CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apache : Security Vulnerabilities (CVSS score between 7 and 7.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
201 CVE-2002-2029 2002-12-31 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
202 CVE-2002-1394 Bypass 2003-01-17 2017-10-09
7.5
User Remote Low Not required Partial Partial Partial
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
203 CVE-2002-0843 DoS Exec Code Overflow 2002-10-11 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
204 CVE-2002-0839 DoS 2002-10-11 2016-10-17
7.2
Admin Local Low Not required Complete Complete Complete
The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
205 CVE-2002-0682 XSS 2002-07-23 2017-10-09
7.5
User Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
206 CVE-2002-0661 Exec Code Dir. Trav. 2002-08-12 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
207 CVE-2002-0493 254 Bypass 2002-08-12 2016-10-24
7.5
User Remote Low Not required Partial Partial Partial
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
208 CVE-2002-0392 DoS Exec Code 2002-07-03 2008-09-10
7.5
User Remote Low Not required Partial Partial Partial
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
209 CVE-2002-0257 XSS +Info 2002-05-29 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other users via the form fields (1) TITLE, (2) DESCTIT, (3) DESC, (4) searchstring, (5) ALIAS, (6) EMAIL, (7) ADDRESS1, (8) ADDRESS2, (9) ADDRESS3, (10) PHONE1, (11) PHONE2, (12) PHONE3, or (13) PHONE4.
210 CVE-2002-0185 2002-05-16 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
mod_python version 2.7.6 and earlier allows a module indirectly imported by a published module to then be accessed via the publisher, which allows remote attackers to call possibly dangerous functions from the imported module.
211 CVE-2002-0061 Exec Code 2002-03-21 2016-10-17
7.5
User Remote Low Not required Partial Partial Partial
Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
212 CVE-2001-1563 2001-12-31 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers.
213 CVE-2001-1449 2001-11-28 2017-07-10
7.5
User Remote Low Not required Partial Partial Partial
The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
214 CVE-2001-0766 Bypass 2001-10-18 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.
215 CVE-1999-1053 Exec Code 1999-09-13 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
216 CVE-1999-0071 Overflow 1997-09-01 2008-09-09
7.5
User Remote Low Not required Partial Partial Partial
Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.
217 CVE-1999-0045 1996-12-10 2008-09-09
7.5
None Remote Low Not required Partial Partial Partial
List of arbitrary files on Web host via nph-test-cgi script.
Total number of vulnerabilities : 217   Page : 1 2 3 4 5 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.