-6405 | Medium | 2007-12-17 | Not applicable | Working exploit published | Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a URI with an appended (1) '+' character, (2) '.' character, (3) %2e sequence (hex-encoded dot), or (4) hex-encoded character greater than 0x7f. NOTE: the %20 vector is already covered by CVE-2007-3407. |
| CVE-2007-6404 | Medium | 2007-12-17 | Not applicable | Working exploit published | Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the URI. |
| CVE-2007-6326 | Medium | 2007-12-13 | Not applicable | Working exploit published | Sergey Lyubka Simple HTTPD (shttpd) 1.3 on Windows allows remote attackers to cause a denial of service via a request that includes an MS-DOS device name, as demonstrated by the /aux URI. |
| CVE-2007-6203 | Medium | 2007-12-03 | Not applicable | Working exploit published | Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918. |
| CVE-2007-5685 | Medium | 2007-10-28 | Not applicable | Working exploit published | The safe_path function in shttp before 0.0.5 allows remote attackers to conduct directory traversal attacks and read files via a combination of ".." and sub-directory specifiers that resolve to a pathname that is at or below the same level as the web document root, but in a different part of the directory tree. |
| CVE-2007-4060 | High | 2007-07-30 | Not applicable | Working exploit published | Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request. |
| CVE-2007-3947 | Medium | 2007-07-24 | Not applicable | Working exploit published | request.c in lighttpd 1.4.15 allows remote attackers to cause a denial of service (daemon crash) by sending an HTTP request with duplicate headers, as demonstrated by a request containing two Location header lines, which results in a segmentation fault. |
| CVE-2007-3407 | Medium | 2007-06-26 | Not applicable | Working exploit published | Sergey Lyubka Simple HTTPD (shttpd) 1.38 allows remote attackers to obtain sensitive information (script source code) via a URL with a trailing encoded space (%20). |
| CVE-2007-3340 | High | 2007-06-21 | Not applicable | Working exploit published | BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows remote attackers to cause a denial of service (application crash) via a large number of requests for nonexistent pages. |
| CVE-2007-3327 | Medium | 2007-06-21 | Not applicable | Working exploit published | httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information (script source code) via a URI with a trailing %20 (encoded space). |
| CVE-2007-3159 | Medium | 2007-06-11 | Not applicable | Working exploit published | http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negative value in the Content-Length HTTP header. |
| CVE-2007-3009 | Medium | 2007-06-04 | Not applicable | Working exploit published | Format string vulnerability in the MprLogToFile::logEvent function in Mbedthis AppWeb 2.0.5-4, when the build supports logging but the configuration disables logging, allows remote attackers to cause a denial of service (daemon crash) via format string specifiers in the HTTP scheme, as demonstrated by a "GET %n://localhost:80/" request. |
| CVE-2007-2563 | High | 2007-05-09 | Not applicable | Working exploit published | Buffer overflow in the AddFile function in VersalSoft HTTP File Upload ActiveX control (UFileUploaderD.dll) allows remote attackers to execute arbitrary code via a long argument. |
| CVE-2007-2367 | High | 2007-04-30 | Not applicable | Working exploit published | Buffer overflow in wserve_console.exe in Wserve HTTP Server (whttp) 4.6 allows remote attackers to cause a denial of service (forced application exit) via a long directory name in the URI. |
| CVE-2007-0450 | Medium | 2007-03-16 | Outside Waratek scope | Working exploit published | Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache. |
| CVE-2007-0548 | Medium | 2007-01-29 | Not applicable | Working exploit published | KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonexistent objects. |
| CVE-2006-6758 | Medium | 2006-12-27 | Not applicable | Working exploit published | Directory traversal vulnerability in Http explorer 1.02 allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the URI. |
| CVE-2006-5216 | High | 2006-10-10 | Not applicable | Working exploit published | Stack-based buffer overflow in Sergey Lyubka Simple HTTPD (shttpd) 1.34 allows remote attackers to execute arbitrary code via a long URI. |
| CVE-2006-4723 | Medium | 2006-09-12 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in raidenhttpd-admin/slice/check.php in RaidenHTTPD 1.1.49, when register_globals and WebAdmin is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SoftParserFileXml parameter. |
| CVE-2006-4110 | Medium | 2006-08-14 | Not applicable | Working exploit published | Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems. |
| CVE-2006-3918 | Medium | 2006-07-28 | Not applicable | Working exploit published | http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file. |
| CVE-2006-3747 | High | 2006-07-28 | Not applicable | Working exploit published | Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules. |
| CVE-2006-2222 | Medium | 2006-05-05 | Not applicable | Working exploit published | Buffer overflow in zawhttpd 0.8.23, and possibly previous versions, allows remote attackers to cause a denial of service (daemon crash) via a request for a URI composed of several "\" (backslash) characters. |
