List of arbitrary files on Web host via nph-test-cgi script.
Max CVSS
7.5
EPSS Score
0.44%
Published
1996-12-10
Updated
2022-08-17
Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.
Max CVSS
7.5
EPSS Score
0.14%
Published
1997-09-01
Updated
2022-08-17
ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
Max CVSS
7.5
EPSS Score
0.28%
Published
1997-01-01
Updated
2022-08-17

CVE-1999-1053

Public exploit
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
Max CVSS
7.5
EPSS Score
94.36%
Published
1999-09-13
Updated
2008-09-05
The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
Max CVSS
7.5
EPSS Score
0.88%
Published
2001-11-28
Updated
2017-07-11
Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers.
Max CVSS
7.5
EPSS Score
0.13%
Published
2001-12-31
Updated
2017-07-11
Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
Max CVSS
7.5
EPSS Score
10.76%
Published
2002-03-21
Updated
2024-01-26
mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attackers to call possibly dangerous functions from the imported module.
Max CVSS
7.5
EPSS Score
2.79%
Published
2002-05-16
Updated
2008-09-05
Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields (1) TITLE, (2) DESCTIT, (3) DESC, (4) searchstring, (5) ALIAS, (6) EMAIL, (7) ADDRESS1, (8) ADDRESS2, (9) ADDRESS3, (10) PHONE1, (11) PHONE2, (12) PHONE3, or (13) PHONE4.
Max CVSS
7.5
EPSS Score
5.87%
Published
2002-05-29
Updated
2016-10-18

CVE-2002-0392

Public exploit
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
Max CVSS
7.5
EPSS Score
75.28%
Published
2002-07-03
Updated
2021-07-15
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
Max CVSS
7.5
EPSS Score
0.25%
Published
2002-08-12
Updated
2019-03-25
Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
Max CVSS
7.5
EPSS Score
95.96%
Published
2002-08-12
Updated
2021-06-06
Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
Max CVSS
7.5
EPSS Score
1.47%
Published
2002-07-23
Updated
2019-03-25
The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
Max CVSS
7.2
EPSS Score
0.09%
Published
2002-10-11
Updated
2022-09-23
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
Max CVSS
7.5
EPSS Score
0.51%
Published
2002-10-11
Updated
2021-06-06
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
Max CVSS
7.5
EPSS Score
0.26%
Published
2003-01-17
Updated
2019-03-25
mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
Max CVSS
7.5
EPSS Score
0.42%
Published
2002-12-31
Updated
2024-02-09
PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
Max CVSS
7.5
EPSS Score
28.80%
Published
2002-12-31
Updated
2008-09-05
Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
Max CVSS
7.8
EPSS Score
0.72%
Published
2002-12-31
Updated
2017-07-29
Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
Max CVSS
7.5
EPSS Score
5.86%
Published
2003-02-07
Updated
2021-06-06
Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.
Max CVSS
7.2
EPSS Score
0.10%
Published
2003-11-03
Updated
2021-06-06
mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
Max CVSS
7.5
EPSS Score
0.38%
Published
2004-03-03
Updated
2021-06-06
mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
Max CVSS
7.5
EPSS Score
0.34%
Published
2004-03-29
Updated
2021-06-06
Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."
Max CVSS
7.5
EPSS Score
35.31%
Published
2004-05-04
Updated
2024-02-15
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
Max CVSS
7.5
EPSS Score
57.48%
Published
2004-07-07
Updated
2022-09-23
572 vulnerabilities found
1 2 3 4 5 6 ...... 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!