· 7 years ago · Aug 04, 2019, 07:32 AM
1#####################################################################################################################################
2=======================================================================================================================================
3Hostname www.egw.co.jp ISP KDDI Web Communications Inc.
4Continent Asia Flag
5JP
6Country Japan Country Code JP
7Region Unknown Local time 02 Aug 2019 14:58 JST
8City Unknown Postal Code Unknown
9IP Address 150.60.195.62 Latitude 35.69
10 Longitude 139.69
11
12======================================================================================================================================
13#####################################################################################################################################
14> www.egw.co.jp
15Server: 185.93.180.131
16Address: 185.93.180.131#53
17
18Non-authoritative answer:
19www.egw.co.jp canonical name = egw.co.jp.
20Name: egw.co.jp
21Address: 150.60.195.62
22>
23########################################################################################################################################
24[ JPRS database provides information on network administration. Its use is ]
25[ restricted to network administration purposes. For further information, ]
26[ use 'whois -h whois.jprs.jp help'. To suppress Japanese output, add'/e' ]
27[ at the end of command, e.g. 'whois -h whois.jprs.jp xxx/e'. ]
28
29Domain Information:
30a. [Domain Name] EGW.CO.JP
31g. [Organization] Life Support Egawa Co.,Ltd.
32l. [Organization Type] Company
33m. [Administrative Contact] NE2558JP
34n. [Technical Contact] NE2558JP
35p. [Name Server] 01.dnsv.jp
36p. [Name Server] 02.dnsv.jp
37p. [Name Server] 03.dnsv.jp
38p. [Name Server] 04.dnsv.jp
39s. [Signing Key]
40[State] Connected (2019/10/31)
41[Registered Date] 2014/10/14
42[Connected Date] 2014/10/14
43[Last Update] 2018/11/01 01:04:10 (JST)
44######################################################################################################################################
45[+] Target : www.egw.co.jp
46
47[+] IP Address : 150.60.195.62
48
49[+] Headers :
50
51[+] Date : Sun, 04 Aug 2019 01:43:56 GMT
52[+] Server : Apache
53[+] X-Powered-By : PHP/7.1.23
54[+] Expires : Wed, 11 Jan 1984 05:00:00 GMT
55[+] Cache-Control : no-cache, must-revalidate, max-age=0
56[+] Link : <https://www.egw.co.jp/wp-json/>; rel="https://api.w.org/"
57[+] Vary : Accept-Encoding
58[+] Content-Encoding : gzip
59[+] Content-Length : 9789
60[+] Connection : close
61[+] Content-Type : text/html; charset=UTF-8
62
63[+] SSL Certificate Information :
64
65[+] commonName : www.egw.co.jp
66[+] countryName : JP
67[+] organizationName : SECOM Trust Systems CO.,LTD.
68[+] commonName : KDDI Web Communications Certification Authority 3
69[+] Version : 3
70[+] Serial Number : 380915C6175EE689
71[+] Not Before : Dec 21 03:54:31 2018 GMT
72[+] Not After : Dec 27 14:59:59 2019 GMT
73[+] OCSP : ('http://kddiweb3.ocsp.secomtrust.net',)
74[+] subject Alt Name : (('DNS', 'www.egw.co.jp'),)
75
76[+] Whois Lookup :
77
78[+] NIR : {'query': '150.60.195.62', 'raw': None, 'nets': [{'cidr': '150.60.0.0/16', 'name': 'KDDI Web Communications Inc.', 'handle': 'KWC-NET', 'range': '150.60.0.1 - 150.60.255.255', 'country': 'JP', 'address': None, 'postal_code': None, 'nameservers': ['ns0.cpi.ad.jp', 'ns1.cpi.ad.jp', 'ns2.cpi.ad.jp', 'ns3.cpi.ad.jp', 'ns4.cpi.ad.jp', 'ns5.cpi.ad.jp', 'ns6.cpi.ad.jp', 'ns7.cpi.ad.jp'], 'created': None, 'updated': '2016-09-29T09:59:06', 'contacts': {'admin': {'name': 'Morikawa, Yoshihiko', 'email': 'tech@cpi.ad.jp', 'reply_email': 'tech@cpi.ad.jp\ntech@kddi-web.com', 'organization': 'KDDI Web Communications Inc.', 'division': '', 'title': '', 'phone': '03-6371-1900', 'fax': '', 'updated': '2016-09-30T06:14:05'}, 'tech': {'name': 'Morikawa, Yoshihiko', 'email': 'tech@cpi.ad.jp', 'reply_email': 'tech@cpi.ad.jp\ntech@kddi-web.com', 'organization': 'KDDI Web Communications Inc.', 'division': '', 'title': '', 'phone': '03-6371-1900', 'fax': '', 'updated': '2016-09-30T06:14:05'}}}]}
79[+] ASN Registry : apnic
80[+] ASN : 9597
81[+] ASN CIDR : 150.60.0.0/16
82[+] ASN Country Code : JP
83[+] ASN Date : 1997-03-31
84[+] ASN Description : CPI-NET KDDI Web Communications Inc., JP
85[+] cidr : 150.26.0.0/15, 150.28.0.0/14, 150.32.0.0/11, 150.64.0.0/12, 150.80.0.0/13, 150.88.0.0/14, 150.92.0.0/15, 150.94.0.0/16, 150.95.0.0/20
86[+] name : JAPAN150
87[+] handle : JNIC1-AP
88[+] range : 150.26.0.0 - 150.95.15.255
89[+] description : Japan Network Information Center
90[+] country : JP
91[+] state : None
92[+] city : None
93[+] address : Urbannet-Kanda Bldg 4F, 3-6-2 Uchi-Kanda
94Chiyoda-ku, Tokyo 101-0047, Japan
95[+] postal_code : None
96[+] emails : ['hostmaster@nic.ad.jp']
97[+] created : None
98[+] updated : None
99
100[+] Crawling Target...
101
102[+] Looking for robots.txt........[ Found ]
103[+] Extracting robots Links.......[ 2 ]
104[+] Looking for sitemap.xml.......[ Not Found ]
105[+] Extracting CSS Links..........[ 9 ]
106[+] Extracting Javascript Links...[ 16 ]
107[+] Extracting Internal Links.....[ 31 ]
108[+] Extracting External Links.....[ 1 ]
109[+] Extracting Images.............[ 8 ]
110
111[+] Total Links Extracted : 67
112
113[+] Dumping Links in /opt/FinalRecon/dumps/www.egw.co.jp.dump
114[+] Completed!
115#####################################################################################################################################
116[+] Starting At 2019-08-03 21:43:59.800483
117[+] Collecting Information On: https://www.egw.co.jp/
118[#] Status: 200
119--------------------------------------------------
120[#] Web Server Detected: Apache
121[#] X-Powered-By: PHP/7.1.23
122[!] X-Frame-Options Headers not detect! target might be vulnerable Click Jacking
123- Date: Sun, 04 Aug 2019 01:43:57 GMT
124- Server: Apache
125- X-Powered-By: PHP/7.1.23
126- Expires: Wed, 11 Jan 1984 05:00:00 GMT
127- Cache-Control: no-cache, must-revalidate, max-age=0
128- Link: <https://www.egw.co.jp/wp-json/>; rel="https://api.w.org/"
129- Vary: Accept-Encoding
130- Content-Encoding: gzip
131- Content-Length: 9789
132- Connection: close
133- Content-Type: text/html; charset=UTF-8
134--------------------------------------------------
135[#] Finding Location..!
136[#] as: AS9597 KDDI Web Communications Inc.
137[#] city: Chiyoda
138[#] country: Japan
139[#] countryCode: JP
140[#] isp: CPI
141[#] lat: 35.6906
142[#] lon: 139.77
143[#] org: KDDI Web Communications Inc.
144[#] query: 150.60.195.62
145[#] region: 13
146[#] regionName: Tokyo
147[#] status: success
148[#] timezone: Asia/Tokyo
149[#] zip: 100-0001
150--------------------------------------------------
151[x] Didn't Detect WAF Presence on: https://www.egw.co.jp/
152--------------------------------------------------
153[#] Starting Reverse DNS
154[-] Failed ! Fail
155--------------------------------------------------
156[!] Scanning Open Port
157[#] 21/tcp open ftp
158[#] 80/tcp open http
159[#] 443/tcp open https
160--------------------------------------------------
161[+] Collecting Information Disclosure!
162[#] Detecting sitemap.xml file
163[-] sitemap.xml file not Found!?
164[#] Detecting robots.txt file
165[!] robots.txt File Found: https://www.egw.co.jp//robots.txt
166[#] Detecting GNU Mailman
167[-] GNU Mailman App Not Detected!?
168--------------------------------------------------
169[+] Crawling Url Parameter On: https://www.egw.co.jp/
170--------------------------------------------------
171[#] Searching Html Form !
172[-] No Html Form Found!?
173--------------------------------------------------
174[!] Found 3 dom parameter
175[#] https://www.egw.co.jp//#no
176[#] https://www.egw.co.jp//#no
177[#] https://www.egw.co.jp//#
178--------------------------------------------------
179[!] 1 Internal Dynamic Parameter Discovered
180[+] https://www.egw.co.jp/xmlrpc.php?rsd
181--------------------------------------------------
182[-] No external Dynamic Paramter Found!?
183--------------------------------------------------
184[!] 74 Internal links Discovered
185[+] https://www.egw.co.jp/wp-content/themes/support_egawa/img/favicon.png
186[+] https://www.egw.co.jp/wp-content/themes/support_egawa/bootstrap-4.0.0-beta/dist/css/bootstrap.min.css
187[+] https://www.egw.co.jp/wp-content/themes/support_egawa/css/common.css
188[+] https://www.egw.co.jp/feed/
189[+] https://www.egw.co.jp/comments/feed/
190[+] https://www.egw.co.jp/wp-includes/wlwmanifest.xml
191[+] https://www.egw.co.jp/
192[+] https://www.egw.co.jp/point/
193[+] https://www.egw.co.jp/company/
194[+] https://www.egw.co.jp/service/
195[+] https://www.egw.co.jp/service01/
196[+] https://www.egw.co.jp/service02/
197[+] https://www.egw.co.jp/service03/
198[+] https://www.egw.co.jp/case/
199[+] https://www.egw.co.jp/map/
200[+] https://www.egw.co.jp/contact/
201[+] https://www.egw.co.jp/recruit/
202[+] https://www.egw.co.jp/
203[+] https://www.egw.co.jp/point/
204[+] https://www.egw.co.jp/company/
205[+] https://www.egw.co.jp/service01/
206[+] https://www.egw.co.jp/service02/
207[+] https://www.egw.co.jp/service03/
208[+] https://www.egw.co.jp/case/
209[+] https://www.egw.co.jp/map/
210[+] https://www.egw.co.jp/contact/
211[+] https://www.egw.co.jp/recruit/
212[+] https://www.egw.co.jp/point
213[+] https://www.egw.co.jp/2019/05/20/%ef%bd%8c%ef%bd%93%ef%bd%85%ef%bc%81%e3%83%81%e3%83%a3%e3%83%aa%e3%83%86%e3%82%a3%e3%83%bc%e3%83%90%e3%82%b6%e3%83%bc%ef%bc%92%ef%bc%90%ef%bc%91%ef%bc%99%e3%82%92%e9%96%8b%e5%82%ac%e3%81%97%e3%81%be/
214[+] https://www.egw.co.jp/2019/05/20/%ef%bd%8c%ef%bd%93%ef%bd%85%ef%bc%81%e3%83%81%e3%83%a3%e3%83%aa%e3%83%86%e3%82%a3%e3%83%bc%e3%83%90%e3%82%b6%e3%83%bc%ef%bc%92%ef%bc%90%ef%bc%91%ef%bc%99%e3%82%92%e9%96%8b%e5%82%ac%e3%81%97%e3%81%be/
215[+] https://www.egw.co.jp/2019/05/20/%ef%bd%8c%ef%bd%93%ef%bd%85%ef%bc%81%e3%83%81%e3%83%a3%e3%83%aa%e3%83%86%e3%82%a3%e3%83%bc%e3%83%90%e3%82%b6%e3%83%bc%ef%bc%92%ef%bc%90%ef%bc%91%ef%bc%99%e3%82%92%e9%96%8b%e5%82%ac%e3%81%97%e3%81%be/
216[+] https://www.egw.co.jp/2019/04/01/%e5%85%a5%e7%a4%be%e5%bc%8f%e3%82%92%e9%96%8b%e5%82%ac%ef%bc%81/
217[+] https://www.egw.co.jp/2019/04/01/%e5%85%a5%e7%a4%be%e5%bc%8f%e3%82%92%e9%96%8b%e5%82%ac%ef%bc%81/
218[+] https://www.egw.co.jp/2019/04/01/%e5%85%a5%e7%a4%be%e5%bc%8f%e3%82%92%e9%96%8b%e5%82%ac%ef%bc%81/
219[+] https://www.egw.co.jp/2019/03/17/%e5%ae%89%e5%85%a8%e6%84%8f%e8%ad%98%e3%82%92%e5%86%8d%e8%aa%8d%e8%ad%98%e3%80%81%e4%ba%8b%e6%95%85%e6%92%b2%e6%bb%85%e7%b7%8f%e6%b1%ba%e8%b5%b7%e5%a4%a7%e4%bc%9a%e3%81%8c%e8%a1%8c%e3%82%8f%e3%82%8c/
220[+] https://www.egw.co.jp/2019/03/17/%e5%ae%89%e5%85%a8%e6%84%8f%e8%ad%98%e3%82%92%e5%86%8d%e8%aa%8d%e8%ad%98%e3%80%81%e4%ba%8b%e6%95%85%e6%92%b2%e6%bb%85%e7%b7%8f%e6%b1%ba%e8%b5%b7%e5%a4%a7%e4%bc%9a%e3%81%8c%e8%a1%8c%e3%82%8f%e3%82%8c/
221[+] https://www.egw.co.jp/2019/03/17/%e5%ae%89%e5%85%a8%e6%84%8f%e8%ad%98%e3%82%92%e5%86%8d%e8%aa%8d%e8%ad%98%e3%80%81%e4%ba%8b%e6%95%85%e6%92%b2%e6%bb%85%e7%b7%8f%e6%b1%ba%e8%b5%b7%e5%a4%a7%e4%bc%9a%e3%81%8c%e8%a1%8c%e3%82%8f%e3%82%8c/
222[+] https://www.egw.co.jp/2019/03/13/%e6%96%b0%e8%bb%8a%e7%b4%8d%e8%bb%8a%e5%ae%89%e5%85%a8%e7%a5%88%e9%a1%98%e7%a5%ad%e3%82%92%e9%96%8b%e5%82%ac-4/
223[+] https://www.egw.co.jp/2019/03/13/%e6%96%b0%e8%bb%8a%e7%b4%8d%e8%bb%8a%e5%ae%89%e5%85%a8%e7%a5%88%e9%a1%98%e7%a5%ad%e3%82%92%e9%96%8b%e5%82%ac-4/
224[+] https://www.egw.co.jp/2019/03/13/%e6%96%b0%e8%bb%8a%e7%b4%8d%e8%bb%8a%e5%ae%89%e5%85%a8%e7%a5%88%e9%a1%98%e7%a5%ad%e3%82%92%e9%96%8b%e5%82%ac-4/
225[+] https://www.egw.co.jp/2019/01/26/%ef%bc%92%ef%bc%90%ef%bc%91%ef%bc%99%e5%b9%b4%e5%b9%b9%e9%83%a8%e4%bc%9a%e3%81%8c%e8%a1%8c%e3%82%8f%e3%82%8c%e3%81%be%e3%81%97%e3%81%9f/
226[+] https://www.egw.co.jp/2019/01/26/%ef%bc%92%ef%bc%90%ef%bc%91%ef%bc%99%e5%b9%b4%e5%b9%b9%e9%83%a8%e4%bc%9a%e3%81%8c%e8%a1%8c%e3%82%8f%e3%82%8c%e3%81%be%e3%81%97%e3%81%9f/
227[+] https://www.egw.co.jp/2019/01/26/%ef%bc%92%ef%bc%90%ef%bc%91%ef%bc%99%e5%b9%b4%e5%b9%b9%e9%83%a8%e4%bc%9a%e3%81%8c%e8%a1%8c%e3%82%8f%e3%82%8c%e3%81%be%e3%81%97%e3%81%9f/
228[+] https://www.egw.co.jp/news
229[+] https://www.egw.co.jp/service01
230[+] https://www.egw.co.jp/service02
231[+] https://www.egw.co.jp/service03
232[+] https://www.egw.co.jp/case
233[+] https://www.egw.co.jp/support_egawa/map/
234[+] https://www.egw.co.jp/recruit
235[+] https://www.egw.co.jp/contact/
236[+] https://www.egw.co.jp/
237[+] https://www.egw.co.jp/point
238[+] https://www.egw.co.jp/company
239[+] https://www.egw.co.jp/service
240[+] https://www.egw.co.jp/service01
241[+] https://www.egw.co.jp/service02
242[+] https://www.egw.co.jp/service03
243[+] https://www.egw.co.jp/case
244[+] https://www.egw.co.jp/map
245[+] https://www.egw.co.jp/contact
246[+] https://www.egw.co.jp/recruit
247[+] https://www.egw.co.jp/privacy
248[+] https://www.egw.co.jp//
249[+] https://www.egw.co.jp/point/
250[+] https://www.egw.co.jp/company/
251[+] https://www.egw.co.jp/service01/
252[+] https://www.egw.co.jp/service02/
253[+] https://www.egw.co.jp/service03/
254[+] https://www.egw.co.jp/case/
255[+] https://www.egw.co.jp/map/
256[+] https://www.egw.co.jp/contact/
257[+] https://www.egw.co.jp/recruit/
258[+] https://www.egw.co.jp/privacy/
259--------------------------------------------------
260[!] 5 External links Discovered
261[#] http://gmpg.org/xfn/11
262[#] https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css
263[#] https://jaysalvat.github.io/vegas/releases/latest/vegas.min.css
264[#] https://fonts.googleapis.com/earlyaccess/notosansjapanese.css
265[#] https://www.facebook.com/LIFESUPPORTEGAWA/
266--------------------------------------------------
267[#] Mapping Subdomain..
268[!] Found 1 Subdomain
269- egw.co.jp
270--------------------------------------------------
271[!] Done At 2019-08-03 21:44:50.686299
272#######################################################################################################################################
273Trying "egw.co.jp"
274;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13683
275;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 4, ADDITIONAL: 6
276
277;; QUESTION SECTION:
278;egw.co.jp. IN ANY
279
280;; ANSWER SECTION:
281egw.co.jp. 3600 IN TXT "v=spf1 include:spf.protection.outlook.com -all"
282egw.co.jp. 3600 IN TXT "MS=ms94704371"
283egw.co.jp. 3600 IN MX 0 egw-co-jp.mail.protection.outlook.com.
284egw.co.jp. 3600 IN A 150.60.195.62
285egw.co.jp. 43200 IN SOA 01.dnsv.jp. hostmaster.dnsv.jp. 1517532620 3600 900 604800 300
286egw.co.jp. 43200 IN NS 04.dnsv.jp.
287egw.co.jp. 43200 IN NS 01.dnsv.jp.
288egw.co.jp. 43200 IN NS 03.dnsv.jp.
289egw.co.jp. 43200 IN NS 02.dnsv.jp.
290
291;; AUTHORITY SECTION:
292egw.co.jp. 43200 IN NS 04.dnsv.jp.
293egw.co.jp. 43200 IN NS 03.dnsv.jp.
294egw.co.jp. 43200 IN NS 02.dnsv.jp.
295egw.co.jp. 43200 IN NS 01.dnsv.jp.
296
297;; ADDITIONAL SECTION:
29801.dnsv.jp. 23262 IN A 157.7.32.53
29902.dnsv.jp. 4750 IN A 157.7.33.53
30003.dnsv.jp. 23262 IN A 157.7.32.35
30103.dnsv.jp. 23262 IN AAAA 2400:8500:3000::53
30204.dnsv.jp. 23262 IN A 157.7.33.35
30304.dnsv.jp. 23262 IN AAAA 2400:8500:3fff::53
304
305Received 477 bytes from 2001:18c0:121:6900:724f:b8ff:fefd:5b6a#53 in 234 ms
306#####################################################################################################################################
307; <<>> DiG 9.11.5-P4-5.1-Debian <<>> +trace egw.co.jp any
308;; global options: +cmd
309. 84456 IN NS b.root-servers.net.
310. 84456 IN NS f.root-servers.net.
311. 84456 IN NS j.root-servers.net.
312. 84456 IN NS d.root-servers.net.
313. 84456 IN NS e.root-servers.net.
314. 84456 IN NS h.root-servers.net.
315. 84456 IN NS c.root-servers.net.
316. 84456 IN NS g.root-servers.net.
317. 84456 IN NS a.root-servers.net.
318. 84456 IN NS k.root-servers.net.
319. 84456 IN NS m.root-servers.net.
320. 84456 IN NS l.root-servers.net.
321. 84456 IN NS i.root-servers.net.
322. 84456 IN RRSIG NS 8 0 518400 20190817050000 20190804040000 59944 . F7fzmi95BrYtOTREXfXA2wWtkw0Rmw/tAxgwx0goUx1S6i7yLHhQa2s2 B3KaRJ6gAHY+a8B5XC6aYE34JCEWjeY+XSpClj7FoaxFRhDnYEbQdhmJ yv7+uHAO05QV4P1FA7SccEsTHR6uQkyjm4sx9RW+qIKvZiN7kd8ZQ3T7 Y8evJ6cCsuHOJy06mJw1ghMAwXlDtWa+CY2LyLuz+n30SBCnJVkfQQL6 r3wimSNcs3DkXcLoI9TILtQUlrCW+fDJms6NtpkqFweGsJAGPcOBmcQm T10XeKWfG8VYLAi62RD3bgUY2oB7SzPn4KxM0P2ja4KRQI+vPej4nyZs EbNGvw==
323;; Received 525 bytes from 185.93.180.131#53(185.93.180.131) in 224 ms
324
325jp. 172800 IN NS e.dns.jp.
