WaratekVRT Sign in

High Http Server CVEs

10 CVEs, 1 exploited

Reset
More filters (1)
Columns
Product http server✕
Overview 10 matches · 0 protected · 1 exploited · 1 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
10matches 0protected0.0% 1exploited10.0% 1CISA KEV10.0% 3public PoC30.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 30.0% No exploit published 7 70.0%
Critical 0 0.0% High 10 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 10.0% Working exploit published 2 20.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 70.0%
split by peak 3 / year
No exploit published: 7Mitigation candidate: 3 High: 10 not blocked: 10 No public exploit: 7Working exploit published: 2Exploited: 1
20021 Mitigation candidate1 High1 not blocked1 Working exploit published1 20030 20040 20050 20061 No exploit published1 High1 not blocked1 No public exploit1 20071 No exploit published1 High1 not blocked1 No public exploit1 20080 20090 20100 20110 20121 No exploit published1 High1 not blocked1 No public exploit1 20130 20140 20150 20160 20171 No exploit published1 High1 not blocked1 No public exploit1 20180 20190 20200 20211 Mitigation candidate1 High1 not blocked1 Working exploit published1 20223 No exploit published3 High3 not blocked3 No public exploit3 20231 Mitigation candidate1 High1 not blocked1 Exploited1
20032005200720092011201320152017201920212023
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-21593 High 2022-10-18 No exploit published No public exploit Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data as well as unauthorized update, insert or delete access to some of Oracle HTTP Server accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
CVE-2020-26185 High 2022-06-01 No exploit published No public exploit Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability.
CVE-2020-26184 High 2022-06-01 No exploit published No public exploit Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability.
CVE-2021-42697 High 2021-11-02 Mitigation candidate Working exploit published Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
CVE-2017-1000118 High 2017-10-05 No exploit published No public exploit Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
CVE-2012-5955 High 2012-12-20 No exploit published No public exploit Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2007-0279 High 2007-01-17 No exploit published No public exploit Multiple unspecified vulnerabilities in Oracle HTTP Server 9.2.0.8 and Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, aka (1) OHS01, (2) OHS02, (3) OHS05, (4) OHS06, and (5) OHS07.
CVE-2006-5350 High 2006-10-18 No exploit published No public exploit Unspecified vulnerability in Oracle HTTP Server 9.2.0.7 and Oracle E-Business Suite and Applications 11.5.10CU2 has unknown impact and local attack vectors, aka Vuln# OHS08.
CVE-2002-2272 High 2002-12-31 Mitigation candidate Working exploit published Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.