Apache » Http Server » 2.0.38 : Security Vulnerabilities, CVEs, Published In 2002
mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.
Max CVSS
5.0
EPSS Score
2.71%
Published
2002-09-25
Updated
2021-06-06
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
Max CVSS
6.8
EPSS Score
97.14%
Published
2002-10-11
Updated
2021-06-06
Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
Max CVSS
7.5
EPSS Score
95.96%
Published
2002-08-12
Updated
2021-06-06
Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
Max CVSS
5.0
EPSS Score
13.21%
Published
2002-09-05
Updated
2021-06-06
4 vulnerabilities found