326jp. 172800 IN NS h.dns.jp.
327jp. 172800 IN NS a.dns.jp.
328jp. 172800 IN NS c.dns.jp.
329jp. 172800 IN NS f.dns.jp.
330jp. 172800 IN NS b.dns.jp.
331jp. 172800 IN NS d.dns.jp.
332jp. 172800 IN NS g.dns.jp.
333jp. 86400 IN DS 54004 8 2 5F4B24F667BC70880720D10DF317DC8FF80C63E586D504E6BBFE53F0 B9ECC040
334jp. 86400 IN DS 54004 8 1 0EC348CC7E6D3213CC89E5867088043FC7D5C111
335jp. 86400 IN RRSIG DS 8 1 86400 20190817050000 20190804040000 59944 . JmEmdm39jzYWZEbd0D76gH9m8dQYZnPdxy3H//C0vzVHSehyVvQGcFqn BB4zgREgaTOO6ZPGy+Jgi4iDHU1GzSUYT+gm5prAqHfjZEoZe3KksCpL t9vS5dCm44mWlxfEB2RTvZFy9O40EFkVGyr2qQrnG0LrDhBGoLXQz5W9 F44j/PESFSFef4B9z4Upvmvyfu263xjd1eHUXgT2nUG8vR1sFukQRXi5 ichOgdckXn5hlNiIJ5VhCKKeDNblIMLjjAmUMGsWWuMdmvqLF2NTuOMZ zyN66g0R0S3Hf6WmaOJ9e6ieYetQjRveISuoyu7/VL3qEgxlodftvhJN LVQprw==
336;; Received 893 bytes from 2001:500:200::b#53(b.root-servers.net) in 75 ms
337
338egw.co.jp. 86400 IN NS 02.dnsv.jp.
339egw.co.jp. 86400 IN NS 03.dnsv.jp.
340egw.co.jp. 86400 IN NS 04.dnsv.jp.
341egw.co.jp. 86400 IN NS 01.dnsv.jp.
3420PSDMSCJA8KIOGTU909I5GRFKRS7C22T.jp. 900 IN NSEC3 1 1 8 FE147A6D36 0PUVUJ79ISO0FKAF1V1ANMQJ4P3OASUM TXT RRSIG
3430PSDMSCJA8KIOGTU909I5GRFKRS7C22T.jp. 900 IN RRSIG NSEC3 8 2 900 20190902174502 20190803174502 41763 jp. hDvr/KfoJqkRKXw8Hxe/lFq2iBxQn6jCn2dqORRHTk9te2YbQXEUef5c yXRSjT0QBit1JKh+R4n3+Ve2BcioxPLWXiOOQvI3APd4SJhXGYpVkOri O1cTduxFFfACntFrLgxhf0BN9euP6UpnvjR8cgtik5+Q+w8HmNGt0b5G PNk=
344E414EFUPCSCUDBN1GMUGR88472834OMQ.jp. 900 IN NSEC3 1 1 8 FE147A6D36 E4QL4M0JGJ9CD002H6PVAKHG4GT45MK3 TXT RRSIG
345E414EFUPCSCUDBN1GMUGR88472834OMQ.jp. 900 IN RRSIG NSEC3 8 2 900 20190902174502 20190803174502 41763 jp. lqpmO/wHctuVDRrcvwuF+2GsFtvoCtlMFVhVLiy7dOR6C1alCqF/yVRX 1X3B7M4RTriDixyhqGn4Mm7bT3DZvUchyIVGbiETB8lxN/3eEKSnqMVu VRYpEF4roY1LqiQBcjx9VC622V9nWdjULKsntyBjODaxeRIiyeUTr2x5 PtY=
346;; Received 751 bytes from 2001:240::53#53(d.dns.jp) in 52 ms
347
348egw.co.jp. 86400 IN SOA 01.dnsv.jp. hostmaster.dnsv.jp. 1517532620 3600 900 604800 300
349egw.co.jp. 86400 IN NS 01.dnsv.jp.
350egw.co.jp. 86400 IN NS 02.dnsv.jp.
351egw.co.jp. 86400 IN NS 03.dnsv.jp.
352egw.co.jp. 86400 IN NS 04.dnsv.jp.
353egw.co.jp. 3600 IN A 150.60.195.62
354egw.co.jp. 3600 IN MX 0 egw-co-jp.mail.protection.outlook.com.
355egw.co.jp. 3600 IN TXT "v=spf1 include:spf.protection.outlook.com -all"
356egw.co.jp. 3600 IN TXT "MS=ms94704371"
357;; Received 342 bytes from 2400:8500:3000::53#53(03.dnsv.jp) in 189 ms
358#####################################################################################################################################
359[-] DNSSEC is not configured for egw.co.jp
360[*] SOA 01.dnsv.jp 157.7.32.53
361[*] NS 03.dnsv.jp 157.7.32.35
362[*] NS 03.dnsv.jp 2400:8500:3000::53
363[*] NS 04.dnsv.jp 157.7.33.35
364[*] NS 04.dnsv.jp 2400:8500:3fff::53
365[*] NS 02.dnsv.jp 157.7.33.53
366[*] NS 01.dnsv.jp 157.7.32.53
367[*] MX egw-co-jp.mail.protection.outlook.com 104.47.93.36
368[*] MX egw-co-jp.mail.protection.outlook.com 104.47.92.36
369[*] A egw.co.jp 150.60.195.62
370[*] TXT egw.co.jp MS=ms94704371
371[*] TXT egw.co.jp v=spf1 include:spf.protection.outlook.com -all
372[*] Enumerating SRV Records
373[*] SRV _sipfederationtls._tcp.egw.co.jp sipfed.online.lync.com 52.112.193.13 5061 1
374[*] SRV _sipfederationtls._tcp.egw.co.jp sipfed.online.lync.com 2603:1027:0:2::b 5061 1
375[*] SRV _sip._tls.egw.co.jp sipdir.online.lync.com 52.112.192.139 443 1
376[*] SRV _sip._tls.egw.co.jp sipdir.online.lync.com 2603:1027::b 443 1
377[+] 4 Records Found
378#####################################################################################################################################
379[*] Processing domain egw.co.jp
380[*] Using system resolvers ['185.93.180.131', '194.187.251.67', '38.132.106.139', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
381[+] Getting nameservers
382157.7.32.35 - 03.dnsv.jp
383157.7.33.35 - 04.dnsv.jp
384157.7.33.53 - 02.dnsv.jp
385157.7.32.53 - 01.dnsv.jp
386[-] Zone transfer failed
387
388[+] TXT records found
389"MS=ms94704371"
390"v=spf1 include:spf.protection.outlook.com -all"
391
392[+] MX records found, added to target list
3930 egw-co-jp.mail.protection.outlook.com.
394
395[*] Scanning egw.co.jp for A records
396150.60.195.62 - egw.co.jp
39740.101.136.24 - autodiscover.egw.co.jp
39840.101.138.216 - autodiscover.egw.co.jp
39940.101.137.8 - autodiscover.egw.co.jp
40040.101.136.248 - autodiscover.egw.co.jp
401150.60.195.62 - ftp.egw.co.jp
40252.112.193.16 - lyncdiscover.egw.co.jp
40340.126.1.166 - msoid.egw.co.jp
40440.126.1.130 - msoid.egw.co.jp
40540.126.1.128 - msoid.egw.co.jp
40620.190.129.2 - msoid.egw.co.jp
40720.190.129.160 - msoid.egw.co.jp
40852.112.192.11 - sip.egw.co.jp
409150.60.195.62 - www.egw.co.jp
410#####################################################################################################################################
411
412
413
414 AVAILABLE PLUGINS
415 -----------------
416
417 OpenSslCipherSuitesPlugin
418 CertificateInfoPlugin
419 HeartbleedPlugin
420 SessionRenegotiationPlugin
421 CompressionPlugin
422 HttpHeadersPlugin
423 SessionResumptionPlugin
424 OpenSslCcsInjectionPlugin
425 FallbackScsvPlugin
426 RobotPlugin
427 EarlyDataPlugin
428
429
430
431 CHECKING HOST(S) AVAILABILITY
432 -----------------------------
433
434 150.60.195.62:443 => 150.60.195.62
435
436
437
438
439 SCAN RESULTS FOR 150.60.195.62:443 - 150.60.195.62
440 --------------------------------------------------
441
442 * Certificate Information:
443 Content
444 SHA1 Fingerprint: af0c13c8c5c658939b4aab5831058ccb12fccef0
445 Common Name: www.egw.co.jp
446 Issuer: KDDI Web Communications Certification Authority 3
447 Serial Number: 4037782481454163593
448 Not Before: 2018-12-21 03:54:31
449 Not After: 2019-12-27 14:59:59
450 Signature Algorithm: sha256
451 Public Key Algorithm: RSA
452 Key Size: 2048
453 Exponent: 65537 (0x10001)
454 DNS Subject Alternative Names: ['www.egw.co.jp']
455
456 Trust
457 Hostname Validation: FAILED - Certificate does NOT match 150.60.195.62
458 Android CA Store (9.0.0_r9): OK - Certificate is trusted
459 iOS CA Store (12, macOS 10.14, watchOS 5, and tvOS 12):OK - Certificate is trusted
460 Java CA Store (jdk-11.0.2): OK - Certificate is trusted
461 macOS CA Store (12, macOS 10.14, watchOS 5, and tvOS 12):OK - Certificate is trusted
462 Mozilla CA Store (2018-11-22): OK - Certificate is trusted
463 OPENJDK CA Store (jdk-11.0.2): OK - Certificate is trusted
464 Windows CA Store (2018-12-08): OK - Certificate is trusted
465 Symantec 2018 Deprecation: OK - Not a Symantec-issued certificate
466 Received Chain: www.egw.co.jp --> KDDI Web Communications Certification Authority 3
467 Verified Chain: www.egw.co.jp --> KDDI Web Communications Certification Authority 3 --> countryName=JP, organizationName=SECOM Trust Systems CO.,LTD., organizationalUnitName=Security Communication RootCA2
468 Received Chain Contains Anchor: OK - Anchor certificate not sent
469 Received Chain Order: OK - Order is valid
470 Verified Chain contains SHA1: OK - No SHA1-signed certificate in the verified certificate chain
471
472 Extensions
473 OCSP Must-Staple: NOT SUPPORTED - Extension not found
474 Certificate Transparency: OK - 3 SCTs included
475
476 OCSP Stapling
477 NOT SUPPORTED - Server did not send back an OCSP response
478
479 * OpenSSL Heartbleed:
480 OK - Not vulnerable to Heartbleed
481
482 * TLSV1_1 Cipher Suites:
483 Forward Secrecy OK - Supported
484 RC4 OK - Not Supported
485
486 Preferred:
487 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
488 Accepted:
489 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
490 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
491 TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
492 TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
493 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
494 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
495
496 * TLSV1 Cipher Suites:
497 Forward Secrecy OK - Supported
498 RC4 OK - Not Supported
499
500 Preferred:
501 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
502 Accepted:
503 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
504 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
505 TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
506 TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
507 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
508 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
509
510 * TLS 1.2 Session Resumption Support:
511 With Session IDs: NOT SUPPORTED (0 successful, 5 failed, 0 errors, 5 total attempts).
512 With TLS Tickets: OK - Supported
513
514 * TLSV1_2 Cipher Suites:
515 Forward Secrecy OK - Supported
516 RC4 OK - Not Supported
517
518 Preferred:
519 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
520 Accepted:
521 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
522 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
523 TLS_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
524 TLS_RSA_WITH_AES_256_CBC_SHA256 256 bits HTTP 200 OK
525 TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
526 TLS_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
527 TLS_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
528 TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
529 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
530 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 256 bits HTTP 200 OK
531 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
532 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
533 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
534 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
535
536 * Session Renegotiation:
537 Client-initiated Renegotiation: OK - Rejected
538 Secure Renegotiation: OK - Supported
539
540 * SSLV2 Cipher Suites:
541 Server rejected all cipher suites.
542
543 * Deflate Compression:
544 OK - Compression disabled
545
546 * Downgrade Attacks:
547 TLS_FALLBACK_SCSV: OK - Supported
548
549 * OpenSSL CCS Injection:
550 OK - Not vulnerable to OpenSSL CCS injection
551
552 * TLSV1_3 Cipher Suites:
553 Server rejected all cipher suites.
554
555 * SSLV3 Cipher Suites:
556 Server rejected all cipher suites.
557
558 * ROBOT Attack:
559 OK - Not vulnerable
560
561
562 SCAN COMPLETED IN 40.41 S
563 -------------------------
564#####################################################################################################################################
565Domains still to check: 1
566 Checking if the hostname egw.co.jp. given is in fact a domain...
567
568Analyzing domain: egw.co.jp.
569 Checking NameServers using system default resolver...
570 IP: 157.7.32.35 (Japan)
571 HostName: 03.dnsv.jp Type: NS
572 HostName: 03.dnsv.jp Type: PTR
573 IP: 157.7.33.35 (Japan)
574 HostName: 04.dnsv.jp Type: NS
575 HostName: 04.dnsv.jp Type: PTR
576 IP: 157.7.33.53 (Japan)
577 HostName: 02.dnsv.jp Type: NS
578 HostName: 02.dnsv.jp Type: PTR
579 IP: 157.7.32.53 (Japan)
580 HostName: 01.dnsv.jp Type: NS
581 HostName: 01.dnsv.jp Type: PTR
582
583 Checking MailServers using system default resolver...
584 IP: 104.47.92.36 (United States)
585 HostName: egw-co-jp.mail.protection.outlook.com Type: MX
586 HostName: mail-os2jpn010036.inbound.protection.outlook.com Type: PTR
587 IP: 104.47.93.36 (United States)
588 HostName: egw-co-jp.mail.protection.outlook.com Type: MX
589 HostName: mail-ty1jpn010036.inbound.protection.outlook.com Type: PTR
590
591 Checking the zone transfer for each NS... (if this takes more than 10 seconds, just hit CTRL-C and it will continue. Bug in the libs)
592 No zone transfer found on nameserver 157.7.32.53
593 No zone transfer found on nameserver 157.7.33.53
594 No zone transfer found on nameserver 157.7.32.35
595 No zone transfer found on nameserver 157.7.33.35
596
597 Checking SPF record...
598
599 Checking SPF record...
600 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 207.46.100.0/24, but only the network IP
601 New IP found: 207.46.100.0
602 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 207.46.163.0/24, but only the network IP
603 New IP found: 207.46.163.0
604 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 65.55.169.0/24, but only the network IP
605 New IP found: 65.55.169.0
606 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 157.56.110.0/23, but only the network IP
607 New IP found: 157.56.110.0
608 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 157.55.234.0/24, but only the network IP
609 New IP found: 157.55.234.0
610 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 213.199.154.0/24, but only the network IP
611 New IP found: 213.199.154.0
612 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 213.199.180.128/26, but only the network IP
613 New IP found: 213.199.180.128
614 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 52.100.0.0/14, but only the network IP
615 New IP found: 52.100.0.0
616
617 Checking SPF record...
618 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 157.56.112.0/24, but only the network IP
619 New IP found: 157.56.112.0
620 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 207.46.51.64/26, but only the network IP
621 New IP found: 207.46.51.64
622 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 64.4.22.64/26, but only the network IP
623 New IP found: 64.4.22.64
624 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 40.92.0.0/15, but only the network IP
625 New IP found: 40.92.0.0
626 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 40.107.0.0/16, but only the network IP
627 New IP found: 40.107.0.0
628 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 134.170.140.0/24, but only the network IP
629 New IP found: 134.170.140.0
630
631 Checking SPF record...
632 There are no IPv4 addresses in the SPF. Maybe IPv6.
633 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 23.103.128.0/19, but only the network IP
634 New IP found: 23.103.128.0
635 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 23.103.198.0/23, but only the network IP
636 New IP found: 23.103.198.0
637 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 65.55.88.0/24, but only the network IP
638 New IP found: 65.55.88.0
639 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 104.47.0.0/17, but only the network IP
640 New IP found: 104.47.0.0
641 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 23.103.200.0/21, but only the network IP
642 New IP found: 23.103.200.0
643 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 23.103.208.0/21, but only the network IP
644 New IP found: 23.103.208.0
645 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 23.103.191.0/24, but only the network IP
646 New IP found: 23.103.191.0
647 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 216.32.180.0/23, but only the network IP
648 New IP found: 216.32.180.0
649 WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 94.245.120.64/26, but only the network IP
650 New IP found: 94.245.120.64
651 New hostname found: 2202::/48
652 There are no IPv4 addresses in the SPF. Maybe IPv6.
653
654 Checking 193 most common hostnames using system default resolver...
655 IP: 150.60.195.62 (Japan)
656 HostName: www.egw.co.jp. Type: A
657 IP: 150.60.195.62 (Japan)
658 HostName: www.egw.co.jp. Type: A
659 HostName: ftp.egw.co.jp. Type: A
660
661 Checking with nmap the reverse DNS hostnames of every <ip>/24 netblock using system default resolver...
662 Checking netblock 65.55.169.0
663 Checking netblock 52.100.0.0
664 Checking netblock 23.103.191.0
665 Checking netblock 65.55.88.0
666 Checking netblock 157.7.33.0
667 Checking netblock 207.46.100.0
668 Checking netblock 157.55.234.0
669 Checking netblock 94.245.120.0
670 Checking netblock 216.32.180.0
671 Checking netblock 23.103.128.0
672 Checking netblock 64.4.22.0
673 Checking netblock 157.56.110.0
674 Checking netblock 23.103.208.0
675 Checking netblock 104.47.92.0
676 Checking netblock 157.7.32.0
677 Checking netblock 23.103.198.0
678 Checking netblock 207.46.163.0
679 Checking netblock 134.170.140.0
680 Checking netblock 213.199.154.0
681 Checking netblock 150.60.195.0
682 Checking netblock 40.107.0.0
683 Checking netblock 40.92.0.0
684 Checking netblock 104.47.93.0
685 Checking netblock 157.56.112.0
686 Checking netblock 207.46.51.0
687 Checking netblock 104.47.0.0
688 Checking netblock 213.199.180.0
689 Checking netblock 23.103.200.0
690
691 Searching for egw.co.jp. emails in Google
692 mail_address@egw.co.jp.
