Apache Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/apache/ Sun, 26 Feb 2023 09:11:45 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png Apache Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/apache/ 32 32 CVE-2008-6879 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6879/ Sun, 26 Feb 2023 09:11:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6879/ Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.

The post CVE-2008-6879 appeared first on CVE Vulnerability.

]]> Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.

The post CVE-2008-6879 appeared first on CVE Vulnerability.

]]> CVE-2008-6682 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6682/ Sun, 26 Feb 2023 09:11:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6682/ Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) ” (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url […]

The post CVE-2008-6682 appeared first on CVE Vulnerability.

]]> Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) ” (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.

The post CVE-2008-6682 appeared first on CVE Vulnerability.

]]> CVE-2008-5519 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5519/ Sun, 26 Feb 2023 09:11:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5519/ The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to […]

The post CVE-2008-5519 appeared first on CVE Vulnerability.

]]> The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol’s requirements for requests containing Content-Length headers.

The post CVE-2008-5519 appeared first on CVE Vulnerability.

]]> CVE-2008-5515 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5515/ Sun, 26 Feb 2023 09:11:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5515/ Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.

The post CVE-2008-5515 appeared first on CVE Vulnerability.

]]> Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.

The post CVE-2008-5515 appeared first on CVE Vulnerability.

]]> CVE-2008-4308 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-4308/ Sun, 26 Feb 2023 09:10:28 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-4308/ The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.

The post CVE-2008-4308 appeared first on CVE Vulnerability.

]]> The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.

The post CVE-2008-4308 appeared first on CVE Vulnerability.

]]> CVE-2008-3271 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-3271/ Sun, 26 Feb 2023 09:09:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-3271/ Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a “synchronization problem” and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, […]

The post CVE-2008-3271 appeared first on CVE Vulnerability.

]]> Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a “synchronization problem” and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.

The post CVE-2008-3271 appeared first on CVE Vulnerability.

]]> CVE-2008-2939 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-2939/ Sun, 26 Feb 2023 09:09:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-2939/ Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

The post CVE-2008-2939 appeared first on CVE Vulnerability.

]]> Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

The post CVE-2008-2939 appeared first on CVE Vulnerability.

]]> CVE-2008-2938 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-2938/ Sun, 26 Feb 2023 09:09:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-2938/ Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists […]

The post CVE-2008-2938 appeared first on CVE Vulnerability.

]]> Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

The post CVE-2008-2938 appeared first on CVE Vulnerability.

]]> CVE-2008-2370 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-2370/ Sun, 26 Feb 2023 09:09:28 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-2370/ Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

The post CVE-2008-2370 appeared first on CVE Vulnerability.

]]> Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

The post CVE-2008-2370 appeared first on CVE Vulnerability.

]]> CVE-2008-2364 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-2364/ Sun, 26 Feb 2023 09:09:28 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-2364/ The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.

The post CVE-2008-2364 appeared first on CVE Vulnerability.

]]> The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.

The post CVE-2008-2364 appeared first on CVE Vulnerability.

]]>