Apache : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2013-3060	287		DoS +Info	2013-04-21	2013-04-22	6.4	None	Remote	Low	Not required	Partial	None	Partial
The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
2	CVE-2013-2071	200		+Info	2013-06-01	2013-06-14	2.6	None	Remote	High	Not required	Partial	None	None
java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
3	CVE-2013-2067	287			2013-06-01	2013-06-14	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
4	CVE-2013-1884	119		DoS Overflow	2013-05-02	2013-05-03	5.0	None	Remote	Low	Not required	None	None	Partial
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
5	CVE-2013-1862	310		Exec Code	2013-06-10	2013-06-11	5.1	None	Remote	High	Not required	Partial	Partial	Partial
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
6	CVE-2013-1849			DoS	2013-05-02	2013-05-03	4.3	None	Remote	Medium	Not required	None	None	Partial
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
7	CVE-2013-1847			DoS	2013-05-02	2013-05-03	5.0	None	Remote	Low	Not required	None	None	Partial
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
8	CVE-2013-1846	119		DoS Overflow	2013-05-02	2013-05-03	4.0	None	Remote	Low	Single system	None	None	Partial
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
9	CVE-2013-1845	119		DoS Overflow	2013-05-02	2013-05-06	2.1	None	Remote	High	Single system	None	None	Partial
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
10	CVE-2013-1814	200	1	+Info	2013-03-13	2013-03-19	4.0	None	Remote	Low	Single system	Partial	None	None
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
11	CVE-2013-0253	16			2013-04-09	2013-04-10	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
12	CVE-2013-0248	264			2013-03-15	2013-03-18	3.3	None	Local	Medium	Not required	None	Partial	Partial
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
13	CVE-2013-0239	287		Bypass	2013-03-12	2013-06-04	5.0	None	Remote	Low	Not required	None	Partial	None
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
14	CVE-2012-6551	399		DoS	2013-04-21	2013-04-22	5.0	None	Remote	Low	Not required	None	None	Partial
The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
15	CVE-2012-6092	79		XSS	2013-04-21	2013-04-22	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
16	CVE-2012-5887	287		Bypass	2012-11-17	2013-06-04	5.0	None	Remote	Low	Not required	None	Partial	None
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
17	CVE-2012-5886	287		Bypass	2012-11-17	2013-06-04	5.0	None	Remote	Low	Not required	None	Partial	None
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
18	CVE-2012-5885	264		Bypass	2012-11-17	2013-06-04	5.0	None	Remote	Low	Not required	Partial	None	None
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
19	CVE-2012-5786	20			2012-11-04	2013-02-07	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
20	CVE-2012-5785	20			2012-11-04	2012-11-19	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
21	CVE-2012-5784	20			2012-11-04	2013-05-14	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
22	CVE-2012-5783	20			2012-11-04	2013-05-14	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
23	CVE-2012-5633	287		Bypass	2013-03-12	2013-06-04	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
24	CVE-2012-5616	255		+Info	2013-01-22	2013-04-01	1.5	None	Local	Medium	Single system	Partial	None	None
Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
25	CVE-2012-5568	16		DoS	2012-11-30	2013-03-07	5.0	None	Remote	Low	Not required	None	None	Partial
Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
26	CVE-2012-5351	287		Bypass	2012-10-09	2013-02-13	6.4	None	Remote	Low	Not required	Partial	Partial	None
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
27	CVE-2012-4558	79		XSS	2013-02-26	2013-03-06	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
28	CVE-2012-4557	399		DoS	2012-11-30	2013-02-06	5.0	None	Remote	Low	Not required	None	None	Partial
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
29	CVE-2012-4534	399		DoS	2012-12-19	2013-06-04	2.6	None	Remote	High	Not required	None	None	Partial
org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
30	CVE-2012-4501	264			2012-10-26	2012-10-26	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
31	CVE-2012-4460	119		DoS Overflow	2013-03-13	2013-03-19	5.0	None	Remote	Low	Not required	None	None	Partial
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
32	CVE-2012-4459	189		DoS Overflow	2013-03-13	2013-03-19	5.0	None	Remote	Low	Not required	None	None	Partial
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
33	CVE-2012-4458	189		DoS	2013-03-13	2013-03-19	5.0	None	Remote	Low	Not required	None	None	Partial
The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
34	CVE-2012-4446	287		Bypass	2013-03-13	2013-03-19	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
35	CVE-2012-4431	264		Bypass CSRF	2012-12-19	2013-06-04	4.3	None	Remote	Medium	Not required	None	Partial	None
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
36	CVE-2012-4418	287		Bypass	2012-10-09	2013-01-29	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
37	CVE-2012-4387	264		DoS	2012-09-05	2012-09-13	5.0	None	Remote	Low	Not required	None	None	Partial
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
38	CVE-2012-4386	352		CSRF	2012-09-05	2012-09-06	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
39	CVE-2012-3546	264		Bypass	2012-12-19	2013-06-04	4.3	None	Remote	Medium	Not required	None	Partial	None
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
40	CVE-2012-3544	20		DoS	2013-06-01	2013-06-14	5.0	None	Remote	Low	Not required	None	None	Partial
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
41	CVE-2012-3506				2012-10-25	2013-03-01	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
42	CVE-2012-3502	200		+Info	2012-08-22	2013-04-18	4.3	None	Remote	Medium	Not required	Partial	None	None
The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
43	CVE-2012-3499	79		XSS	2013-02-26	2013-03-06	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
44	CVE-2012-3467	287		Bypass	2012-08-27	2013-01-29	5.0	None	Remote	Low	Not required	None	Partial	None
Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
45	CVE-2012-3451	20			2012-09-24	2013-05-14	4.3	None	Remote	Medium	Not required	None	Partial	None
Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
46	CVE-2012-3446	20			2012-11-04	2012-11-06	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
47	CVE-2012-3376	310			2012-07-12	2012-07-16	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
48	CVE-2012-3373	79		XSS	2012-09-19	2013-03-21	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
49	CVE-2012-2733	20		DoS	2012-11-16	2013-06-04	5.0	None	Remote	Low	Not required	None	None	Partial
java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
50	CVE-2012-2687	79		XSS	2012-08-22	2013-05-29	2.6	None	Remote	High	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

Total number of vulnerabilities : 438 Page : 1 (This Page)2 3 4 5 6 7 8 9