693
694 Checking 30 active hosts using nmap... (nmap -sn -n -v -PP -PM -PS80,25 -PA -PY -PU53,40125 -PE --reason <ip> -oA <output_directory>/nmap/<ip>.sn)
695 Host 65.55.169.0 is up (reset ttl 64)
696 Host 52.100.0.0 is up (reset ttl 64)
697 Host 23.103.191.0 is up (reset ttl 64)
698 Host 65.55.88.0 is up (reset ttl 64)
699 Host 157.7.33.53 is up (reset ttl 64)
700 Host 207.46.100.0 is up (reset ttl 64)
701 Host 157.55.234.0 is up (reset ttl 64)
702 Host 94.245.120.64 is up (reset ttl 64)
703 Host 216.32.180.0 is up (reset ttl 64)
704 Host 23.103.128.0 is up (reset ttl 64)
705 Host 64.4.22.64 is up (reset ttl 64)
706 Host 157.56.110.0 is up (reset ttl 64)
707 Host 23.103.208.0 is up (reset ttl 64)
708 Host 104.47.92.36 is up (reset ttl 64)
709 Host 157.7.33.35 is up (reset ttl 64)
710 Host 157.7.32.53 is up (reset ttl 64)
711 Host 23.103.198.0 is up (reset ttl 64)
712 Host 207.46.163.0 is up (reset ttl 64)
713 Host 134.170.140.0 is up (reset ttl 64)
714 Host 213.199.154.0 is up (reset ttl 64)
715 Host 150.60.195.62 is up (reset ttl 64)
716 Host 157.7.32.35 is up (reset ttl 64)
717 Host 40.107.0.0 is up (reset ttl 64)
718 Host 40.92.0.0 is up (reset ttl 64)
719 Host 104.47.93.36 is up (reset ttl 64)
720 Host 157.56.112.0 is up (reset ttl 64)
721 Host 207.46.51.64 is up (reset ttl 64)
722 Host 104.47.0.0 is up (reset ttl 64)
723 Host 213.199.180.128 is up (reset ttl 64)
724 Host 23.103.200.0 is up (reset ttl 64)
725
726 Checking ports on every active host using nmap... (nmap -O --reason --webxml --traceroute -sS -sV -sC -Pn -n -v -F <ip> -oA <output_directory>/nmap/<ip>)
727 Scanning ip 65.55.169.0 ():
728 Scanning ip 52.100.0.0 ():
729 Scanning ip 23.103.191.0 ():
730 Scanning ip 65.55.88.0 ():
731 Scanning ip 157.7.33.53 (02.dnsv.jp (PTR)):
732 53/tcp open domain syn-ack ttl 50 ISC BIND
733 | dns-nsid:
734 | NSID: acf (616366)
735 |_ id.server: acf
736 Device type: storage-misc|general purpose
737 Scanning ip 207.46.100.0 ():
738 Scanning ip 157.55.234.0 ():
739 Scanning ip 94.245.120.64 ():
740 Scanning ip 216.32.180.0 ():
741 Scanning ip 23.103.128.0 ():
742 Scanning ip 64.4.22.64 ():
743 Scanning ip 157.56.110.0 ():
744 Scanning ip 23.103.208.0 ():
745 Scanning ip 104.47.92.36 (mail-os2jpn010036.inbound.protection.outlook.com (PTR)):
746 Scanning ip 157.7.33.35 (04.dnsv.jp (PTR)):
747 53/tcp open tcpwrapped syn-ack ttl 50
748 | dns-nsid:
749 | NSID: ach (616368)
750 |_ id.server: GDNS version 20180305
751 Device type: storage-misc|general purpose|WAP
752 Running (JUST GUESSING): HP embedded (87%), Linux 3.X|2.6.X (86%)
753 Scanning ip 157.7.32.53 (01.dnsv.jp (PTR)):
754 53/tcp open domain syn-ack ttl 50 ISC BIND
755 | dns-nsid:
756 | NSID: acd (616364)
757 |_ id.server: GDNS version 20180305
758 Device type: storage-misc|general purpose|WAP
759 Running (JUST GUESSING): HP embedded (87%), Linux 3.X|2.6.X (85%)
760 Scanning ip 23.103.198.0 ():
761 Scanning ip 207.46.163.0 ():
762 Scanning ip 134.170.140.0 ():
763 Scanning ip 213.199.154.0 ():
764 Scanning ip 150.60.195.62 (ftp.egw.co.jp.):
765 21/tcp open tcpwrapped syn-ack ttl 41
766 80/tcp open http syn-ack ttl 39 Apache httpd
767 | http-methods:
768 |_ Supported Methods: GET HEAD POST OPTIONS
769 |_http-server-header: Apache
770 |_http-title: Did not follow redirect to https://150.60.195.62/
771 443/tcp open ssl/http syn-ack ttl 39 Apache httpd (PHP 7.1.23)
772 | http-methods:
773 |_ Supported Methods: GET HEAD POST
774 |_http-server-header: Apache
775 |_http-title: 400 Bad Request
776 | ssl-cert: Subject: commonName=www.egw.co.jp
777 | Subject Alternative Name: DNS:www.egw.co.jp
778 | Issuer: commonName=KDDI Web Communications Certification Authority 3/organizationName=SECOM Trust Systems CO.,LTD./countryName=JP
779 | Public Key type: rsa
780 | Public Key bits: 2048
781 | Signature Algorithm: sha256WithRSAEncryption
782 | Not valid before: 2018-12-21T03:54:31
783 | Not valid after: 2019-12-27T14:59:59
784 | MD5: 1dca 8e95 be91 d695 d9f8 f6f5 bda2 9fd5
785 |_SHA-1: af0c 13c8 c5c6 5893 9b4a ab58 3105 8ccb 12fc cef0
786 |_ssl-date: TLS randomness does not represent time
787 Scanning ip 157.7.32.35 (03.dnsv.jp (PTR)):
788 53/tcp open domain syn-ack ttl 50 ISC BIND
789 | dns-nsid:
790 | NSID: acc (616363)
791 |_ id.server: GDNS version 20180305
792 Device type: storage-misc|general purpose|WAP
793 Running (JUST GUESSING): HP embedded (87%), Linux 3.X|2.6.X (85%)
794 Scanning ip 40.107.0.0 ():
795 Scanning ip 40.92.0.0 ():
796 Scanning ip 104.47.93.36 (mail-ty1jpn010036.inbound.protection.outlook.com (PTR)):
797 Scanning ip 157.56.112.0 ():
798 Scanning ip 207.46.51.64 ():
799 Scanning ip 104.47.0.0 ():
800 Scanning ip 213.199.180.128 ():
801 Scanning ip 23.103.200.0 ():
802 WebCrawling domain's web servers... up to 50 max links.
803
804 + URL to crawl: http://www.egw.co.jp.
805 + Date: 2019-08-04
806
807 + Crawling URL: http://www.egw.co.jp.:
808 + Links:
809 + Crawling http://www.egw.co.jp.
810 + Searching for directories...
811 + Searching open folders...
812
813
814 + URL to crawl: http://ftp.egw.co.jp.
815 + Date: 2019-08-04
816
817 + Crawling URL: http://ftp.egw.co.jp.:
818 + Links:
819 + Crawling http://ftp.egw.co.jp.
820 + Searching for directories...
821 + Searching open folders...
822
823
824 + URL to crawl: https://www.egw.co.jp.
825 + Date: 2019-08-04
826
827 + Crawling URL: https://www.egw.co.jp.:
828 + Links:
829 + Crawling https://www.egw.co.jp.
830 + Searching for directories...
831 + Searching open folders...
832
833
834 + URL to crawl: https://ftp.egw.co.jp.
835 + Date: 2019-08-04
836
837 + Crawling URL: https://ftp.egw.co.jp.:
838 + Links:
839 + Crawling https://ftp.egw.co.jp.
840 + Searching for directories...
841 + Searching open folders...
842
843--Finished--
844Summary information for domain egw.co.jp.
845-----------------------------------------
846 Domain Specific Information:
847 Email: mail_address@egw.co.jp.
848
849 Domain Ips Information:
850 IP: 65.55.169.0
851 Type: SPF
852 Is Active: True (reset ttl 64)
853 IP: 52.100.0.0
854 Type: SPF
855 Is Active: True (reset ttl 64)
856 IP: 23.103.191.0
857 Type: SPF
858 Is Active: True (reset ttl 64)
859 IP: 65.55.88.0
860 Type: SPF
861 Is Active: True (reset ttl 64)
862 IP: 157.7.33.53
863 HostName: 02.dnsv.jp Type: NS
864 HostName: 02.dnsv.jp Type: PTR
865 Country: Japan
866 Is Active: True (reset ttl 64)
867 Port: 53/tcp open domain syn-ack ttl 50 ISC BIND
868 Script Info: | dns-nsid:
869 Script Info: | NSID: acf (616366)
870 Script Info: |_ id.server: acf
871 Script Info: Device type: storage-misc|general purpose
872 IP: 207.46.100.0
873 Type: SPF
874 Is Active: True (reset ttl 64)
875 IP: 157.55.234.0
876 Type: SPF
877 Is Active: True (reset ttl 64)
878 IP: 94.245.120.64
879 Type: SPF
880 Is Active: True (reset ttl 64)
881 IP: 216.32.180.0
882 Type: SPF
883 Is Active: True (reset ttl 64)
884 IP: 23.103.128.0
885 Type: SPF
886 Is Active: True (reset ttl 64)
887 IP: 64.4.22.64
888 Type: SPF
889 Is Active: True (reset ttl 64)
890 IP: 157.56.110.0
891 Type: SPF
892 Is Active: True (reset ttl 64)
893 IP: 23.103.208.0
894 Type: SPF
895 Is Active: True (reset ttl 64)
896 IP: 104.47.92.36
897 HostName: egw-co-jp.mail.protection.outlook.com Type: MX
898 HostName: mail-os2jpn010036.inbound.protection.outlook.com Type: PTR
899 Country: United States
900 Is Active: True (reset ttl 64)
901 IP: 157.7.33.35
902 HostName: 04.dnsv.jp Type: NS
903 HostName: 04.dnsv.jp Type: PTR
904 Country: Japan
905 Is Active: True (reset ttl 64)
906 Port: 53/tcp open tcpwrapped syn-ack ttl 50
907 Script Info: | dns-nsid:
908 Script Info: | NSID: ach (616368)
909 Script Info: |_ id.server: GDNS version 20180305
910 Script Info: Device type: storage-misc|general purpose|WAP
911 Script Info: Running (JUST GUESSING): HP embedded (87%), Linux 3.X|2.6.X (86%)
912 IP: 157.7.32.53
913 HostName: 01.dnsv.jp Type: NS
914 HostName: 01.dnsv.jp Type: PTR
915 Country: Japan
916 Is Active: True (reset ttl 64)
917 Port: 53/tcp open domain syn-ack ttl 50 ISC BIND
918 Script Info: | dns-nsid:
919 Script Info: | NSID: acd (616364)
920 Script Info: |_ id.server: GDNS version 20180305
921 Script Info: Device type: storage-misc|general purpose|WAP
922 Script Info: Running (JUST GUESSING): HP embedded (87%), Linux 3.X|2.6.X (85%)
923 IP: 23.103.198.0
924 Type: SPF
925 Is Active: True (reset ttl 64)
926 IP: 207.46.163.0
927 Type: SPF
928 Is Active: True (reset ttl 64)
929 IP: 134.170.140.0
930 Type: SPF
931 Is Active: True (reset ttl 64)
932 IP: 213.199.154.0
933 Type: SPF
934 Is Active: True (reset ttl 64)
935 IP: 150.60.195.62
936 HostName: www.egw.co.jp. Type: A
937 HostName: ftp.egw.co.jp. Type: A
938 Country: Japan
939 Is Active: True (reset ttl 64)
940 Port: 21/tcp open tcpwrapped syn-ack ttl 41
941 Port: 80/tcp open http syn-ack ttl 39 Apache httpd
942 Script Info: | http-methods:
943 Script Info: |_ Supported Methods: GET HEAD POST OPTIONS
944 Script Info: |_http-server-header: Apache
945 Script Info: |_http-title: Did not follow redirect to https://150.60.195.62/
946 Port: 443/tcp open ssl/http syn-ack ttl 39 Apache httpd (PHP 7.1.23)
947 Script Info: | http-methods:
948 Script Info: |_ Supported Methods: GET HEAD POST
949 Script Info: |_http-server-header: Apache
950 Script Info: |_http-title: 400 Bad Request
951 Script Info: | ssl-cert: Subject: commonName=www.egw.co.jp
952 Script Info: | Subject Alternative Name: DNS:www.egw.co.jp
953 Script Info: | Issuer: commonName=KDDI Web Communications Certification Authority 3/organizationName=SECOM Trust Systems CO.,LTD./countryName=JP
954 Script Info: | Public Key type: rsa
955 Script Info: | Public Key bits: 2048
956 Script Info: | Signature Algorithm: sha256WithRSAEncryption
957 Script Info: | Not valid before: 2018-12-21T03:54:31
958 Script Info: | Not valid after: 2019-12-27T14:59:59
959 Script Info: | MD5: 1dca 8e95 be91 d695 d9f8 f6f5 bda2 9fd5
960 Script Info: |_SHA-1: af0c 13c8 c5c6 5893 9b4a ab58 3105 8ccb 12fc cef0
961 Script Info: |_ssl-date: TLS randomness does not represent time
962 IP: 157.7.32.35
963 HostName: 03.dnsv.jp Type: NS
964 HostName: 03.dnsv.jp Type: PTR
965 Country: Japan
966 Is Active: True (reset ttl 64)
967 Port: 53/tcp open domain syn-ack ttl 50 ISC BIND
968 Script Info: | dns-nsid:
969 Script Info: | NSID: acc (616363)
970 Script Info: |_ id.server: GDNS version 20180305
971 Script Info: Device type: storage-misc|general purpose|WAP
972 Script Info: Running (JUST GUESSING): HP embedded (87%), Linux 3.X|2.6.X (85%)
973 IP: 40.107.0.0
974 Type: SPF
975 Is Active: True (reset ttl 64)
976 IP: 40.92.0.0
977 Type: SPF
978 Is Active: True (reset ttl 64)
979 IP: 104.47.93.36
980 HostName: egw-co-jp.mail.protection.outlook.com Type: MX
981 HostName: mail-ty1jpn010036.inbound.protection.outlook.com Type: PTR
982 Country: United States
983 Is Active: True (reset ttl 64)
984 IP: 157.56.112.0
985 Type: SPF
986 Is Active: True (reset ttl 64)
987 IP: 207.46.51.64
988 Type: SPF
989 Is Active: True (reset ttl 64)
990 IP: 104.47.0.0
991 Type: SPF
992 Is Active: True (reset ttl 64)
993 IP: 213.199.180.128
994 Type: SPF
995 Is Active: True (reset ttl 64)
996 IP: 23.103.200.0
997 Type: SPF
998 Is Active: True (reset ttl 64)
999#####################################################################################################################################
1000Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:10 EDT
1001Nmap scan report for 150.60.195.62
1002Host is up (0.48s latency).
1003Not shown: 469 filtered ports, 4 closed ports
1004Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
1005PORT STATE SERVICE
100621/tcp open ftp
100780/tcp open http
1008443/tcp open https
1009######################################################################################################################################
1010Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:13 EDT
1011Nmap scan report for 150.60.195.62
1012Host is up (0.19s latency).
1013Not shown: 2 filtered ports
1014PORT STATE SERVICE
101553/udp open|filtered domain
101667/udp open|filtered dhcps
101768/udp open|filtered dhcpc
101869/udp open|filtered tftp
101988/udp open|filtered kerberos-sec
1020123/udp open|filtered ntp
1021139/udp open|filtered netbios-ssn
1022161/udp open|filtered snmp
1023162/udp open|filtered snmptrap
1024389/udp open|filtered ldap
1025520/udp open|filtered route
10262049/udp open|filtered nfs
1027######################################################################################################################################
1028Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:13 EDT
1029Nmap scan report for 150.60.195.62
1030Host is up (0.44s latency).
1031
1032PORT STATE SERVICE VERSION
103321/tcp open tcpwrapped
1034Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
1035Device type: general purpose
1036Running (JUST GUESSING): OpenBSD 4.X (86%)
1037OS CPE: cpe:/o:openbsd:openbsd:4.8
1038Aggressive OS guesses: OpenBSD 4.8 (86%), OpenBSD 4.0 (86%)
1039No exact OS matches for host (test conditions non-ideal).
1040Network Distance: 17 hops
1041
1042TRACEROUTE (using port 21/tcp)
1043HOP RTT ADDRESS
10441 186.63 ms 10.244.200.1
10452 187.78 ms 213.184.122.97
10463 186.79 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
10474 249.07 ms bzq-219-189-185.dsl.bezeqint.net (62.219.189.185)
10485 187.41 ms bzq-114-65-2.cust.bezeqint.net (192.114.65.2)
10496 187.01 ms bzq-179-124-85.cust.bezeqint.net (212.179.124.85)
10507 240.31 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
10518 323.51 ms 202.232.1.113
10529 323.54 ms 202.232.1.113
105310 382.41 ms sjc002bb12.IIJ.Net (58.138.81.226)
105411 384.13 ms sjc002bb12.IIJ.Net (58.138.80.122)
105512 487.24 ms tky001ip57.IIJ.Net (58.138.100.18)
105613 487.43 ms 202.232.9.94
105714 ... 16
105817 498.74 ms 150.60.195.62
1059######################################################################################################################################
1060Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:24 EDT
1061Nmap scan report for 150.60.195.62
1062Host is up.
1063
1064PORT STATE SERVICE VERSION
106567/udp open|filtered dhcps
1066|_dhcp-discover: ERROR: Script execution failed (use -d to debug)
1067Too many fingerprints match this host to give specific OS details
1068
1069TRACEROUTE (using proto 1/icmp)
1070HOP RTT ADDRESS
10711 190.87 ms 10.244.200.1
10722 192.07 ms 213.184.122.97
10733 190.93 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
10744 185.73 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
10755 239.73 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
10766 238.72 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
10777 323.77 ms et-0-0-67.cr3-was1.ip4.gtt.net (89.149.142.246)
10788 325.75 ms 202.232.1.113
10799 385.20 ms sjc002bb12.IIJ.Net (58.138.81.226)
108010 485.60 ms tky001bb11.IIJ.Net (58.138.88.85)
108111 476.40 ms tky001ip57.IIJ.Net (58.138.100.22)
108212 486.89 ms 202.232.9.94
108313 ... 30
1084#####################################################################################################################################
1085Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:26 EDT
1086Nmap scan report for 150.60.195.62
1087Host is up.
1088
1089PORT STATE SERVICE VERSION
109068/udp open|filtered dhcpc
1091Too many fingerprints match this host to give specific OS details
1092
1093TRACEROUTE (using proto 1/icmp)
1094HOP RTT ADDRESS
10951 191.90 ms 10.244.200.1
10962 195.07 ms 213.184.122.97
10973 195.17 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
10984 193.47 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
10995 244.79 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
11006 244.18 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
11017 331.25 ms et-0-0-67.cr3-was1.ip4.gtt.net (89.149.142.246)
11028 326.25 ms 202.232.1.113
11039 384.05 ms sjc002bb12.IIJ.Net (58.138.81.226)
110410 484.71 ms tky001bb11.IIJ.Net (58.138.88.85)
110511 475.20 ms tky001ip57.IIJ.Net (58.138.100.22)
110612 485.40 ms 202.232.9.94
110713 ... 30
1108######################################################################################################################################
1109Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:28 EDT
1110Nmap scan report for 150.60.195.62
1111Host is up.
1112
1113PORT STATE SERVICE VERSION
111469/udp open|filtered tftp
1115Too many fingerprints match this host to give specific OS details
1116
1117TRACEROUTE (using proto 1/icmp)
1118HOP RTT ADDRESS
11191 189.86 ms 10.244.200.1
11202 186.06 ms 213.184.122.97
11213 184.66 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
11224 184.90 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
11235 239.07 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
11246 239.50 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
11257 323.12 ms et-0-0-67.cr3-was1.ip4.gtt.net (89.149.142.246)
11268 325.13 ms 202.232.1.113
11279 384.67 ms sjc002bb12.IIJ.Net (58.138.81.226)
112810 485.00 ms tky001bb11.IIJ.Net (58.138.88.85)
112911 475.89 ms tky001ip57.IIJ.Net (58.138.100.22)
113012 486.34 ms 202.232.9.94
113113 ... 30
1132#####################################################################################################################################
1133Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:30 EDT
1134Nmap scan report for 150.60.195.62
1135Host is up (0.45s latency).