| CVE-2006-1681 | Medium | 2006-04-11 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. |
| CVE-2005-4503 | Medium | 2005-12-22 | Not applicable | Working exploit published | httprint v202, and possibly other versions before v301, allows remote attackers to cause a denial of service (crash) via a long Server field in an HTTP response. |
| CVE-2005-4502 | Medium | 2005-12-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in httprint v202, and possibly other versions before v301, allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response, which is not sanitized before being displayed to the user. |
| CVE-2005-1666 | High | 2005-05-18 | Not applicable | Working exploit published | Multiple buffer overflows in Orenosv HTTP/FTP Server 0.8.1 allow remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via long arguments to FTP commands such as MKD, RMD, or DELE, which are processed by the (1) ftp_xlate_path, (2) ftp_is_canonical, or (3) os_fn_nativize functions, or (4) a long SSI command that is processed by the parse_cmd function in cgissi.exe. |
| CVE-2005-1344 | High | 2005-05-02 | Not applicable | Working exploit published | Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability. |
| CVE-2005-1086 | Medium | 2005-05-02 | Not applicable | Working exploit published | Buffer overflow in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to execute arbitrary code via an HTTP request with a long User-Agent header. |
| CVE-2005-1087 | Medium | 2005-04-07 | Not applicable | Working exploit published | CRLF injection vulnerability in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to spoof or hide entries in the logfile, and possibly read files using an injected type command, via CRLF sequences in an HTTP request. |
| CVE-2004-0942 | Medium | 2005-02-09 | Not applicable | Working exploit published | Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters. |
| CVE-2004-0940 | High | 2005-02-09 | Not applicable | Working exploit published | Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error. |
| CVE-2004-2628 | Medium | 2004-12-31 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in thttpd 2.07 beta 0.4, when running on Windows, allow remote attackers to read arbitrary files via a URL that contains (1) a hex-encoded backslash dot-dot sequence ("%5C..") or (2) a drive letter (such as "C:"). |
| CVE-2004-2271 | High | 2004-12-31 | Not applicable | Working exploit published | Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. |
| CVE-2004-2171 | Medium | 2004-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Cherokee before 0.4.8 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly quoted in the resulting error page. |
| CVE-2004-2115 | Medium | 2004-12-31 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request. |
| CVE-2004-2096 | Medium | 2004-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Mephistoles httpd 0.6.0 final allows remote attackers to execute arbitrary script as other users by injecting arbitrary HTML or script into the URL. |
| CVE-2004-0349 | Medium | 2004-11-23 | Not applicable | Working exploit published | Directory traversal vulnerability in GWeb HTTP Server 0.6 allows remote attackers to view arbitrary files via a .. (dot dot) in the URL. |
| CVE-2004-0292 | High | 2004-11-23 | Not applicable | Working exploit published | Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request. |
| CVE-2004-0264 | Medium | 2004-11-23 | Not applicable | Working exploit published | palmhttpd for PalmOS allows remote attackers to cause a denial of service (crash) by establishing two simultaneous HTTP connections, which exceeds the PalmOS accept queue. |
| CVE-2004-0751 | Medium | 2004-10-20 | Not applicable | Working exploit published | The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault). |
| CVE-2004-0493 | Medium | 2004-08-06 | Not applicable | Working exploit published | The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters. |
| CVE-2004-2035 | Medium | 2004-05-26 | Not applicable | Working exploit published | MiniShare 1.3.2 allows remote attackers to cause a denial of service (crash) via a malformed HTTP GET or HEAD request without the proper number of trailing CRLF sequences. |
| CVE-2004-2033 | Medium | 2004-05-26 | Not applicable | Working exploit published | Orenosv 0.5.9f allows remote attackers to cause a denial of service (crash) via a long HTTP GET request. |
| CVE-2004-0173 | Medium | 2004-04-15 | Not applicable | Working exploit published | Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences. |
| CVE-2003-1511 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Bajie Java HTTP Server 0.95 through 0.95zxv4 allows remote attackers to inject arbitrary web script or HTML via (1) the query string to test.txt, (2) the guestName parameter to the custMsg servlet, or (3) the cookiename parameter to the CookieExample servlet. |
| CVE-2003-1307 | Medium | 2003-12-31 | Not applicable | Working exploit published | The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP. |
| CVE-2003-1271 | Medium | 2003-12-31 | Not applicable | Working exploit published | Cross-site scripting vulnerability (XSS) in AN HTTP 1.41e allows remote attackers to execute arbitrary web script or HTML as other users via a URL containing the script. |