http_server Archives - CVE Vulnerability

CVE-2008-2939

Sun, 26 Feb 2023 09:09:46 +0000

Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

The post CVE-2008-2939 appeared first on CVE Vulnerability.

CVE-2008-2364

Sun, 26 Feb 2023 09:09:28 +0000

The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.

The post CVE-2008-2364 appeared first on CVE Vulnerability.

CVE-2007-1742

Sun, 26 Feb 2023 09:06:00 +0000

suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using “html_backup” and “htmleditor” under an “html” directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because “the attacks described rely on an insecure server configuration” in which the user “has write access to the document root.”

The post CVE-2007-1742 appeared first on CVE Vulnerability.

CVE-2007-1743

Sun, 26 Feb 2023 09:06:00 +0000

suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because “the attacks described rely on an insecure server configuration” in which the user “has write access to the document root.” In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.

The post CVE-2007-1743 appeared first on CVE Vulnerability.

CVE-2007-0450

Sun, 26 Feb 2023 09:05:29 +0000

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) “/” (slash), (2) “” (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

The post CVE-2007-0450 appeared first on CVE Vulnerability.

CVE-2021-33193

Thu, 23 Feb 2023 14:09:57 +0000

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

The post CVE-2021-33193 appeared first on CVE Vulnerability.