1136
1137PORT STATE SERVICE VERSION
113880/tcp open http Apache httpd
1139|_http-server-header: Apache
1140| vulscan: VulDB - https://vuldb.com:
1141| [135270] Apache JSPWiki up to 2.11.0.M3 Plugin Link cross site scripting
1142| [135269] Apache JSPWiki up to 2.11.0.M3 InterWiki Link cross site scripting
1143| [135268] Apache JSPWiki up to 2.11.0.M3 Attachment cross site scripting
1144| [134527] Apache Karaf up to 4.2.4 Config Service directory traversal
1145| [134416] Apache Sanselan 0.97-incubator Loop denial of service
1146| [134415] Apache Sanselan 0.97-incubator Hang denial of service
1147| [134291] Apache Axis up to 1.7.8 Server-Side Request Forgery
1148| [134290] Apache UIMA DUCC up to 2.2.2 cross site scripting
1149| [134248] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
1150| [134247] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
1151| [134246] Apache Camel up to 2.19/2.21.3/2.22.2/2.23.0 directory traversal
1152| [134138] Apache Pluto 3.0.0/3.0.1 Chat Room Demo Portlet cross site scripting
1153| [133992] Apache Qpid Proton up to 0.27.0 Certificate Validation Man-in-the-Middle weak authentication
1154| [133977] Apache Zeppelin up to 0.7.x Stored cross site scripting
1155| [133976] Apache Zeppelin up to 0.7.x Cron Scheduler privilege escalation
1156| [133975] Apache Zeppelin up to 0.7.2 Session Fixation weak authentication
1157| [133444] Apache PDFbox 2.0.14 XML Parser XML External Entity
1158| [133750] Oracle Agile Recipe Management for Pharmaceuticals 9.3.3/9.3.4 Apache Commons FileUpload unknown vulnerability
1159| [133728] Oracle Retail Xstore Point of Service 7.0/7.1 Apache HTTP Server denial of service
1160| [133644] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
1161| [133643] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache HTTP Server denial of service
1162| [133640] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Commons FileUpload unknown vulnerability
1163| [133638] Oracle Healthcare Master Person Index 3.0/4.0 Apache Commons FileUpload unknown vulnerability
1164| [133614] Oracle Data Integrator 12.2.1.3.0 Apache Batik unknown vulnerability
1165| [133594] Oracle WebCenter Portal 12.2.1.3.0 Apache Commons FileUpload unknown vulnerability
1166| [133591] Oracle JDeveloper 11.1.1.9.0/12.1.3.0.0/12.2.1.3.0 Apache Log4j unknown vulnerability
1167| [133590] Oracle Identity Analytics 11.1.1.5.8 Apache Commons FileUpload unknown vulnerability
1168| [133588] Oracle Endeca Information Discovery Integrator 3.2.0 Apache Commons FileUpload unknown vulnerability
1169| [133587] Oracle Data Integrator 11.1.1.9.0 Apache Groovy unknown vulnerability
1170| [133585] Oracle API Gateway 11.1.2.4.0 Apache Commons FileUpload unknown vulnerability
1171| [133573] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache ActiveMQ unknown vulnerability
1172| [133571] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache Commons FileUpload unknown vulnerability
1173| [133522] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache Tomcat unknown vulnerability
1174| [133520] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache HTTP Server denial of service
1175| [133518] Oracle Primavera Unifier up to 18.8 Apache Commons FileUpload unknown vulnerability
1176| [133508] Oracle Communications Instant Messaging Server 10.0.1 Apache Tomcat unknown vulnerability
1177| [133501] Oracle Communications Policy Management 12.1/12.2/12.3/12.4 Apache Struts 1 unknown vulnerability
1178| [133500] Oracle Communications Application Session Controller 3.7.1/3.8.0 Apache Tomcat unknown vulnerability
1179| [133493] Oracle Communications Pricing Design Center 11.1/12.0 Apache Log4j unknown vulnerability
1180| [133407] Apache Tomcat up to 7.0.93/8.5.39/9.0.17 on Windows JRE Command Line Argument Code Execution
1181| [133315] Apache Airflow up to 1.10.2 HTTP Endpoint cross site request forgery
1182| [133314] Apache Airflow up to 1.10.2 Metadata Database cross site scripting
1183| [133290] Apache Tomcat up to 8.5.37/9.0.14 HTTP2 Stream Execution denial of service
1184| [133112] Apache HTTP Server up to 2.4.38 mod_auth_digest race condition privilege escalation
1185| [133111] Apache HTTP Server 2.4.37/2.4.38 mod_ssl Bypass privilege escalation
1186| [133092] Airsonic 10.2.1 org.apache.commons.lang.RandomStringUtils RecoverController.java java.util.Random weak authentication
1187| [132568] Apache JSPWiki up to 2.11.0.M2 URL User information disclosure
1188| [132567] Apache JSPWiki up to 2.11.0.M2 URL cross site scripting
1189| [132566] Apache ActiveMQ up to 5.15.8 MQTT Frame Memory denial of service
1190| [132565] Apache HBase up to 2.1.3 REST Server Request privilege escalation
1191| [132183] Apache Mesos up to pre-1.4.x Docker Image Code Execution
1192| [131988] Apache Karaf up to 4.2.2 kar Deployer directory traversal
1193| [131859] Apache Hadoop up to 2.9.1 privilege escalation
1194| [131479] Apache Solr up to 7.6 HTTP GET Request Server-Side Request Forgery
1195| [131446] Apache Solr up to 5.0.5/6.6.5 Config API HTTP POST Request Code Execution
1196| [131385] Apache Qpid Broker-J up to 6.x/7.0.6/7.1.0 AMQP Command Crash denial of service
1197| [131315] Apache Mesos up to pre-1.4.x Mesos Masters Rendering JSON Payload Recursion denial of service
1198| [131236] Apache Airflow up to 1.10.1 Metadata Database cross site scripting
1199| [130755] Apache JSPWiki up to 2.10.5 URL cross site scripting
1200| [130629] Apache Guacamole Cookie Flag weak encryption
1201| [130628] Apache Hadoop up to 3.0.0 HDFS information disclosure
1202| [130529] Apache Subversion 1.10.0/1.10.1/1.10.2/1.10.3/1.11.0 mod_dav_svn Directory Crash denial of service
1203| [130353] Apache Open Office up to 4.1.5 Document Loader String memory corruption
1204| [130341] Apache HTTP Server 2.4.37 mod_ssl Loop denial of service
1205| [130330] Apache HTTP Server up to 2.4.37 mod_session Expired privilege escalation
1206| [130329] Apache HTTP Server 2.4.37 mod_http2 Slowloris denial of service
1207| [130212] Apache Airflow up to 1.10.0 LDAP Auth Backend Certificate weak authentication
1208| [130123] Apache Airflow up to 1.8.2 information disclosure
1209| [130122] Apache Airflow up to 1.8.2 command injection cross site request forgery
1210| [130121] Apache Airflow up to 1.8.2 Webserver Object Code Execution
1211| [129717] Oracle Secure Global Desktop 5.4 Apache HTTP Server denial of service
1212| [129688] Oracle Tape Library ACSLS 8.4 Apache Log4j unknown vulnerability
1213| [129673] Oracle Retail Returns Management 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
1214| [129672] Oracle Retail Central Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
1215| [129671] Oracle Retail Back Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
1216| [129574] Oracle Outside In Technology 8.5.3/8.5.4 Apache Tomcat denial of service
1217| [129573] Oracle WebLogic Server 10.3.6.0 Apache HTTP Server denial of service
1218| [129563] Oracle Enterprise Repository 12.1.3.0.0 Apache Log4j unknown vulnerability
1219| [129555] Oracle Outside In Technology 8.5.3 Apache Batik denial of service
1220| [129551] Oracle Outside In Technology 8.5.3/8.5.4 Apache Commons FileUpload denial of service
1221| [129542] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
1222| [129538] Oracle SOA Suite 12.1.3.0.0/12.2.1.3.0 Apache Batik unknown vulnerability
1223| [129519] Oracle Enterprise Manager Ops Center 12.2.2/12.3.3 Apache ActiveMQ unknown vulnerability
1224| [129508] Oracle Applications Manager up to 12.2.8 Apache Derby unknown vulnerability
1225| [129507] Oracle Mobile Field Service up to 12.2.8 Apache Log4j unknown vulnerability
1226| [129505] Oracle Email Center up to 12.2.8 Apache Log4j unknown vulnerability
1227| [129504] Oracle CRM Technical Foundation up to 12.2.8 Apache Commons FileUpload unknown vulnerability
1228| [129499] Oracle Partner Management up to 12.2.8 Apache Log4j unknown vulnerability
1229| [129498] Oracle Marketing up to 12.2.8 Apache Commons FileUpload unknown vulnerability
1230| [129480] Oracle Communications WebRTC Session Controller up to 7.1 Apache Batik unknown vulnerability
1231| [129479] Oracle Communications Diameter Signaling Router up to 8.2 Apache Batik unknown vulnerability
1232| [129474] Oracle Communications Diameter Signaling Router up to 8.2 Apache HTTP Server information disclosure
1233| [129472] Oracle Communications WebRTC Session Controller up to 7.1 Apache Struts 1 unknown vulnerability
1234| [129470] Oracle Communications Converged Application Server up to 7.0.0.0 Apache Struts 1 unknown vulnerability
1235| [129463] Oracle Communications WebRTC Session Controller up to 7.1 Apache Log4j unknown vulnerability
1236| [129461] Oracle Communications Services Gatekeeper up to 6.1.0.3.x Apache Commons Collections Fileupload unknown vulnerability
1237| [129460] Oracle Communications Service Broker 6.0 Apache Log4j unknown vulnerability
1238| [129459] Oracle Communications Policy Management up to 12.4 Apache Struts 2 unknown vulnerability
1239| [129458] Oracle Communications Online Mediation Controller 6.1 Apache Log4j unknown vulnerability
1240| [129457] Oracle Communications Diameter Signaling Router up to 8.2 Apache Commons Fileupload unknown vulnerability
1241| [129456] Oracle Communications Converged Application Server 6.1 Apache Log4j unknown vulnerability
1242| [128714] Apache Thrift Java Client Library up to 0.11.0 SASL Negotiation org.apache.thrift.transport.TSaslTransport unknown vulnerability
1243| [128713] Apache Thrift Node.js Static Web Server up to 0.11.0 directory traversal
1244| [128709] Apache Karaf up to 4.1.6/4.2.1 Features Deployer XMLInputFactory XML External Entity
1245| [128575] Apache NetBeans 9.0 Proxy Auto-Config Code Execution
1246| [128369] Apache Tika 1.8-1.19.1 SQLite3Parser Loop sql injection
1247| [128111] Apache NiFi 1.8.0 Template Upload Man-in-the-Middle cross site request forgery
1248| [128110] Apache NiFi 1.8.0 Cluster Request privilege escalation
1249| [128109] Apache NiFi 1.8.0 Error Page message-page.jsp Request Header cross site scripting
1250| [128108] Apache NiFi up to 1.7.x X-Frame-Options Header privilege escalation
1251| [128102] Apache Oozie up to 5.0.0 Workflow XML Impersonation spoofing
1252| [127994] WordPress up to 5.0.0 on Apache httpd MIME Restriction cross site scripting
1253| [127981] Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04 HTTP Engine httpService GET Request privilege escalation
1254| [127161] Apache Hadoop 2.7.4/2.7.5/2.7.6 Incomplete Fix CVE-2016-6811 privilege escalation
1255| [127040] Loadbalancer.org Enterprise VA MAX up to 8.3.2 Apache HTTP Server Log cross site scripting
1256| [127007] Apache Spark Request Code Execution
1257| [126791] Apache Hadoop up to 0.23.11/2.7.6/2.8.4/2.9.1/3.0.2 ZIP File unknown vulnerability
1258| [126767] Apache Qpid Proton-J Transport 0.3 Certificate Verification Man-in-the-Middle weak authentication
1259| [126896] Apache Commons FileUpload 1.3.3 on LDAP Manager DiskFileItem File privilege escalation
1260| [126574] Apache Hive up to 2.3.3/3.1.0 Query privilege escalation
1261| [126573] Apache Hive up to 2.3.3/3.1.0 HiveServer2 privilege escalation
1262| [126564] Apache Superset up to 0.22 Pickle Library load Code Execution
1263| [126488] Apache Syncope up to 2.0.10/2.1.1 BPMN Definition xxe privilege escalation
1264| [126487] Apache Syncope up to 2.0.10/2.1.1 cross site scripting
1265| [126346] Apache Tomcat Path privilege escalation
1266| [125922] Apache Impala up to 3.0.0 ALTER privilege escalation
1267| [125921] Apache Impala up to 3.0.0 Queue Injection privilege escalation
1268| [125647] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Install (Apache Tomcat) information disclosure
1269| [125617] Oracle Retail Returns Management 14.1 Apache Batik unknown vulnerability
1270| [125616] Oracle Retail Point-of-Service 13.4/14.0/14.1 Apache Batik unknown vulnerability
1271| [125614] Oracle Retail Central Office 14.1 Apache Batik unknown vulnerability
1272| [125613] Oracle Retail Back Office 13.3/13.4/14/14.1 Apache Batik unknown vulnerability
1273| [125599] Oracle Retail Open Commerce Platform 5.3.0/6.0.0/6.0.1 Apache Log4j unknown vulnerability
1274| [125569] Oracle PeopleSoft Enterprise PeopleTools 8.55/8.56 Apache HTTP Server information disclosure
1275| [125494] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat information disclosure
1276| [125447] Oracle Business Intelligence Enterprise Edition 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Batik unknown vulnerability
1277| [125428] Oracle Identity Management Suite 11.1.2.3.0/12.2.1.3.0 Apache Log4j unknown vulnerability
1278| [125427] Oracle Identity Analytics 11.1.1.5.8 Apache Log4j unknown vulnerability
1279| [125424] Oracle API Gateway 11.1.2.4.0 Apache Log4j unknown vulnerability
1280| [125423] Oracle BI Publisher 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Log4j unknown vulnerability
1281| [125383] Oracle up to 10.2.0 Apache Trinidad unknown vulnerability
1282| [125379] Oracle up to 10.1.x Apache Struts 1 cross site scripting
1283| [125377] Oracle up to 10.2.0 Apache Commons Collections unknown vulnerability
1284| [125376] Oracle Communications Application Session Controller up to 3.7.0 Apache Commons Collections unknown vulnerability
1285| [125375] Oracle Communications User Data Repository up to 12.1.x Apache Xerces memory corruption
1286| [125248] Apache ActiveMQ up to 5.15.5 Web-based Administration Console queue.jsp Parameter cross site scripting
1287| [125133] Apache Tika up to 1.19 XML Parser reset() denial of service
1288| [124877] Apache PDFbox up to 2.0.11 PDF File denial of service
1289| [124876] Apache Ranger up to 1.1.x UnixAuthenticationService Stack-based memory corruption
1290| [124791] Apache Tomcat up to 7.0.90/8.5.33/9.0.11 URL Open Redirect
1291| [124787] Apache Pony Mail 0.7/0.8/0.9 Statistics Generator Timestamp Data information disclosure
1292| [124447] Apache HTTP Server up to 2.4.34 SETTINGS Frame denial of service
1293| [124346] Apache Mesos pre-1.4.2/1.5.0/1.5.1/1.6.0 on Executor HTTP API String Comparison validation JSON Web Token information disclosure
1294| [124286] Apache Tika up to 1.18 IptcAnpaParser Loop denial of service
1295| [124242] Apache Tika up to 0.18 C:/evil.bat" Directory unknown vulnerability
1296| [124241] Apache Tika up to 0.18 XML Parser Entity Expansion denial of service
1297| [124191] Apache Karaf up to 3.0.8/4.0.8/4.1.0 WebConsole .../gogo/ weak authentication
1298| [124190] Apache Karaf up to 4.1.x sshd privilege escalation
1299| [124152] Apache Camel Mail up to 2.22.0 Path directory traversal
1300| [124143] Apache SpamAssassin up to 3.4.1 PDFInfo Plugin Code Execution
1301| [124134] Apache SpamAssassin up to 3.4.1 Scan Engine HTML::Parser Email denial of service
1302| [124095] PHP up to 5.6.37/7.0.31/7.1.21/7.2.9 Apache2 sapi_apache2.c php_handler cross site scripting
1303| [124024] Apache Mesos 1.4.x/1.5.0 libprocess JSON Payload denial of service
1304| [123814] Apache ActiveMQ Client up to 5.15.5 TLS Hostname Verification Man-in-the-Middle weak authentication
1305| [123393] Apache Traffic Server up to 6.2.2/7.1.3 ESI Plugin Config privilege escalation
1306| [123392] Apache Traffic Server 6.2.2 TLS Handshake Segmentation Fault denial of service
1307| [123391] Apache Traffic Server up to 6.2.2/7.1.3 Range Request Performance denial of service
1308| [123390] Apache Traffic Server up to 6.2.2/7.1.3 Request HTTP Smuggling privilege escalation
1309| [123369] Apache Traffic Server up to 6.2.2/7.1.3 ACL remap.config Request denial of service
1310| [123197] Apache Sentry up to 2.0.0 privilege escalation
1311| [123145] Apache Struts up to 2.3.34/2.5.16 Namespace Code Execution
1312| [123144] Apache Cayenne up to 4.1.M1 CayenneModeler XML File File Transfer privilege escalation
1313| [122981] Apache Commons Compress 1.7 ZipArchiveInputStream ZIP Archive denial of service
1314| [122889] Apache HTTP Server up to 2.2.31/2.4.23 mod_userdir HTTP Response Splitting privilege escalation
1315| [122800] Apache Spark 1.3.0 REST API weak authentication
1316| [122642] Apache Airflow up to 1.8.x 404 Page Reflected cross site scripting
1317| [122568] Apache Tomcat up to 8.5.31/9.0.9 Connection Reuse weak authentication
1318| [122567] Apache Axis 1.0./1.1/1.2/1.3/1.4 cross site scripting
1319| [122556] Apache Tomcat up to 7.0.86/8.0.51/8.5.30/9.0.7 UTF-8 Decoder Loop denial of service
1320| [122531] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.9 WebSocket Client unknown vulnerability
1321| [122456] Apache Camel up to 2.20.3/2.21.0 XSD Validator XML External Entity
1322| [122455] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Revoked Certificate weak authentication
1323| [122454] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Responder Revoked Certificate weak authentication
1324| [122214] Apache Kafka up to 0.9.0.1/0.10.2.1/0.11.0.2/1.0.0 Broker Request Data Loss denial of service
1325| [122202] Apache Kafka up to 0.10.2.1/0.11.0.1 SASL Impersonation spoofing
1326| [122101] Docker Skeleton Runtime for Apache OpenWhisk Docker Action dockerskeleton:1.3.0 privilege escalation
1327| [122100] PHP Runtime for Apache OpenWhisk Docker Action action-php-v7.2:1.0.0 privilege escalation
1328| [122012] Apache Ignite up to 2.5 Serialization privilege escalation
1329| [121911] Apache Ambari up to 2.5.x/2.6.2 Log Message Credentials information disclosure
1330| [121910] Apache HTTP Server 2.4.33 mod_md HTTP Requests denial of service
1331| [121854] Oracle Tape Library ACSLS up to ACSLS 8.4.0-2 Apache Commons Collections unknown vulnerability
1332| [121752] Oracle Insurance Policy Administration 10.0/10.1/10.2/11.0 Apache Log4j unknown vulnerability
1333| [121370] Apache Spark up to 2.1.2/2.2.1/2.3.0 URL cross site scripting
1334| [121354] Apache CouchDB HTTP API Code Execution
1335| [121144] Apache LDAP API up to 1.0.1 SSL Filter information disclosure
1336| [121143] Apache storm up to 0.10.2/1.0.6/1.1.2/1.2.1 Cluster privilege escalation
1337| [120436] Apache CXF Fediz up to 1.4.3 Application Plugin unknown vulnerability
1338| [120310] Apache PDFbox up to 1.8.14/2.0.10 AFMParser Loop denial of service
1339| [120168] Apache CXF weak authentication
1340| [120080] Apache Cassandra up to 3.11.1 JMX/RMI Interface RMI Request privilege escalation
1341| [120043] Apache HBase up to 1.2.6.0/1.3.2.0/1.4.4/2.0.0 Thrift 1 API Server weak authentication
1342| [119723] Apache Qpid Broker-J 7.0.0/7.0.1/7.0.2/7.0.3/7.0.4 AMQP Messages Crash denial of service
1343| [122569] Apache HTTP Server up to 2.4.33 HTTP2 Request denial of service
1344| [119486] Apache Geode up to 1.4.0 Security Manager Code Execution
1345| [119306] Apache MXNet Network Interface privilege escalation
1346| [118999] Apache Storm up to 1.0.6/1.1.2/1.2.1 Archive directory traversal
1347| [118996] Apache Storm up to 1.0.6/1.1.2/1.2.1 Daemon spoofing
1348| [118644] Apple macOS up to 10.13.5 apache_mod_php unknown vulnerability
1349| [118200] Apache Batik up to 1.9 Deserialization unknown vulnerability
1350| [118143] Apache NiFi activemq-client Library Deserialization denial of service
1351| [118142] Apache NiFi 1.6.0 SplitXML xxe privilege escalation
1352| [118051] Apache Zookeeper up to 3.4.9/3.5.3-beta weak authentication
1353| [117997] Apache ORC up to 1.4.3 ORC File Recursion denial of service
1354| [117825] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.8 CORS Filter privilege escalation
1355| [117405] Apache Derby up to 10.14.1.0 Network Server Network Packet privilege escalation
1356| [117347] Apache Ambari up to 2.6.1 HTTP Request directory traversal
1357| [117265] LibreOffice/Apache Office Writer SMB Connection XML Document information disclosure
1358| [117143] Apache uimaj/uima-as/uimaFIT/uimaDUCC XML XXE information disclosure
1359| [117117] Apache Tika up to 1.17 ChmParser Loop denial of service
1360| [117116] Apache Tika up to 1.17 BPGParser Loop denial of service
1361| [117115] Apache Tika up to 1.17 tika-server command injection
1362| [116929] Apache Fineract getReportType Parameter privilege escalation
1363| [116928] Apache Fineract REST Endpoint Parameter privilege escalation
1364| [116927] Apache Fineract MakercheckersApiResource Parameter sql injection
1365| [116926] Apache Fineract REST Hand Parameter privilege escalation
1366| [116574] Apache wicket-jquery-ui up to 6.29.0/7.10.1/8.0.0-M9.1 WYSIWYG Editor privilege escalation
1367| [116622] Oracle Enterprise Manager for MySQL Database 12.1.0.4 EM Plugin: General (Apache Tomcat) unknown vulnerability
1368| [115931] Apache Solr up to 6.6.2/7.2.1 XML Data Parameter XML External Entity
1369| [115883] Apache Hive up to 2.3.2 privilege escalation
1370| [115882] Apache Hive up to 2.3.2 xpath_short information disclosure
1371| [115881] Apache DriverHive JDBC Driver up to 2.3.2 Escape Argument Bypass privilege escalation
1372| [115518] Apache Ignite 2.3 Deserialization privilege escalation
1373| [115260] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache cross site scripting
1374| [115259] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache Cookie Stack-based memory corruption
1375| [115500] CA Workload Control Center up to r11.4 SP5 Apache MyFaces Component Code Execution
1376| [115121] Apache Struts REST Plugin up to 2.5.15 Xstream XML Data denial of service
1377| [115061] Apache HTTP Server up to 2.4.29 HTTP Digest Authentication Challenge HTTP Requests Replay privilege escalation
1378| [115060] Apache HTTP Server up to 2.4.29 mod_cache_socache Request Header Crash denial of service
1379| [115059] Apache HTTP Server up to 2.4.29 HTTP2 NULL Pointer Dereference denial of service
1380| [115058] Apache HTTP Server up to 2.4.29 HTTP Header Crash denial of service
1381| [115057] Apache HTTP Server up to 2.4.29 mod_session Variable Name Cache privilege escalation
1382| [115039] Apache HTTP Server up to 2.4.29 FilesMatch File Upload privilege escalation
1383| [115038] Apache HTTP Server up to 2.0.65/2.2.34/2.4.29 mod_authnz_ldap Crash denial of service
1384| [114817] Apache Syncope up to 1.2.10/2.0.7 Search Parameter information disclosure
1385| [114816] Apache Syncope up to 1.2.10/2.0.7 XSLT Code Execution
1386| [114717] Apache Commons 1.11/1.12/1.13/1.14/1.15 ZIP Archive ZipFile/ZipArchiveInputStream denial of service
1387| [114661] Apache Allura up to 1.8.0 HTTP Response Splitting privilege escalation
1388| [114400] Apache Tomcat JK ISAPI Connector up to 1.2.42 IIS/ISAPI privilege escalation
1389| [114258] Apache HTTP Server up to 2.4.22 mod_cluster Segmentation Fault denial of service
1390| [114086] Apache ODE 1.3.3 ODE Process Deployment Web Service directory traversal
1391| [113955] Apache Xerces-C up to 3.2.0 XML Parser NULL Pointer Dereference denial of service
1392| [113945] Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4 URL Pattern Empty String privilege escalation
1393| [113944] Apache OpenMeetings up to 3.x/4.0.1 CRUD Operation denial of service
1394| [113905] Apache Traffic Server up to 5.2.x/5.3.2/6.2.0/7.0.0 TLS Handshake Core Dump denial of service
1395| [113904] Apache Traffic Server up to 6.2.0 Host Header privilege escalation
1396| [113895] Apache Geode up to 1.3.x Code Execution
1397| [113894] Apache Geode up to 1.3.x TcpServer Code Execution
1398| [113888] Apache James Hupa WebMail 0.0.2 cross site scripting
1399| [113813] Apache Geode Cluster up to 1.3.x Secure Mode privilege escalation
1400| [113747] Apache Tomcat Servlets privilege escalation
1401| [113647] Apache Qpid up to 0.30 qpidd Broker AMQP Message Crash denial of service
1402| [113645] Apache VCL up to 2.1/2.2.1/2.3.1 Web GUI/XMLRPC API privilege escalation
1403| [113560] Apache jUDDI Console 3.0.0 Log Entries spoofing
1404| [113571] Apache Oozie up to 4.3.0/5.0.0-beta1 XML Data XML File privilege escalation
1405| [113569] Apache Karaf up to 4.0.7 LDAPLoginModule LDAP injection denial of service
1406| [113273] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
1407| [113198] Apache Qpid Dispatch Router 0.7.0/0.8.0 AMQP denial of service
1408| [113186] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
1409| [113145] Apache Thrift up to 0.9.3 Go Client Library privilege escalation
1410| [113106] Apache jUDDI up to 3.3.3 XML Data WADL2Java/WSDL2Java XML Document privilege escalation
1411| [113105] Apache Qpid Broker-J 7.0.0 AMQP Crash denial of service
1412| [112885] Apache Allura up to 1.8.0 File information disclosure
1413| [112856] Apache CloudStack up to 4.8.1.0/4.9.0.0 API weak authentication
1414| [112855] Apache CloudStack 4.1.0/4.1.1 API information disclosure
1415| [112678] Apache Tomcat up to 7.0.82/8.0.47/8.5.23/9.0.1 Bug Fix 61201 privilege escalation
1416| [112677] Apache Tomcat Native Connector up to 1.1.34/1.2.14 OCSP Checker Client weak authentication
1417| [112625] Apache POI up to 3.16 Loop denial of service
1418| [112448] Apache NiFi up to 1.3.x Deserialization privilege escalation
1419| [112396] Apache Hadoop 2.7.3/2.7.4 YARN NodeManager Credentials information disclosure
1420| [112339] Apache NiFi 1.5.0 Header privilege escalation
1421| [112330] Apache NiFi 1.5.0 Header HTTP Request privilege escalation
1422| [112314] NetGain Enterprise Manager 7.2.730 Build 1034 org.apache.jsp.u.jsp.tools.exec_jsp Servlet Parameter privilege escalation
1423| [112253] Apache Hadoop up to 0.23.x/2.7.4/2.8.2 MapReduce Job History Server Configuration File privilege escalation
1424| [112171] Oracle Secure Global Desktop 5.3 Apache Log4j privilege escalation
1425| [112164] Oracle Agile PLM 9.3.5/9.3.6 Apache Tomcat unknown vulnerability
1426| [112161] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Tomcat privilege escalation
1427| [112158] Oracle Autovue for Agile Product Lifecycle Management 21.0.0/21.0.1 Apache Log4j privilege escalation
1428| [112156] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Log4j privilege escalation
1429| [112155] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Apache Log4j privilege escalation
1430| [112137] Oracle MICROS Relate CRM Software 10.8.x/11.4.x/15.0.x, Apache Tomcat unknown vulnerability
1431| [112136] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat privilege escalation
1432| [112133] Oracle Retail Workforce Management 1.60.7/1.64.0 Apache Log4j privilege escalation
1433| [112129] Oracle Retail Assortment Planning 14.1.3/15.0.3/16.0.1 Apache Log4j privilege escalation
1434| [112114] Oracle 9.1 Apache Log4j privilege escalation
1435| [112113] Oracle 9.1 Apache Log4j privilege escalation
1436| [112045] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat privilege escalation
1437| [112038] Oracle Health Sciences Empirica Inspections 1.0.1.1 Apache Tomcat information disclosure
1438| [112019] Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 Apache Tomcat privilege escalation
1439| [112017] Oracle WebCenter Portal 11.1.1.9.0/12.2.1.2.0/12.2.1.3.0 Apache Struts 1 cross site scripting
1440| [112011] Oracle Identity Manager 11.1.2.3.0 Apache Commons Collections privilege escalation
1441| [111950] Oracle Database 12.2.0.1 Apache Tomcat information disclosure
1442| [111703] Apache Sling XSS Protection API 1.0.4 URL Encoding cross site scripting
1443| [111556] Apache Geode up to 1.2.x Secure Mode Parameter OQL privilege escalation
1444| [111555] Apache Geode up to 1.2.x Secure Mode OQL privilege escalation
1445| [111540] Apache Geode up to 1.2.x Secure Mode information disclosure
1446| [111519] Apache Sling JCR ContentLoader 2.1.4 xmlreader directory traversal
1447| [111338] Apache DeltaSpike-JSF 1.8.0 cross site scripting
1448| [111330] Apache OFBiz 16.11.01/16.11.02/16.11.03 BIRT Plugin cross site scripting
1449| [110789] Apache Sling up to 1.4.0 Authentication Service Credentials information disclosure
1450| [110785] Apache Drill up to 1.11.0 Query Page unknown vulnerability
1451| [110701] Apache Fineract Query Parameter sql injection
1452| [110484] Apache Synapse up to 3.0.0 Apache Commons Collections Serialized Object Code Injection privilege escalation
1453| [110426] Adobe Experience Manager 6.0/6.1/6.2/6.3 Apache Sling Servlets Post cross site scripting
1454| [110393] Apple macOS up to 10.13.2 apache information disclosure
1455| [110141] Apache Struts up to 2.5.14 REST Plugin denial of service
1456| [110140] Apache Qpid Broker-J up to 0.32 privilege escalation
1457| [110139] Apache Qpid Broker-J up to 6.1.4 AMQP Frame denial of service
1458| [110106] Apache CXF Fediz Spring cross site request forgery
1459| [109766] Apache OpenOffice up to 4.1.3 DOC File Parser WW8Fonts memory corruption
1460| [109750] Apache OpenOffice up to 4.1.3 DOC File Parser ImportOldFormatStyles memory corruption
1461| [109749] Apache OpenOffice up to 4.1.3 PPT File Parser PPTStyleSheet memory corruption
1462| [109606] October CMS Build 412 Apache Configuration File Upload privilege escalation
1463| [109419] Apache Camel up to 2.19.3/2.20.0 camel-castor Java Object Deserialization privilege escalation
1464| [109418] Apache Camel up to 2.19.3/2.20.0 camel-hessian Java Object Deserialization privilege escalation
1465| [109400] Apache CouchDB up to 1.6.x/2.1.0 Database Server Shell privilege escalation
1466| [109399] Apache CouchDB up to 1.6.x/2.1.0 JSON Parser Shell privilege escalation
1467| [109398] Apache CXF 3.1.14/3.2.1 JAX-WS/JAX-RS Attachment denial of service
1468| [108872] Apache Hive up to 2.1.1/2.2.0/2.3.0 Policy Enforcement privilege escalation
1469| [108939] Apple macOS up to 10.13.1 apache unknown vulnerability
1470| [108938] Apple macOS up to 10.13.1 apache denial of service
1471| [108937] Apple macOS up to 10.13.1 apache unknown vulnerability
1472| [108936] Apple macOS up to 10.13.1 apache unknown vulnerability
1473| [108935] Apple macOS up to 10.13.1 apache denial of service
1474| [108934] Apple macOS up to 10.13.1 apache unknown vulnerability
1475| [108933] Apple macOS up to 10.13.1 apache unknown vulnerability
1476| [108932] Apple macOS up to 10.13.1 apache unknown vulnerability
1477| [108931] Apple macOS up to 10.13.1 apache denial of service
1478| [108930] Apple macOS up to 10.13.1 apache unknown vulnerability
1479| [108929] Apple macOS up to 10.13.1 apache denial of service
1480| [108928] Apple macOS up to 10.13.1 apache unknown vulnerability
1481| [108797] Apache Struts up to 2.3.19 TextParseUtiltranslateVariables OGNL Expression privilege escalation
1482| [108795] Apache Traffic Server up to 5.3.0 HTTP2 set_dynamic_table_size memory corruption
1483| [108794] Apache WSS4J up to 1.6.16/2.0.1 Incomplete Fix Leak information disclosure
1484| [108793] Apache Qpid up to 0.30 qpidd Crash denial of service
1485| [108792] Apache Traffic Server up to 5.1.0 Access Restriction privilege escalation
1486| [108791] Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2 Session information disclosure
1487| [108790] Apache storm 0.9.0.1 Log Viewer directory traversal
1488| [108789] Apache Cordova In-App-Browser Standalone Plugin up to 0.3.1 on iOS CDVInAppBrowser privilege escalation
1489| [108788] Apache Cordova File-Transfer Standalone Plugin up to 0.4.1 on iOS ios/CDVFileTransfer.m spoofing
1490| [108787] Apache HttpClient up to 4.3.0 HttpClientBuilder.java unknown vulnerability
1491| [108786] Apache Wicket up to 1.4.21/1.5.9/6.3.x script Tag cross site scripting
1492| [108783] Apache Hadoop up to 0.23.3/1.0.3/2.0.1 Kerberos Security Feature Key weak encryption
1493| [108782] Apache Xerces2 XML Service denial of service
1494| [108781] Apache jUDDI up to 1.x happyjuddi.jsp Parameter cross site scripting
1495| [108780] Apache jUDDI up to 1.x Log File uddiget.jsp spoofing
1496| [108709] Apache Cordova Android up to 3.7.1/4.0.1 intent URL privilege escalation
1497| [108708] Apache ActiveMQ up to 5.10.0 XML Data XML External Entity
1498| [108707] Apache ActiveMQ up to 1.7.0 XML Data XML External Entity
1499| [108629] Apache OFBiz up to 10.04.01 privilege escalation
1500| [108543] Apache Derby 10.1.2.1/10.2.2.0/10.3.1.4/10.4.1.3 Export File privilege escalation
1501| [108312] Apache HTTP Server on RHEL IP Address Filter privilege escalation
1502| [108297] Apache NiFi up to 0.7.1/1.1.1 Proxy Chain Username Deserialization privilege escalation
1503| [108296] Apache NiFi up to 0.7.1/1.1.1 Cluster Request privilege escalation
1504| [108250] Oracle Secure Global Desktop 5.3 Apache HTTP Server memory corruption
1505| [108245] Oracle Transportation Management up to 6.3.7 Apache Tomcat unknown vulnerability
1506| [108244] Oracle Transportation Management 6.4.1/6.4.2 Apache Commons FileUpload denial of service
1507| [108243] Oracle Agile Engineering Data Management 6.1.3/6.2.0 Apache Commons Collections memory corruption
1508| [108222] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Batik denial of service
1509| [108219] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat unknown vulnerability
1510| [108217] Oracle Retail Store Inventory Management 13.2.9/14.0.4/14.1.3/15.0.1/16.0.1 Apache Groovy unknown vulnerability
1511| [108216] Oracle Retail Convenience and Fuel POS Software 2.1.132 Apache Groovy unknown vulnerability
1512| [108169] Oracle MySQL Enterprise Monitor up to 3.2.8.2223/3.3.4.3247/3.4.2.4181 Apache Tomcat unknown vulnerability
1513| [108113] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Batik denial of service
1514| [108107] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
1515| [108102] Oracle Healthcare Master Person Index 4.x Apache Groovy unknown vulnerability
1516| [108085] Oracle Identity Manager 11.1.2.3.0 Apache Struts 1 memory corruption
1517| [108083] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
1518| [108080] Oracle GlassFish Server 3.1.2 Apache Commons FileUpload denial of service
1519| [108069] Oracle Endeca Information Discovery Integrator 2.4/3.0/3.1/3.2 Apache Commons Collections memory corruption
1520| [108067] Oracle Business Process Management Suite 11.1.1.9.0/12.2.1.1.0 Apache Commons Collections memory corruption
1521| [108066] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Tomcat memory corruption
1522| [108065] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Commons Collections memory corruption
1523| [108062] Oracle BI Publisher 11.1.1.7.0/12.2.1.1.0/12.2.1.2.0 Apache ActiveMQ memory corruption
1524| [108060] Oracle Enterprise Manager Ops Center 12.2.2/12.3.2 Apache Groovy unknown vulnerability
1525| [108033] Oracle Primavera Unifier 9.13/9.14/10.x/15.x/16.x, Apache Groovy unknown vulnerability
1526| [108024] Oracle Communications Order and Service Management 7.2.4.x.x/7.3.0.x.x/7.3.1.x.x/7.3.5.x.x Apache Commons Collections memory corruption
1527| [108015] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Commons Collections memory corruption
1528| [108013] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Groovy unknown vulnerability
1529| [108011] Oracle Communications Services Gatekeeper 5.1/6.0 Apache Trinidad unknown vulnerability
1530| [107904] Apache Struts up to 2.3.28 Double OGNL Evaluation privilege escalation
1531| [107860] Apache Solr up to 7.0 Apache Lucene RunExecutableListener XML External Entity
1532| [107834] Apache Ranger up to 0.6.1 Change Password privilege escalation
1533| [107639] Apache NiFi 1.4.0 XML External Entity
1534| [107606] Apache ZooKeper up to 3.4.9/3.5.2 Command CPU Exhaustion denial of service
1535| [107597] Apache Roller up to 5.0.2 XML-RPC Protocol Support XML External Entity
1536| [107429] Apache Impala up to 2.9.x Kudu Table privilege escalation
1537| [107411] Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0 JSP File File Upload privilege escalation
1538| [107385] Apache Geode up to 1.2.0 Secure Mode privilege escalation
1539| [107339] Apache OpenNLP up to 1.5.3/1.6.0/1.7.2/1.8.1 XML Data XML External Entity
1540| [107333] Apache Wicket up to 8.0.0-M1 CSRF Prevention HTTP Header privilege escalation
1541| [107323] Apache Wicket 1.5.10/6.13.0 Class Request information disclosure
1542| [107310] Apache Geode up to 1.2.0 Command Line Utility Query privilege escalation
1543| [107276] ArcSight ESM/ArcSight ESM Express up to 6.9.1c Patch 3/6.11.0 Apache Tomcat Version information disclosure
1544| [107266] Apache Tika up to 1.12 XML Parser XML External Entity
1545| [107262] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
1546| [107258] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
1547| [107197] Apache Xerces Jelly Parser XML File XML External Entity
1548| [107193] ZTE NR8950 Apache Commons Collections RMI Request Deserialization privilege escalation
1549| [107084] Apache Struts up to 2.3.19 cross site scripting
1550| [106877] Apache Struts up to 2.0.33/2.5.10 Freemarker Tag privilege escalation
1551| [106875] Apache Struts up to 2.5.5 URL Validator denial of service
1552| [106874] Apache Struts up to 2.3.30 Convention Plugin directory traversal
1553| [106847] Apache Tomcat up to 7.0.80 VirtualDirContext Source information disclosure
1554| [106846] Apache Tomcat up to 7.0.79 on Windows HTTP PUT Method Parameter File Upload privilege escalation
1555| [106777] Apache HTTP Server up to 2.2.34/2.4.27 Limit Directive ap_limit_section HTTP Request information disclosure
1556| [106739] puppetlabs-apache up to 1.11.0/2.0.x weak authentication
1557| [106720] Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4 CryptoMapper privilege escalation
1558| [106586] Apache Brooklyn up to 0.9.x REST Server cross site scripting
1559| [106562] Apache Spark up to 2.1.1 Launcher API Deserialization privilege escalation
1560| [106559] Apache Brooklyn up to 0.9.x SnakeYAML YAML Data Java privilege escalation
1561| [106558] Apache Brooklyn up to 0.9.x REST Server cross site request forgery
1562| [106556] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
1563| [106555] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
1564| [106171] Apache Directory LDAP API up to 1.0.0-M30 Timing unknown vulnerability
1565| [106167] Apache Struts up to 2.5.12 REST Plugin XML Data privilege escalation
1566| [106166] Apache Struts up to 2.3.33/2.5.12 REST Plugin denial of service
1567| [106165] Apache Struts up to 2.3.33/2.5.12 URLValidator Regex CPU Exhaustion denial of service
1568| [106115] Apache Hadoop up to 2.6.4/2.7.2 YARN NodeManager Password information disclosure
1569| [106012] Apache Solr up to 5.5.3/6.4.0 Replication directory traversal
1570| [105980] Apache Engine 16.11.01 Parameter Reflected unknown vulnerability
1571| [105962] Apache Atlas 0.6.0/0.7.0 Frame cross site scripting
1572| [105961] Apache Atlas 0.6.0/0.7.0 Stack Trace information disclosure
1573| [105960] Apache Atlas 0.6.0/0.7.0 Search Reflected cross site scripting
1574| [105959] Apache Atlas 0.6.0/0.7.0 edit Tag DOM cross site scripting
1575| [105958] Apache Atlas 0.6.0/0.7.0 edit Tag Stored cross site scripting
1576| [105957] Apache Atlas 0.6.0/0.7.0 Cookie privilege escalation
1577| [105905] Apache Atlas 0.6.0/0.7.0/0.7.1 /js privilege escalation
1578| [105878] Apache Struts up to 2.3.24.0 privilege escalation
1579| [105682] Apache2Triad 1.5.4 phpsftpd/users.php Parameter cross site scripting
1580| [105681] Apache2Triad 1.5.4 phpsftpd/users.php Request cross site request forgery
1581| [105680] Apache2Triad 1.5.4 Parameter Session Fixation weak authentication
1582| [105643] Apache Pony Mail up to 0.8b weak authentication
1583| [105288] Apache Sling up to 2.3.21 Sling.evalString() String cross site scripting
1584| [105219] Apache Tomcat up to 8.5.15/9.0.0.M21 HTTP2 Bypass directory traversal
1585| [105218] Apache Tomcat up to 7.0.78/8.0.44/8.5.15/9.0.0.M21 CORS Filter Cache Poisoning privilege escalation
1586| [105215] Apache CXF up to 3.0.12/3.1.9 OAuth2 Hawk/JOSE MAC Validation Timing unknown vulnerability
1587| [105206] Apache CXF up to 3.0.11/3.1.8 JAX-RS Module XML External Entity
1588| [105205] Apache CXF up to 3.0.11/3.1.8 HTTP Transport Module Parameter cross site scripting
1589| [105202] Apache Storm 1.0.0/1.0.1/1.0.2/1.0.3/1.1.0 Worker privilege escalation
1590| [104987] Apache Xerces-C++ XML Service CPU Exhaustion denial of service
1591| [104986] Apache CXF 2.4.5/2.5.1 WS-SP UsernameToken Policy SOAP Request weak authentication
1592| [104985] Apache MyFaces Core up to 2.1.4 EL Expression Parameter Injection information disclosure
1593| [104983] Apache Wink up to 1.1.1 XML Document xxe privilege escalation
1594| [104981] Apache Commons Email 1.0/1.1/1.2/1.3/1.4 Subject Linebreak SMTP privilege escalation
1595| [104591] MEDHOST Document Management System Apache Solr Default Credentials weak authentication
1596| [104062] Oracle MySQL Enterprise Monitor up to 3.3.3.1199 Apache Tomcat unknown vulnerability
1597| [104061] Oracle MySQL Enterprise Monitor up to 3.2.7.1204/3.3.3.1199 Apache Tomcat unknown vulnerability
1598| [104060] Oracle MySQL Enterprise Monitor up to 3.1.5.7958/3.2.5.1141/3.3.2.1162 Apache Struts 2 unknown vulnerability
1599| [103995] Oracle 8.3/8.4/15.1/15.2 Apache Trinidad unknown vulnerability
1600| [103993] Oracle Policy Automation up to 12.2.3 Apache Commons FileUplaod denial of service
1601| [103916] Oracle Banking Platform 2.3/2.4/2.4.1/2.5 Apache Commons FileUpload denial of service
1602| [103906] Oracle Communications BRM 11.2.0.0.0 Apache Commons Collections privilege escalation
1603| [103904] Oracle Communications BRM 11.2.0.0.0/11.3.0.0.0 Apache Groovy memory corruption
1604| [103866] Oracle Transportation Management 6.1/6.2 Apache Webserver unknown vulnerability
1605| [103816] Oracle BI Publisher 11.1.1.9.0/12.2.1.1.0/12.2.1.2.0 Apache Commons Fileupload denial of service
1606| [103797] Oracle Tuxedo System and Applications Monitor Apache Commons Collections privilege escalation
1607| [103792] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Commons Fileupload privilege escalation
1608| [103791] Oracle Endeca Server 7.6.0.0/7.6.1.0 Apache Commons Collections privilege escalation
1609| [103788] Oracle Enterprise Repository 11.1.1.7.0/12.1.3.0.0 Apache ActiveMQ memory corruption
1610| [103787] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Groovy memory corruption
1611| [103763] Apache Sling up to 1.0.11 XSS Protection API XSS.getValidXML() Application XML External Entity
1612| [103762] Apache Sling up to 1.0.12 XSS Protection API XSSAPI.encodeForJSString() Script Tag cross site scripting
1613| [103693] Apache OpenMeetings 1.0.0 HTTP Method privilege escalation
1614| [103692] Apache OpenMeetings 1.0.0 Tomcat Error information disclosure
1615| [103691] Apache OpenMeetings 3.2.0 Parameter privilege escalation
1616| [103690] Apache OpenMeetings 1.0.0 sql injection
1617| [103689] Apache OpenMeetings 1.0.0 crossdomain.xml privilege escalation
1618| [103688] Apache OpenMeetings 1.0.0 weak encryption
1619| [103687] Apache OpenMeetings 1.0.0 cross site request forgery
1620| [103556] Apache Roller 5.1.0/5.1.1 Weblog Page Template VTL privilege escalation
1621| [103554] Apache OpenMeetings 1.0.0 Password Update unknown vulnerability
1622| [103553] Apache OpenMeetings 1.0.0 File Upload privilege escalation
1623| [103552] Apache OpenMeetings 3.2.0 Chat cross site scripting
1624| [103551] Apache OpenMeetings 3.1.0 XML unknown vulnerability
1625| [103521] Apache HTTP Server 2.4.26 HTTP2 Free memory corruption
1626| [103520] Apache HTTP Server up to 2.2.33/2.4.26 mod_auth_digest Authorization Header memory corruption
1627| [103519] Apache Struts up to 2.5.11/2.3.32 Spring AOP denial of service
1628| [103518] Apache Struts up to 2.5.11 URLValidator directory traversal
1629| [103492] Apache Spark up to 2.1.x Web UI Reflected cross site scripting
1630| [103401] Apache Struts 2.3.x Struts 1 Plugin ActionMessage privilege escalation
1631| [103399] Apache Traffic Control Traffic Router TCP Connection Slowloris denial of service
1632| [103387] Apache Impala up to 2.8.0 StatestoreSubscriber weak encryption
1633| [103386] Apache Impala up to 2.7.x/2.8.0 Kerberos weak authentication
1634| [103352] Apache Solr Node weak authentication
1635| [102897] Apache Ignite up to 2.0 Update Notifier information disclosure
1636| [102878] Code42 CrashPlan 5.4.x RMI Server org.apache.commons.ssl.rmi.DateRMI privilege escalation
1637| [102698] Apache HTTP Server up to 2.2.32/2.4.25 mod_mime Content-Type memory corruption
1638| [102697] Apache HTTP Server 2.2.32/2.2.24 HTTP Strict Parsing ap_find_token Request Header memory corruption
1639| [102690] Apache HTTP Server up to 2.2.32/2.4.25 mod_ssl ap_hook_process_connection() denial of service
1640| [102689] Apache HTTP Server up to 2.2.32/2.4.25 ap_get_basic_auth_pw weak authentication
1641| [102622] Apache Thrift up to 0.9.2 Client Libraries skip denial of service
1642| [102538] Apache Ranger up to 0.7.0 Authorizer unknown vulnerability
1643| [102537] Apache Ranger up to 0.7.0 Wildcard Character unknown vulnerability
1644| [102536] Apache Ranger up to 0.6 Stored cross site scripting
1645| [102535] Apache Ranger up to 0.6.2 Policy Engine unknown vulnerability
1646| [102255] Apache NiFi up to 0.7.3/1.2.x Response Header privilege escalation
1647| [102254] Apache NiFi up to 0.7.3/1.2.x UI cross site scripting
1648| [102070] Apache CXF Fediz up to 1.1.2/1.2.0 Application Plugin denial of service
1649| [102020] Apache Tomcat up to 9.0.0.M1 Java Servlet HTTP Method unknown vulnerability
1650| [101858] Apache Hive up to 1.2.1/2.0.0 Client weak authentication
1651| [101802] Apache KNOX up to 0.11.0 WebHDFS privilege escalation
1652| [101928] HPE Aruba ClearPass Apache Tomcat information disclosure
1653| [101524] Apache Archiva up to 1.x/2.2.1 REST Endpoint cross site request forgery
1654| [101513] Apache jUDDI 3.1.2/3.1.3/3.1.4/3.1. Logout Open Redirect
1655| [101430] Apache CXF Fediz up to 1.3.1 OIDC Service cross site request forgery
1656| [101429] Apache CXF Fediz up to 1.2.3/1.3.1 Plugins cross site request forgery
1657| [100619] Apache Hadoop up to 2.6.x HDFS Servlet unknown vulnerability
1658| [100618] Apache Hadoop up to 2.7.0 HDFS Web UI cross site scripting
1659| [100621] Adobe ColdFusion 10/11/2016 Apache BlazeDS Library Deserialization privilege escalation
1660| [100205] Oracle MySQL Enterprise Monitor up to 3.1.6.8003/3.2.1182/3.3.2.1162 Apache Commons FileUpload denial of service
1661| [100191] Oracle Secure Global Desktop 4.71/5.2/5.3 Web Server (Apache HTTP Server) information disclosure
1662| [100162] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Commons Collections privilege escalation
1663| [100160] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Trinidad unknown vulnerability
1664| [99969] Oracle WebCenter Sites 11.1.1.8.0 Apache Tomcat memory corruption
1665| [99937] Apache Batik up to 1.8 privilege escalation
1666| [99936] Apache FOP up to 2.1 privilege escalation
1667| [99935] Apache CXF up to 3.0.12/3.1.10 STSClient Cache information disclosure
1668| [99934] Apache CXF up to 3.0.12/3.1.10 JAX-RS XML Security Streaming Client spoofing
1669| [99930] Apache Traffic Server up to 6.2.0 denial of service
1670| [99929] Apache Log4j up to 2.8.1 Socket Server Deserialization privilege escalation
1671| [99925] Apache Traffic Server 6.0.0/6.1.0/6.2.0 HPACK Bomb denial of service
1672| [99738] Ping Identity OpenID Connect Authentication Module up to 2.13 on Apache Mod_auth_openidc.c spoofing
1673| [117569] Apache Hadoop up to 2.7.3 privilege escalation
1674| [99591] Apache TomEE up to 1.7.3/7.0.0-M2 EjbObjectInputStream Serialized Object privilege escalation
1675| [99370] Apache Ignite up to 1.8 update-notifier Document XML External Entity
1676| [99299] Apache Geode up to 1.1.0 Pulse OQL Query privilege escalation
1677| [99572] Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 Application Listener privilege escalation
1678| [99570] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP Connector Cache information disclosure
1679| [99569] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP/2 GOAWAY Frame Resource Exhaustion denial of service
1680| [99568] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 Pipelined Request information disclosure
1681| [99048] Apache Ambari up to 2.3.x REST API Shell Metacharacter privilege escalation
1682| [99014] Apache Camel Jackson/JacksonXML privilege escalation
1683| [98610] Apple macOS up to 10.12.3 apache_mod_php memory corruption
1684| [98609] Apple macOS up to 10.12.3 apache_mod_php denial of service
1685| [98608] Apple macOS up to 10.12.3 apache_mod_php memory corruption
1686| [98607] Apple macOS up to 10.12.3 apache_mod_php denial of service
1687| [98606] Apple macOS up to 10.12.3 apache_mod_php denial of service
1688| [98605] Apple macOS up to 10.12.3 Apache denial of service
1689| [98604] Apple macOS up to 10.12.3 Apache denial of service
1690| [98603] Apple macOS up to 10.12.3 Apache denial of service
1691| [98602] Apple macOS up to 10.12.3 Apache denial of service
1692| [98601] Apple macOS up to 10.12.3 Apache denial of service
1693| [98517] Apache POI up to 3.14 OOXML File XXE denial of service
1694| [98405] Apache Hadoop up to 0.23.10 privilege escalation
1695| [98199] Apache Camel Validation XML External Entity
1696| [97892] Apache Tomcat up to 9.0.0.M15 Reverse-Proxy Http11InputBuffer.java information disclosure
1697| [97617] Apache Camel camel-snakeyaml Deserialization privilege escalation
1698| [97602] Apache Camel camel-jackson/camel-jacksonxml CamelJacksonUnmarshalType privilege escalation
1699| [97732] Apache Struts up to 2.3.31/2.5.10 Jakarta Multipart Parser Content-Type privilege escalation
1700| [97466] mod_auth_openidc up to 2.1.5 on Apache weak authentication
1701| [97455] mod_auth_openidc up to 2.1.4 on Apache weak authentication
1702| [97081] Apache Tomcat HTTPS Request denial of service
1703| [97162] EMC OpenText Documentum D2 BeanShell/Apache Commons privilege escalation
1704| [96949] Hanwha Techwin Smart Security Manager up to 1.5 Redis/Apache Felix Gogo privilege escalation
1705| [96314] Apache Cordova up to 6.1.1 on Android weak authentication
1706| [95945] Apple macOS up to 10.12.2 apache_mod_php denial of service
1707| [95944] Apple macOS up to 10.12.2 apache_mod_php denial of service
1708| [95943] Apple macOS up to 10.12.2 apache_mod_php memory corruption
1709| [95666] Oracle FLEXCUBE Direct Banking 12.0.0/12.0.1/12.0.2/12.0.3 Apache Commons Collections privilege escalation
1710| [95455] Apache NiFi up to 1.0.0/1.1.0 Connection Details Dialogue cross site scripting
1711| [95311] Apache storm UI Daemon privilege escalation
1712| [95291] ZoneMinder 1.30.0 Apache httpd privilege escalation
1713| [94800] Apache Wicket up to 1.5.16/6.24.x Deserialize DiskFileItem denial of service
1714| [94705] Apache Qpid Broker for Java up to 6.1.0 SCRAM-SHA-1/SCRAM-SHA-256 User information disclosure
1715| [94627] Apache HTTP Server up to 2.4.24 mod_auth_digest Crash denial of service
1716| [94626] Apache HTTP Server up to 2.4.24 mod_session_crypto Padding weak encryption
1717| [94625] Apache HTTP Server up to 2.4.24 Response Split privilege escalation
1718| [94540] Apache Tika 1.9 tika-server File information disclosure
1719| [94600] Apache ActiveMQ up to 5.14.1 Administration Console cross site scripting
1720| [94348] Apple macOS up to 10.12.1 apache_mod_php denial of service
1721| [94347] Apple macOS up to 10.12.1 apache_mod_php denial of service
1722| [94346] Apple macOS up to 10.12.1 apache_mod_php denial of service
1723| [94345] Apple macOS up to 10.12.1 apache_mod_php denial of service
1724| [94344] Apple macOS up to 10.12.1 apache_mod_php denial of service
1725| [94343] Apple macOS up to 10.12.1 apache_mod_php memory corruption
1726| [94342] Apple macOS up to 10.12.1 apache_mod_php memory corruption
1727| [94128] Apache Tomcat up to 9.0.0.M13 Error information disclosure
1728| [93958] Apache HTTP Server up to 2.4.23 mod_http2 h2_stream.c denial of service
1729| [93874] Apache Subversion up to 1.8.16/1.9.4 mod_dontdothat XXE denial of service
1730| [93855] Apache Hadoop up to 2.6.4/2.7.2 HDFS Service privilege escalation
1731| [93609] Apache OpenMeetings 3.1.0 RMI Registry privilege escalation
1732| [93555] Apache Tika 1.6-1.13 jmatio MATLAB File privilege escalation
1733| [93799] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
1734| [93798] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
1735| [93797] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 HTTP Split privilege escalation
1736| [93796] Apache Tomcat up to 8.5.6/9.0.0.M11 HTTP/2 Header Parser denial of service
1737| [93532] Apache Commons Collections Library Java privilege escalation
1738| [93210] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 ResourceLinkFactory privilege escalation
1739| [93209] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Realm Authentication User information disclosure
1740| [93208] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 System Property Replacement information disclosure
1741| [93207] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Utility Method privilege escalation
1742| [93206] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Configuration privilege escalation
1743| [93098] Apache Commons FileUpload privilege escalation
1744| [92987] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Commons Collection memory corruption
1745| [92986] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Tomcat memory corruption
1746| [92982] Oracle Insurance IStream 4.3.2 Apache Commons Collections memory corruption
1747| [92981] Oracle Financial Services Lending and Leasing 14.1.0/14.2.0 Apache Commons Collections memory corruption
1748| [92979] Oracle up to 8.0.3 Apache Commons Collections memory corruption
1749| [92977] Oracle FLEXCUBE Universal Banking up to 12.2.0 Apache Commons Collections memory corruption
1750| [92976] Oracle FLEXCUBE Universal Banking 12.87.1/12.87.2 Apache Commons Collections memory corruption
1751| [92975] Oracle FLEXCUBE Private Banking up to 12.1.0 Apache Commons Collections memory corruption
1752| [92974] Oracle FLEXCUBE Investor Servicing 12.0.1 Apache Commons Collections memory corruption
1753| [92973] Oracle 12.0.0/12.1.0 Apache Commons Collections memory corruption
1754| [92972] Oracle FLEXCUBE Core Banking 11.5.0.0.0/11.6.0.0.0 Apache Commons Collections memory corruption
1755| [92962] Oracle Agile PLM 9.3.4/9.3.5 Apache Commons Collections memory corruption
1756| [92909] Oracle Agile PLM 9.3.4/9.3.5 Apache Tomcat unknown vulnerability
1757| [92786] Oracle Banking Digital Experience 15.1 Apache Commons Collections information disclosure
1758| [92549] Apache Tomcat on Red Hat privilege escalation
1759| [92509] Apache Tomcat JK ISAPI Connector up to 1.2.41 jk_uri_worker_map.c memory corruption
1760| [92314] Apache MyFaces Trinidad up to 1.0.13/1.2.15/2.0.1/2.1.1 CoreResponseStateManager memory corruption
1761| [92313] Apache Struts2 up to 2.3.28/2.5.0 Action Name Cleanup cross site request forgery
1762| [92299] Apache Derby up to 10.12.1.0 SqlXmlUtil XML External Entity
1763| [92217] Apache ActiveMQ Artemis up to 1.3.x Broker/REST GetObject privilege escalation
1764| [92174] Apache Ranger up to 0.6.0 Policy cross site scripting
1765| [91831] Apache Jackrabbit up to 2.13.2 HTTP Header cross site request forgery
1766| [91825] Apache Zookeeper up to 3.4.8/3.5.2 C CLI Shell memory corruption
1767| [91818] Apache CXF Fediz up to 1.2.2/1.3.0 Application Plugin privilege escalation
1768| [92056] Apple macOS up to 10.11 apache_mod_php memory corruption
1769| [92055] Apple macOS up to 10.11 apache_mod_php memory corruption
1770| [92054] Apple macOS up to 10.11 apache_mod_php denial of service
1771| [92053] Apple macOS up to 10.11 apache_mod_php denial of service
1772| [92052] Apple macOS up to 10.11 apache_mod_php denial of service
1773| [92051] Apple macOS up to 10.11 apache_mod_php memory corruption
1774| [92050] Apple macOS up to 10.11 apache_mod_php denial of service
1775| [92049] Apple macOS up to 10.11 apache_mod_php memory corruption
1776| [92048] Apple macOS up to 10.11 apache_mod_php denial of service
1777| [92047] Apple macOS up to 10.11 apache_mod_php memory corruption
1778| [92046] Apple macOS up to 10.11 apache_mod_php memory corruption
1779| [92045] Apple macOS up to 10.11 apache_mod_php memory corruption
1780| [92044] Apple macOS up to 10.11 apache_mod_php memory corruption
1781| [92043] Apple macOS up to 10.11 apache_mod_php denial of service
1782| [92042] Apple macOS up to 10.11 apache_mod_php memory corruption
1783| [92041] Apple macOS up to 10.11 apache_mod_php memory corruption
1784| [92040] Apple macOS up to 10.11 Apache Proxy privilege escalation
1785| [91785] Apache Shiro up to 1.3.1 Servlet Filter privilege escalation
1786| [90879] Apache OpenMeetings up to 3.1.1 SWF Panel cross site scripting
1787| [90878] Apache Sentry up to 1.6.x Blacklist Filter reflect/reflect2/java_method privilege escalation
1788| [90610] Apache POI up to 3.13 XLSX2CSV Example OpenXML Document XML External Entity
1789| [90584] Apache ActiveMQ up to 5.11.3/5.12.2/5.13/1 Administration Web Console privilege escalation
1790| [90385] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site scripting
1791| [90384] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site request forgery
1792| [90383] Apache OpenOffice up to 4.1.2 Impress File memory corruption
1793| [89670] Apache Tomcat up to 8.5.4 CGI Servlet Environment Variable Open Redirect
1794| [89669] Apache HTTP Server up to 2.4.23 RFC 3875 Namespace Conflict Environment Variable Open Redirect
1795| [89726] Apple Mac OS X up to 10.11.5 apache_mod_php memory corruption
1796| [89484] Apache Qpid up to 0.13.0 on Windows Proton Library Certificate weak authentication
1797| [89473] HPE iMC PLAT/EAD/APM/iMC NTA/iMC BIMS/iMC UAM_TAM up to 7.2 Apache Commons Collections Library Command privilege escalation
1798| [90263] Apache Archiva Header denial of service
1799| [90262] Apache Archiva Deserialize privilege escalation
1800| [90261] Apache Archiva XML DTD Connection privilege escalation
1801| [88827] Apache Xerces-C++ up to 3.1.3 DTD Stack-Based memory corruption
1802| [88747] Apache HTTP Server 2.4.17/2.4.18 mod_http2 denial of service
1803| [88608] Apache Struts up to 2.3.28.1/2.5.0 URLValidator Null Value denial of service
1804| [88607] Apache Struts up to 2.3.28.1 REST Plugin Expression privilege escalation
1805| [88606] Apache Struts up to 2.3.28.1 Restriction privilege escalation
1806| [88605] Apache Struts up to 2.3.28.1 Restriction privilege escalation
1807| [88604] Apache Struts up to 2.3.28.1 Token Validator cross site request forgery
1808| [88603] Apache Commons FileUpload up to 1.3.1 MultipartStream denial of service
1809| [88602] Apache Struts up to 1.3.10 ActionServlet.java cross site scripting
1810| [88601] Apache Struts up to 1.3.10 Multithreading ActionServlet.java memory corruption
1811| [88600] Apache Struts up to 1.3.10 MultiPageValidator privilege escalation
1812| [89005] Apache Qpid AMQP JMS Client getObject privilege escalation
1813| [87888] Apache Ranger up to 0.5.2 Policy Admin Tool eventTime sql injection
1814| [87835] Apache CloudStack up to 4.5.2.0/4.6.2.0/4.7.1.0/4.8.0.0 SAML-based Authentication privilege escalation
1815| [87806] HPE Discovery and Dependency Mapping Inventory up to 9.32 update 3 Apache Commons Collections Library privilege escalation
1816| [87805] HPE Universal CMDB up to 10.21 Apache Commons Collections Library privilege escalation
1817| [87768] Apache Shiro up to 1.2.4 Cipher Key privilege escalation
1818| [87765] Apache James Server 2.3.2 Command privilege escalation
1819| [88667] Apache HTTP Server up to 2.4.20 mod_http2 Certificate weak authentication
1820| [87718] Apache Struts up to 2.3.24.1 OGNL Caching denial of service
1821| [87717] Apache Struts up to 2.3.28 REST Plugin privilege escalation
1822| [87706] Apache Qpid Java up to 6.0.2 AMQP privilege escalation
1823| [87703] Apache Qbid Java up to 6.0.2 PlainSaslServer.java denial of service
1824| [87702] Apache ActiveMQ up to 5.13.x Fileserver Web Application Upload privilege escalation
1825| [87700] Apache PDFbox up to 1.8.11/2.0.0 XML Parser PDF Document XML External Entity
1826| [87679] HP Release Control 9.13/9.20/9.21 Apache Commons Collections Library Java Object privilege escalation
1827| [87540] Apache Ambari up to 2.2.0 File Browser View information disclosure
1828| [87433] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
1829| [87432] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
1830| [87431] Apple Mac OS X up to 10.11.4 apache_mod_php Format String
1831| [87430] Apple Mac OS X up to 10.11.4 apache_mod_php denial of service
1832| [87429] Apple Mac OS X up to 10.11.4 apache_mod_php information disclosure
1833| [87428] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
1834| [87427] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
1835| [87389] Apache Xerces C++ up to 3.1.3 XML Document DTDScanner.cpp memory corruption
1836| [87172] Adobe ColdFusion up to 10 Update 18/11 Update 7/2016 Apache Commons Collections Library privilege escalation
1837| [87121] Apache Cordova iOS up to 3.x Plugin privilege escalation
1838| [87120] Apache Cordova iOS up to 3.x URL Whitelist privilege escalation
1839| [83806] HPE Network Node Manager i up to 10.01 Apache Commons Collections Library privilege escalation
1840| [83077] Apache Subversion up to 1.8.15/1.9.3 mod_authz_svn mod_authz_svn.c denial of service
1841| [83076] Apache Subversion up to 1.8.15/1.9.3 svnserve svnserve/cyrus_auth.c privilege escalation
1842| [82790] Apache Struts 2.0.0/2.3.24/2.3.28 Dynamic Method privilege escalation
1843| [82789] Apache Struts 2.0.0/2.3.24/2.3.28 XSLTResult privilege escalation
1844| [82725] HPE P9000 Command View up to 7.x/8.4.0 Apache Commons Collections Library privilege escalation
1845| [82444] Apache Camel up to 2.14.x/2.15.4/2.16.0 HTTP Request privilege escalation
1846| [82389] Apache Subversion up to 1.7.x/1.8.14/1.9.2 mod_dav_svn util.c memory corruption
1847| [82280] Apache Struts up to 1.7 JRE URLDecoder cross site scripting
1848| [82260] Apache OFBiz up to 12.04.05/13.07.02 Java Object privilege escalation
1849| [82259] Apache Qpid Proton up to 0.12.0 proton.reactor.Connector weak encryption
1850| [82250] Apache Ranger up to 0.5.0 Admin UI weak authentication
1851| [82214] Apache Wicket up to 1.5.14/6.21.x/7.1.x Input Element cross site scripting
1852| [82213] Apache Wicket up to 1.5.14/6.21.x/7.1.x ModalWindow Title getWindowOpenJavaScript cross site scripting
1853| [82212] Apache Ranger up to 0.5.0 Policy Admin Tool privilege escalation
1854| [82211] Apache OFBiz up to 12.04.06/13.07.02 ModelFormField.java DisplayEntityField.getDescription cross site scripting
1855| [82082] Apache JetSpeed up to 2.3.0 User Manager Service privilege escalation
1856| [82081] Apache OpenMeetings up to 3.1.0 SOAP API information disclosure
1857| [82080] Apache OpenMeetings up to 3.1.0 Event cross site scripting
1858| [82078] Apache OpenMeetings up to 3.1.0 Import/Export System Backup ZIP Archive directory traversal
1859| [82077] Apache OpenMeetings up to 3.1.0 Password Reset sendHashByUser privilege escalation
1860| [82076] Apache Ranger up to 0.5.1 privilege escalation
1861| [82075] Apache JetSpeed up to 2.3.0 Portal cross site scripting
1862| [82074] Apache JetSpeed up to 2.3.0 cross site scripting
1863| [82073] Apache JetSpeed up to 2.3.0 User Manager Service sql injection
1864| [82072] Apache JetSpeed up to 2.3.0 Portal Site Manager ZIP Archive directory traversal
1865| [82058] Apache LDAP Studio/Directory Studio up to 2.0.0-M9 CSV Export privilege escalation
1866| [82053] Apache Ranger up to 0.4.x Policy Admin Tool privilege escalation
1867| [82052] Apache Ranger up to 0.4.x Policy Admin Tool HTTP Request cross site scripting
1868| [81696] Apache ActiveMQ up to 5.13.1 HTTP Header privilege escalation
1869| [81695] Apache Xerces-C up to 3.1.2 internal/XMLReader.cpp memory corruption
1870| [81622] HPE Asset Manager 9.40/9.41/9.50 Apache Commons Collections Library Java Object privilege escalation
1871| [81406] HPE Service Manager up to 9.35 P3/9.41 P1 Apache Commons Collections Library Command privilege escalation
1872| [81405] HPE Operations Orchestration up to 10.50 Apache Commons Collections Library Command privilege escalation
1873| [81427] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
1874| [81426] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
1875| [81372] Apache Struts up to 2.3.24.1 I18NInterceptor cross site scripting
1876| [81371] Apache Struts up to 2.3.24.1 Double OGNL Evaluation privilege escalation
1877| [81370] Apache Struts up to 2.3.24.1 Java URLDecoder cross site scripting
1878| [81084] Apache Tomcat 6.0/7.0/8.0/9.0 ServletContext directory traversal
1879| [81083] Apache Tomcat 7.0/8.0/9.0 Index Page cross site request forgery
1880| [81082] Apache Tomcat 7.0/8.0/9.0 ResourceLinkFactory.setGlobalContext privilege escalation
1881| [81081] Apache Tomcat 6.0/7.0/8.0/9.0 Error information disclosure
1882| [81080] Apache Tomcat 6.0/7.0/8.0/9.0 Session Persistence privilege escalation
1883| [81079] Apache Tomcat 6.0/7.0/8.0/9.0 StatusManagerServlet information disclosure
1884| [81078] Apache Tomcat 7.0/8.0/9.0 Session privilege escalation
1885| [80970] Apache Solr up to 5.3.0 Admin UI plugins.js cross site scripting
1886| [80969] Apache Solr up to 5.2 Schema schema-browser.js cross site scripting
1887| [80968] Apache Solr up to 5.0 analysis.js cross site scripting
1888| [80940] HP Continuous Delivery Automation 1.30 Apache Commons Collections Library privilege escalation
1889| [80823] Apache CloudStack up to 4.5.1 KVM Virtual Machine Migration privilege escalation
1890| [80822] Apache CloudStack up to 4.5.1 API Call information disclosure
1891| [80778] Apache Camel up to 2.15.4/2.16.0 camel-xstream privilege escalation
1892| [80750] HPE Operations Manager 8.x/9.0 on Windows Apache Commons Collections Library privilege escalation
1893| [80724] Apache Hive up to 1.2.1 Authorization Framework privilege escalation
1894| [80577] Oracle Secure Global Desktop 4.63/4.71/5.2 Apache HTTP Server denial of service
1895| [80165] Intel McAfee ePolicy Orchestrator up to 4.6.9/5.0.3/5.3.1 Apache Commons Collections Library privilege escalation
1896| [80116] Apache Subversion up to 1.9.2 svn Protocol libsvn_ra_svn/marshal.c read_string memory corruption
1897| [80115] Apache ActiveMQ up to 5.12.x Broker Service privilege escalation
1898| [80036] IBM Cognos Business Intelligence Apache Commons Collections Library InvokerTransformer privilege escalation
1899| [79873] VMware vCenter Operations/vRealize Orchestrator Apache Commons Collections Library Serialized Java Object privilege escalation
1900| [79840] Apache Cordova File Transfer Plugin up to 1.2.x on Android unknown vulnerability
1901| [79839] Apache TomEE Serialized Java Stream EjbObjectInputStream privilege escalation
1902| [79791] Cisco Products Apache Commons Collections Library privilege escalation
1903| [79539] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
1904| [79538] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
1905| [79294] Apache Cordova-Android up to 3.6 BridgeSecret Random Generator weak encryption
1906| [79291] Apache Cordova-Android up to 4.0 Javascript Whitelist privilege escalation
1907| [79244] Apache CXF up to 2.7.17/3.0.7/3.1.2 SAML Web SSO Module SAML Response weak authentication
1908| [79243] Oracle WebLogic Server 10.3.6.0/12.1.2.0/12.1.3.0/12.2.1.0 WLS Security com.bea.core.apache.commons.collections.jar privilege escalation
1909| [78989] Apache Ambari up to 2.1.1 Open Redirect
1910| [78988] Apache Ambari up to 2.0.1/2.1.0 Password privilege escalation
1911| [78987] Apache Ambari up to 2.0.x cross site scripting
1912| [78986] Apache Ambari up to 2.0.x Proxy Endpoint api/v1/proxy privilege escalation
1913| [78780] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
1914| [78779] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
1915| [78778] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
1916| [78777] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
1917| [78776] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
1918| [78775] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
1919| [78774] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
1920| [78297] Apache Commons Components HttpClient up to 4.3.5 HTTPS Timeout denial of service
1921| [77406] Apache Flex BlazeDS AMF Message XML External Entity
1922| [77429] Apache ActiveMQ up to 5.10.0 LDAPLoginModule privilege escalation
1923| [77399] Apache ActiveMQ up to 5.10.0 LDAPLoginModule weak authentication
1924| [77375] Apache Tapestry up to 5.3.5 Client-Side Object Storage privilege escalation
1925| [77331] Apache ActiveMQ up to 5.11.1 on Windows Fileserver Upload/Download directory traversal
1926| [77299] Apache Solr Real-Time Module up to 7.x-1.1 Index Content information disclosure
1927| [77247] Apache ActiveMQ up to 5.10 TransportConnection.java processControlCommand denial of service
1928| [77083] Apache Groovy up to 2.4.3 MethodClosure.java MethodClosure memory corruption
1929| [76953] Apache Subversion 1.7.0/1.8.0/1.8.10 svn_repos_trace_node_locations information disclosure
1930| [76952] Apache Subversion 1.7.0/1.8.0/1.8.10 mod_authz_svn anonymous/authenticated information disclosure
1931| [76567] Apache Struts 2.3.20 unknown vulnerability
1932| [76733] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 ap_some_auth_required unknown vulnerability
1933| [76732] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 Request apr_brigade_flatten privilege escalation
1934| [76731] Apache HTTP Server 2.4.12 ErrorDocument 400 Crash denial of service
1935| [75690] Apache Camel up to 2.13.3/2.14.1 XPathBuilder.java XML External Entity
1936| [75689] Apache Camel up to 2.13.3/2.14.1 XML Converter Setup XmlConverter.java SAXSource privilege escalation
1937| [75668] Apache Sling API/Sling Servlets Post up to 2.2.1 HtmlResponse cross site scripting
1938| [75601] Apache Jackrabbit up to 2.10.0 WebDAV Request XML External Entity
1939| [75420] Apache Tomcat up to 6.0.43/7.0.58/8.0.16 Security Manager privilege escalation
1940| [75145] Apache OpenOffice up to 4.1.1 HWP Filter Crash denial of service
1941| [75032] Apache Tomcat Connectors up to 1.2.40 mod_jk privilege escalation
1942| [75135] PHP 5.4/5.5 HTTP Request sapi_apache2.c apache2handler privilege escalation
1943| [74793] Apache Tomcat File Upload denial of service
1944| [74708] Apple MacOS X up to 10.10.2 Apache denial of service
1945| [74707] Apple MacOS X up to 10.10.2 Apache denial of service
1946| [74706] Apple MacOS X up to 10.10.2 Apache memory corruption
1947| [74705] Apple MacOS X up to 10.10.2 Apache denial of service
1948| [74704] Apple MacOS X up to 10.10.2 Apache denial of service
1949| [74703] Apple MacOS X up to 10.10.2 Apache denial of service
1950| [74702] Apple MacOS X up to 10.10.2 Apache denial of service
1951| [74701] Apple MacOS X up to 10.10.2 Apache cross site request forgery
1952| [74700] Apple MacOS X up to 10.10.2 Apache unknown vulnerability
1953| [74661] Apache Flex up to 4.14.0 asdoc index.html cross site scripting
1954| [74609] Apache Cassandra up to 1.2.19/2.0.13/2.1.3 JMX/RMI Interface privilege escalation
1955| [74469] Apache Xerces-C up to 7.0 internal/XMLReader.cpp denial of service
1956| [74468] Apache Batik up to 1.6 denial of service
1957| [74414] Apache Mod-gnutls up to 0.5.1 Authentication spoofing
1958| [74371] Apache Standard Taglibs up to 1.2.0 memory corruption
1959| [74367] Apache HTTP Server up to 2.4.12 mod_lua lua_request.c wsupgrade denial of service
1960| [74174] Apache WSS4J up to 2.0.0 privilege escalation
1961| [74172] Apache ActiveMQ up to 5.5.0 Administration Console cross site scripting
1962| [69092] Apache Tomcat up to 6.0.42/7.0.54/8.0.8 HTTP Request Smuggling privilege escalation
1963| [73831] Apache Qpid up to 0.30 Access Restriction unknown vulnerability
1964| [73731] Apache XML Security unknown vulnerability
1965| [68660] Oracle BI Publisher 10.1.3.4.2/11.1.1.7 Apache Tomcat cross site scripting
1966| [73659] Apache CloudStack up to 4.3.0 Stack-Based unknown vulnerability
1967| [73593] Apache Traffic Server up to 5.1.0 denial of service
1968| [73511] Apache POI up to 3.10 Deadlock denial of service
1969| [73510] Apache Solr up to 4.3.0 cross site scripting
1970| [68447] Apache Subversion up to 1.7.18/1.8.10 mod_dav_svn Crash denial of service
1971| [68446] Apache Subversion up to 1.7.18/1.8.10 REPORT Request Crash denial of service
1972| [73173] Apache CloudStack Stack-Based unknown vulnerability
1973| [68357] Apache Struts up to 2.3.16.3 Random Number Generator cross site request forgery
1974| [73106] Apache Hadoop up to 2.4.0 Symlink privilege escalation
1975| [68575] Apache HTTP Server up to 2.4.10 LuaAuthzProvider mod_lua.c privilege escalation
1976| [72890] Apache Qpid 0.30 unknown vulnerability
1977| [72887] Apache Hive 0.13.0 File Permission privilege escalation
1978| [72878] Apache Cordova 3.5.0 cross site request forgery
1979| [72877] Apache Cordova 3.5.0 cross site request forgery
1980| [72876] Apache Cordova 3.5.0 cross site request forgery
1981| [68435] Apache HTTP Server 2.4.10 mod_proxy_fcgi.c handle_headers denial of service
1982| [68065] Apache CXF up to 3.0.1 JAX-RS SAML denial of service
1983| [68064] Apache CXF up to 3.0.0 SAML Token denial of service
1984| [67913] Oracle Retail Markdown Optimization 12.0/13.0/13.1/13.2/13.4 Apache commons-beanutils-1.8.0.jar memory corruption
1985| [67912] Oracle Retail Invoice Matching up to 14.0 Apache commons-beanutils-1.8.0.jar memory corruption
1986| [67911] Oracle Retail Clearance Optimization Engine 13.3/13.4/14.0 Apache commons-beanutils-1.8.0.jar memory corruption
1987| [67910] Oracle Retail Allocation up to 13.2 Apache commons-beanutils-1.8.0.jar memory corruption
1988| [71835] Apache Shiro 1.0.0/1.1.0/1.2.0/1.2.1/1.2.2 unknown vulnerability
1989| [71633] Apachefriends XAMPP 1.8.1 cross site scripting
1990| [71629] Apache Axis2/C spoofing
1991| [67633] Apple Mac OS X up to 10.9.4 apache_mod_php ext/standard/dns.c dns_get_record memory corruption
1992| [67631] Apple Mac OS X up to 10.9.4 apache_mod_php Symlink memory corruption
1993| [67630] Apple Mac OS X up to 10.9.4 apache_mod_php cdf_read_property_info denial of service
1994| [67629] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_count_chain denial of service
1995| [67628] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_check_stream_offset denial of service
1996| [67627] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c mconvert memory corruption
1997| [67626] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c denial of service
1998| [67625] Apple Mac OS X up to 10.9.4 apache_mod_php Crash denial of service
1999| [67624] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_property_info denial of service
2000| [67623] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_unpack_summary_info denial of service
2001| [67622] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_short_sector denial of service
2002| [67620] Apple Mac OS X up to 10.9.4 apache_mod_php magic/Magdir/commands denial of service
2003| [67790] Apache HTTP Server mod_cache NULL Pointer Dereference denial of service
2004| [67522] Apache Tomcat up to 7.0.39 JSP Upload privilege escalation
2005| [70809] Apache POI up to 3.11 Crash denial of service
2006| [70808] Apache POI up to 3.10 unknown vulnerability
2007| [70806] Apache Commons-httpclient 4.2/4.2.1/4.2.2 spoofing
2008| [70749] Apache Axis up to 1.4 getCN spoofing
2009| [70701] Apache Traffic Server up to 3.3.5 denial of service
2010| [70700] Apache OFBiz up to 12.04.03 cross site scripting
2011| [67402] Apache OpenOffice 4.0.0/4.0.1/4.1.0 Calc privilege escalation
2012| [67401] Apache OpenOffice up to 4.1.0 OLE Object information disclosure
2013| [70661] Apache Subversion up to 1.6.17 denial of service
2014| [70660] Apache Subversion up to 1.6.17 spoofing
2015| [70659] Apache Subversion up to 1.6.17 spoofing
2016| [67183] Apache HTTP Server up to 2.4.9 mod_proxy denial of service
2017| [67180] Apache HTTP Server up to 2.4.9 WinNT MPM Memory Leak denial of service
2018| [67185] Apache HTTP Server up to 2.4.9 mod_status Heap-Based memory corruption
2019| [67184] Apache HTTP Server 2.4.5/2.4.6 mod_cache NULL Pointer Dereference denial of service
2020| [67182] Apache HTTP Server up to 2.4.9 mod_deflate Memory Consumption denial of service
2021| [67181] Apache HTTP Server up to 2.4.9 mod_cgid denial of service
2022| [70338] Apache Syncope up to 1.1.7 unknown vulnerability
2023| [70295] Apache CXF up to 2.7.9 Cleartext information disclosure
2024| [70106] Apache Open For Business Project up to 10.04.0 getServerError cross site scripting
2025| [70105] Apache MyFaces up to 2.1.5 JavaServer Faces directory traversal
2026| [69846] Apache HBase up to 0.94.8 information disclosure
2027| [69783] Apache CouchDB up to 1.2.0 memory corruption
2028| [13383] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 XML Parser privilege escalation
2029| [13300] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi setuid() privilege escalation
2030| [13299] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi Content-Type Header information disclosure
2031| [13164] Apache CXF up to 2.6.13/2.7.10 SOAP OutgoingChainInterceptor.java Invalid Content denial of service
2032| [13163] Apache CXF up to 2.6.13/2.7.10 SOAP HTML Content denial of service
2033| [13158] Apache Struts up to 2.3.16.2 ParametersInterceptor getClass privilege escalation
2034| [69515] Apache Struts up to 2.3.15.0 CookieInterceptor memory corruption
2035| [13086] Apache Struts up to 1.3.10 Class Loader privilege escalation
2036| [13067] Apache Struts up to 2.3.16.1 Class Loader privilege escalation
2037| [69431] Apache Archiva up to 1.3.6 cross site scripting
2038| [69385] Apache Syncope up to 1.1.6 unknown vulnerability
2039| [69338] Apache Xalan-Java up to 2.7.1 system-property unknown vulnerability
2040| [12742] Trustwave ModSecurity up to 2.7.5 Chunk Extension apache2/modsecurity.c modsecurity_tx_init() privilege escalation
2041| [12741] Trustwave ModSecurity up to 2.7.6 Chunked HTTP Transfer apache2/modsecurity.c modsecurity_tx_init Trailing Header privilege escalation
2042| [13387] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Content-Length Header privilege escalation
2043| [13386] Apache Tomcat Security Manager up to 6.0.39/7.0.53/8.0.5 XSLT privilege escalation
2044| [13385] Apache Tomcat 8.0.0/8.0.1/8.0.3 AJP Request Zero Length denial of service
2045| [13384] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Chunked HTTP Request denial of service
2046| [12748] Apache CouchDB 1.5.0 UUIDS /_uuids denial of service
2047| [66739] Apache Camel up to 2.12.2 unknown vulnerability
2048| [66738] Apache Camel up to 2.12.2 unknown vulnerability
2049| [12667] Apache HTTP Server 2.4.7 mod_log_config.c log_cookie denial of service
2050| [66695] Apache CouchDB up to 1.2.0 cross site scripting
2051| [66694] Apache CouchDB up to 1.2.0 Partition partition2 directory traversal
2052| [66689] Apache HTTP Server up to 2.0.33 mod_dav dav_xml_get_cdata denial of service
2053| [12518] Apache Tomcat up to 6.0.38/7.0.49/8.0.0-RC9 HTTP Header denial of service
2054| [66498] Apache expressions up to 3.3.0 Whitelist unknown vulnerability
2055| [12781] Apache Struts up to 2.3.8 ParametersInterceptor getClass denial of service
2056| [12439] Apache Tomcat 6.0.33 XML XXE information disclosure
2057| [12438] Apache Tomcat 6.0.33/6.0.34/6.0.35/6.0.36/6.0.37 coyoteadapter.java disableURLRewriting privilege escalation
2058| [66356] Apache Wicket up to 6.8.0 information disclosure
2059| [12209] Apache Tomcat 8.0.0-RC1/8.0.1/7.0.0/7.0.50 Content-Type Header for Multi-Part Request Infinite Loop denial of service
2060| [66322] Apache ActiveMQ up to 5.8.0 cross site scripting
2061| [12291] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
2062| [66255] Apache Open For Business Project up to 10.04.3 cross site scripting
2063| [66200] Apache Hadoop up to 2.0.5 Security Feature information disclosure
2064| [66072] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
2065| [66068] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
2066| [11928] Oracle Secure Global Desktop up to 4.71 Apache Tomcat unknown vulnerability
2067| [11924] Oracle Secure Global Desktop up to 4.63 Apache Tomcat denial of service
2068| [11922] Oracle Secure Global Desktop up to 4.63 Apache Tomcat unknown vulnerability
2069| [66049] Apache XML Security for Java up to 1.4.6 Memory Consumption denial of service
2070| [12199] Apache Subversion up to 1.8.5 mod_dav_svn/repos.c get_resource denial of service
2071| [65946] askapache Firefox Adsense up to 3.0 askapache-firefox-adsense.php cross site request forgery
2072| [65668] Apache Solr 4.0.0 Updater denial of service
2073| [65665] Apache Solr up to 4.3.0 denial of service
2074| [65664] Apache Solr 3.6.0/3.6.1/3.6.2/4.0.0 Updater denial of service
2075| [65663] Apache Solr up to 4.5.1 ResourceLoader directory traversal
2076| [65658] Apache roller 4.0/4.0.1/5.0/5.0.1 unknown vulnerability
2077| [65657] Apache Roller 4.0/4.0.1/5.0/5.0.1 cross site scripting
2078| [11325] Apache Subversion 1.7.13 mod_dontdothat Bypass denial of service
2079| [11324] Apache Subversion up to 1.8.4 mod_dav_svn denial of service
2080| [11098] Apache Tomcat 5.5.25 HTTP Request cross site request forgery
2081| [65410] Apache Struts 2.3.15.3 cross site scripting
2082| [65386] Apache Solr up to 2.2.1 on TYPO3 cross site scripting
2083| [65385] Apache Solr up to 2.2.1 on TYPO3 unknown vulnerability
2084| [11044] Apache Struts 2.3.15.3 showConfig.action cross site scripting
2085| [11043] Apache Struts 2.3.15.3 actionNames.action cross site scripting
2086| [11018] cPanel WHM up to 11.40.0.11 Apache mod_userdir Tweak Interface privilege escalation
2087| [65342] Apache Sling 1.0.2/1.0.4/1.0.6/1.1.0/1.1.2 Auth Core cross site scripting
2088| [65340] Apache Shindig 2.5.0 information disclosure
2089| [65316] Apache Mod Fcgid up to 2.3.7 mod_fcgid fcgid_bucket.c fcgid_header_bucket_read memory corruption
2090| [65313] Apache Sling 2.2.0/2.3.0 AbstractCreateOperation.java deepGetOrCreateNode denial of service
2091| [10826] Apache Struts 2 File privilege escalation
2092| [65204] Apache Camel up to 2.10.1 unknown vulnerability
2093| [10460] Apache Struts 2.0.0/2.3.15.1 Action Mapping Mechanism Bypass privilege escalation
2094| [10459] Apache Struts 2.0.0/2.3.15 Dynamic Method Invocation unknown vulnerability
2095| [10160] Apache Subversion 1.8.0/1.8.1/1.8.2 svnwcsub.py handle_options race condition
2096| [10159] Apache Subversion up to 1.8.2 svnserve write_pid_file() race condition
2097| [10158] Apache Subversion 1.8.0/1.8.1/1.8.2 daemonize.py daemon::daemonize race condition
2098| [10157] Apache Subversion up to 1.8.1 FSFS Repository Symlink privilege escalation
2099| [64808] Fail2ban up to 0.8.9 apache-auth.conf denial of service
2100| [64760] Best Practical RT up to 4.0.12 Apache::Session::File information disclosure
2101| [64722] Apache XML Security for C++ Heap-based memory corruption
2102| [64719] Apache XML Security for C++ Heap-based memory corruption
2103| [64718] Apache XML Security for C++ verify denial of service
2104| [64717] Apache XML Security for C++ getURIBaseTXFM memory corruption
2105| [64716] Apache XML Security for C++ spoofing
2106| [64701] Apache CXF up to 2.7.3 XML Parser Memory Consumption denial of service
2107| [64700] Apache CloudStack up to 4.1.0 Stack-Based cross site scripting
2108| [64667] Apache Open For Business Project up to 10.04.04 unknown vulnerability
2109| [64666] Apache Open For Business Project up to 10.04.04 cross site scripting
2110| [9891] Apache HTTP Server 2.2.22 suEXEC Feature .htaccess information disclosure
2111| [64509] Apache ActiveMQ up to 5.8.0 scheduled.jsp cross site scripting
2112| [9826] Apache Subversion up to 1.8.0 mod_dav_svn denial of service
2113| [9683] Apache HTTP Server 2.4.5 mod_session_dbd denial of service
2114| [64485] Apache Struts up to 2.2.3.0 privilege escalation
2115| [9568] Apache Struts up to 2.3.15 DefaultActionMapper cross site request forgery
2116| [9567] Apache Struts up to 2.3.15 DefaultActionMapper memory corruption
2117| [64467] Apache Geronimo 3.0 memory corruption
2118| [64466] Apache OpenJPA up to 2.2.1 Serialization memory corruption
2119| [64457] Apache Struts up to 2.2.3.0 cross site scripting
2120| [64326] Alejandro Garza Apachesolr Autocomplete up to 7.x-1.1 cross site scripting
2121| [9184] Apache Qpid up to 0.20 SSL misconfiguration
2122| [8935] Apache Subversion up to 1.7.9 FSFS Format Repository denial of service
2123| [8934] Apache Subversion up to 1.7.9 Svnserve Server denial of service
2124| [8933] Apache Subversion up to 1.6.21 check-mime-type.pl svnlook memory corruption
2125| [8932] Apache Subversion up to 1.6.21 svn-keyword-check.pl svnlook changed memory corruption
2126| [9022] Apache Struts up to 2.3.14.2 OGNL Expression memory corruption
2127| [8873] Apache Struts 2.3.14 privilege escalation
2128| [8872] Apache Struts 2.3.14 privilege escalation
2129| [8746] Apache HTTP Server Log File Terminal Escape Sequence Filtering mod_rewrite.c do_rewritelog privilege escalation
2130| [8666] Apache Tomcat up to 7.0.32 AsyncListener information disclosure
2131| [8665] Apache Tomcat up to 7.0.29 Chunked Transfer Encoding Extension Size denial of service
2132| [8664] Apache Tomcat up to 7.0.32 FORM Authentication weak authentication
2133| [64075] Apache Subversion up to 1.7.7 mod_dav_svn Crash denial of service
2134| [64074] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
2135| [64073] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
2136| [64072] Apache Subversion up to 1.7.7 mod_dav_svn NULL Pointer Dereference denial of service
2137| [64071] Apache Subversion up to 1.7.8 mod_dav_svn Memory Consumption denial of service
2138| [8768] Apache Struts up to 2.3.14 on Mac EL and OGNL Interpreter memory corruption
2139| [64006] Apache ActiveMQ up to 5.7.0 denial of service
2140| [64005] Apache ActiveMQ up to 5.7.0 Default Configuration denial of service
2141| [64004] Apache ActiveMQ up to 5.7.0 PortfolioPublishServlet.java cross site scripting
2142| [8427] Apache Tomcat Session Transaction weak authentication
2143| [63960] Apache Maven 3.0.4 Default Configuration spoofing
2144| [63751] Apache qpid up to 0.20 qpid::framing::Buffer denial of service
2145| [63750] Apache qpid up to 0.20 checkAvailable denial of service
2146| [63749] Apache Qpid up to 0.20 Memory Consumption denial of service
2147| [63748] Apache Qpid up to 0.20 Default Configuration denial of service
2148| [63747] Apache Rave up to 0.20 User Account information disclosure
2149| [7889] Apache Subversion up to 1.6.17 mod_dav_svn/svn_fs_file_length() denial of service
2150| [63646] Apache HTTP Server up to 2.2.23/2.4.3 mod_proxy_balancer.c balancer_handler cross site scripting
2151| [7688] Apache CXF up to 2.7.1 WSS4JInterceptor Bypass weak authentication
2152| [7687] Apache CXF up to 2.7.2 Token weak authentication
2153| [63334] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
2154| [63299] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
2155| [7202] Apache HTTP Server 2.4.2 on Oracle Solaris ld_library_path cross site scripting
2156| [7075] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector NioEndpoint.java denial of service
2157| [7074] Apache Tomcat up to 6.0.35/7.0.29 FORM Authentication RealmBase.java weak authentication
2158| [7073] Apache Tomcat up to 6.0.35/7.0.31 CSRF Prevention Filter cross site request forgery
2159| [63090] Apache Tomcat up to 4.1.24 denial of service
2160| [63089] Apache HTTP Server up to 2.2.13 mod_proxy_ajp denial of service
2161| [62933] Apache Tomcat up to 5.5.0 Access Restriction unknown vulnerability
2162| [62929] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector Memory Consumption denial of service
2163| [62833] Apache CXF -/2.6.0 spoofing
2164| [62832] Apache Axis2 up to 1.6.2 spoofing
2165| [62831] Apache Axis up to 1.4 Java Message Service spoofing
2166| [62830] Apache Commons-httpclient 3.0 Payments spoofing
2167| [62826] Apache Libcloud up to 0.11.0 spoofing
2168| [62757] Apache Open For Business Project up to 10.04.0 unknown vulnerability
2169| [8830] Red Hat JBoss Enterprise Application Platform 6.0.1 org.apache.catalina.connector.Response.encodeURL information disclosure
2170| [62661] Apache Axis2 unknown vulnerability
2171| [62658] Apache Axis2 unknown vulnerability
2172| [62467] Apache Qpid up to 0.17 denial of service
2173| [62417] Apache CXF 2.4.7/2.4.8/2.5.3/2.5.4/2.6.1 spoofing
2174| [6301] Apache HTTP Server mod_pagespeed cross site scripting
2175| [6300] Apache HTTP Server mod_pagespeed Hostname information disclosure
2176| [6123] Apache Wicket up to 1.5.7 Ajax Link cross site scripting
2177| [62035] Apache Struts up to 2.3.4 denial of service
2178| [61916] Apache QPID 0.14/0.16/0.5/0.6 unknown vulnerability
2179| [6998] Apache Tomcat 5.5.35/6.0.35/7.0.28 DIGEST Authentication Session State Caching privilege escalation
2180| [6997] Apache Tomcat 5.5.35/6.0.35/7.0.28 HTTP Digest Authentication Implementation privilege escalation
2181| [6092] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_ajp.c information disclosure
2182| [6090] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_http.c information disclosure
2183| [61507] Apache POI up to 3.8 UnhandledDataStructure denial of service
2184| [6070] Apache Struts up to 2.3.4 Token Name Configuration Parameter privilege escalation
2185| [6069] Apache Struts up to 2.3.4 Request Parameter OGNL Expression denial of service
2186| [5764] Oracle Solaris 10 Apache HTTP Server information disclosure
2187| [5700] Oracle Secure Backup 10.3.0.3/10.4.0.1 Apache denial of service
2188| [61255] Apache Hadoop 2.0.0 Kerberos unknown vulnerability
2189| [61229] Apache Sling up to 2.1.1 denial of service
2190| [61152] Apache Commons-compress 1.0/1.1/1.2/1.3/1.4 denial of service
2191| [61094] Apache Roller up to 5.0 cross site scripting
2192| [61093] Apache Roller up to 5.0 cross site request forgery
2193| [61005] Apache OpenOffice 3.3/3.4 unknown vulnerability
2194| [9673] Apache HTTP Server up to 2.4.4 mod_dav mod_dav.c Request denial of service
2195| [5436] Apache OpenOffice 3.3/3.4 WPXContentListener.cpp _closeTableRow() File memory corruption
2196| [5435] Apache OpenOffice 3.3/3.4 vclmi.dll File memory corruption
2197| [60730] PHP 5.4.0/5.4.1/5.4.2 apache_request_headers memory corruption
2198| [60708] Apache Qpid 0.12 unknown vulnerability
2199| [5032] Apache Hadoop up to 0.20.205.0/1.0.1/0.23.1 Kerberos/MapReduce Security Feature privilege escalation
2200| [4949] Apache Struts File Upload XSLTResult.java XSLT File privilege escalation
2201| [4955] Apache Traffic Server 3.0.3/3.1.2 HTTP Header Parser memory corruption
2202| [4882] Apache Wicket up to 1.5.4 directory traversal
2203| [4881] Apache Wicket up to 1.4.19 cross site scripting
2204| [4884] Apache HTTP Server up to 2.3.6 mod_fcgid fcgid_spawn_ctl.c FcgidMaxProcessesPerClass HTTP Requests denial of service
2205| [60352] Apache Struts up to 2.2.3 memory corruption
2206| [60153] Apache Portable Runtime up to 1.4.3 denial of service
2207| [4598] Apache Struts 1.3.10 upload-submit.do cross site scripting
2208| [4597] Apache Struts 1.3.10 processSimple.do cross site scripting
2209| [4596] Apache Struts 2.0.14/2.2.3 struts2-rest-showcase/orders cross site scripting
2210| [4595] Apache Struts 2.0.14/2.2.3 struts2-showcase/person/editPerson.action cross site scripting
2211| [4583] Apache HTTP Server up to 2.2.21 Threaded MPM denial of service
2212| [4582] Apache HTTP Server up to 2.2.21 protocol.c information disclosure
2213| [4571] Apache Struts up to 2.3.1.2 privilege escalation
2214| [4557] Apache Tomcat up to 7.0.21 Caching/Recycling information disclosure
2215| [59934] Apache Tomcat up to 6.0.9 DigestAuthenticator.java unknown vulnerability
2216| [59933] Apache Tomcat up to 6.0.9 Access Restriction unknown vulnerability
2217| [59932] Apache Tomcat up to 6.0.9 unknown vulnerability
2218| [59931] Apache Tomcat up to 6.0.9 Access Restriction information disclosure
2219| [59902] Apache Struts up to 2.2.3 Interfaces unknown vulnerability
2220| [4528] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
2221| [4527] Apache Struts up to 2.2.3 ExceptionDelegator cross site scripting
2222| [59888] Apache Tomcat up to 6.0.6 denial of service
2223| [59886] Apache ActiveMQ up to 5.5.1 Crash denial of service
2224| [4513] Apache Struts up to 2.3.1 ParameterInterceptor directory traversal
2225| [4512] Apache Struts up to 2.2.3 CookieInterceptor command injection
2226| [59850] Apache Geronimo up to 2.2.1 denial of service
2227| [59825] Apache HTTP Server up to 2.1.7 mod_reqtimeout denial of service
2228| [59556] Apache HTTP Server up to 2.0.53 mod_proxy information disclosure
2229| [58467] Apache libcloud 0.2.0/0.3.0/0.3.1/0.4.0 Access Restriction spoofing
2230| [58413] Apache Tomcat up to 6.0.10 spoofing
2231| [58381] Apache Wicket up to 1.4.17 cross site scripting
2232| [58296] Apache Tomcat up to 7.0.19 unknown vulnerability
2233| [57888] Apache HttpClient 4.0/4.0.1/4.1 Authorization information disclosure
2234| [57587] Apache Subversion up to 1.6.16 mod_dav_svn information disclosure
2235| [57585] Apache Subversion up to 1.6.16 mod_dav_svn Memory Consumption denial of service
2236| [57584] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
2237| [57577] Apache Rampart-C 1.3.0 Access Restriction rampart_timestamp_token_validate privilege escalation
2238| [57568] Apache Archiva up to 1.3.4 cross site scripting
2239| [57567] Apache Archiva up to 1.3.4 cross site request forgery
2240| [57481] Apache Tomcat 7.0.12/7.0.13 Access Restriction unknown vulnerability
2241| [4355] Apache HTTP Server APR apr_fnmatch denial of service
2242| [57435] Apache Struts up to 2.2.1.1 FileHandler.java cross site scripting
2243| [57425] Apache Struts up to 2.2.1.1 cross site scripting
2244| [4352] Apache HTTP Server 2.2.x APR apr_fnmatch denial of service
2245| [57025] Apache Tomcat up to 7.0.11 information disclosure
2246| [57024] Apache Tomcat 7.0.11 Access Restriction information disclosure
2247| [56774] IBM WebSphere Application Server up to 7.0.0.14 org.apache.jasper.runtime.JspWriterImpl.response denial of service
2248| [56824] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
2249| [56832] Apache Tomcat up to 7.0.10 Access Restriction information disclosure
2250| [56830] Apache Tomcat up to 7.0.9 Access Restriction privilege escalation
2251| [12440] Apache Tomcat 6.0.33 Malicious Request cross site scripting
2252| [56512] Apache Continuum up to 1.4.0 cross site scripting
2253| [4285] Apache Tomcat 5.x JVM getLocale() denial of service
2254| [4284] Apache Tomcat 5.x HTML Manager cross site scripting
2255| [4283] Apache Tomcat 5.x ServletContect privilege escalation
2256| [56441] Apache Tomcat up to 7.0.6 denial of service
2257| [56300] Apache CouchDB up to 1.0.1 Web Administration Interface cross site scripting
2258| [55967] Apache Subversion up to 1.6.4 rev_hunt.c denial of service
2259| [55966] Apache Subversion up to 1.6.4 mod_dav_svn repos.c walk denial of service
2260| [55095] Apache Axis2 up to 1.6 Default Password memory corruption
2261| [55631] Apache Archiva up to 1.3.1 User Account cross site request forgery
2262| [55556] Apache Tomcat up to 6.0.29 Default Configuration information disclosure
2263| [55553] Apache Tomcat up to 7.0.4 sessionsList.jsp cross site scripting
2264| [55162] Apache MyFaces up to 2.0.0 Authentication Code unknown vulnerability
2265| [54881] Apache Subversion up to 1.6.12 mod_dav_svn authz.c privilege escalation
2266| [54879] Apache APR-util up to 0.9.14 mod_reqtimeout apr_brigade_split_line denial of service
2267| [54693] Apache Traffic Server DNS Cache unknown vulnerability
2268| [54416] Apache CouchDB up to 0.11.0 cross site request forgery
2269| [54394] Apache CXF up to 2.2.8 Memory Consumption denial of service
2270| [54261] Apache Tomcat jsp/cal/cal2.jsp cross site scripting
2271| [54166] Apache HTTP Server up to 2.2.12 mod_cache Crash denial of service
2272| [54385] Apache Struts up to 2.1.8.1 ParameterInterceptor unknown vulnerability
2273| [54012] Apache Tomcat up to 6.0.10 denial of service
2274| [53763] Apache Axis2 1.3/1.4/1.4.1/1.5/1.5.1 Memory Consumption denial of service
2275| [53368] Apache MyFaces 1.1.7/1.2.8 cross site scripting
2276| [53397] Apache axis2 1.4.1/1.5.1 Administration Console cross site scripting
2277| [52894] Apache Tomcat up to 6.0.7 information disclosure
2278| [52960] Apache ActiveMQ up to 5.4-snapshot information disclosure
2279| [52843] Apache HTTP Server mod_auth_shadow unknown vulnerability
2280| [52786] Apache Open For Business Project up to 09.04 cross site scripting
2281| [52587] Apache ActiveMQ up to 5.3.0 cross site request forgery
2282| [52586] Apache ActiveMQ up to 5.3.0 cross site scripting
2283| [52584] Apache CouchDB up to 0.10.1 information disclosure
2284| [51757] Apache HTTP Server 2.0.44 cross site scripting
2285| [51756] Apache HTTP Server 2.0.44 spoofing
2286| [51717] Apache HTTP Server up to 1.3.3 mod_proxy ap_proxy_send_fb memory corruption
2287| [51690] Apache Tomcat up to 6.0 directory traversal
2288| [51689] Apache Tomcat up to 6.0 information disclosure
2289| [51688] Apache Tomcat up to 6.0 directory traversal
2290| [50886] HP Operations Manager 8.10 on Windows File Upload org.apache.catalina.manager.HTMLManagerServlet memory corruption
2291| [50802] Apache Tomcat up to 3.3 Default Password weak authentication
2292| [50626] Apache Solr 1.0.0 cross site scripting
2293| [49857] Apache HTTP Server mod_proxy_ftp cross site scripting
2294| [49856] Apache HTTP Server 2.2.13 mod_proxy_ftp ap_proxy_ftp_handler denial of service
2295| [49348] Apache Xerces-C++ 2.7.0 Stack-Based denial of service
2296| [86789] Apache Portable Runtime memory/unix/apr_pools.c unknown vulnerability
2297| [49283] Apache APR-util up to 1.3.8 apr-util misc/apr_rmm.c apr_rmm_realloc memory corruption
2298| [48952] Apache HTTP Server up to 1.3.6 mod_deflate denial of service
2299| [48626] Apache Tomcat up to 4.1.23 Access Restriction directory traversal
2300| [48431] Apache Tomcat up to 4.1.23 j_security_check cross site scripting
2301| [48430] Apache Tomcat up to 4.1.23 mod_jk denial of service
2302| [47801] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site request forgery
2303| [47800] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site scripting
2304| [47799] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console directory traversal
2305| [47648] Apache Tiles 2.1.0/2.1.1 cross site scripting
2306| [47640] Apache Struts 2.0.11/2.0.6/2.0.8/2.0.9/2.1 cross site scripting
2307| [47638] Apache Tomcat up to 4.1.23 mod_jk information disclosure
2308| [47636] Apache Struts 2.0.9 xip_client.html cross site scripting
2309| [47593] Apache Mod Perl 1 perl-status Apache::Status cross site scripting
2310| [47637] Apache Struts 1.0.2/1.1/1.2.4/1.2.7/1.2.8 cross site scripting
2311| [47239] Apache Struts up to 2.1.2 Beta struts directory traversal
2312| [47214] Apachefriends xampp 1.6.8 spoofing
2313| [47213] Apachefriends xampp 1.6.8 htaccess cross site request forgery
2314| [47162] Apachefriends XAMPP 1.4.4 weak authentication
2315| [47065] Apache Tomcat 4.1.23 cross site scripting
2316| [46834] Apache Tomcat up to 5.5.20 cross site scripting
2317| [46004] Apache Jackrabbit 1.4/1.5.0 search.jsp cross site scripting
2318| [49205] Apache Roller 2.3/3.0/3.1/4.0 Search cross site scripting
2319| [86625] Apache Struts directory traversal
2320| [44461] Apache Tomcat up to 5.5.0 information disclosure
2321| [44389] Apache Xerces-C++ XML Parser Memory Consumption denial of service
2322| [44352] Apache Friends XAMPP 1.6.8 adodb.php cross site scripting
2323| [43663] Apache Tomcat up to 6.0.16 directory traversal
2324| [43612] Apache Friends XAMPP 1.6.7 iart.php cross site scripting
2325| [43556] Apache HTTP Server up to 2.1.8 mod_proxy_ftp proxy_ftp.c cross site scripting
2326| [43516] Apache Tomcat up to 4.1.20 directory traversal
2327| [43509] Apache Tomcat up to 6.0.13 cross site scripting
2328| [42637] Apache Tomcat up to 6.0.16 cross site scripting
2329| [42325] Apache HTTP Server up to 2.1.8 Error Page cross site scripting
2330| [41838] Apache-SSL 1.3.34 1.57 expandcert privilege escalation
2331| [41091] Apache Software Foundation Mod Jk up to 2.0.1 mod_jk2 Stack-based memory corruption
2332| [40924] Apache Tomcat up to 6.0.15 information disclosure
2333| [40923] Apache Tomcat up to 6.0.15 unknown vulnerability
2334| [40922] Apache Tomcat up to 6.0 information disclosure
2335| [40710] Apache HTTP Server up to 2.0.61 mod_negotiation cross site scripting
2336| [40709] Apache HTTP Server up to 2.0.53 mod_negotiation cross site scripting
2337| [40656] Apache Tomcat 5.5.20 information disclosure
2338| [40503] Apache HTTP Server mod_proxy_ftp cross site scripting
2339| [40502] Apache HTTP Server up to 2.2.5 mod_proxy_balancer memory corruption
2340| [40501] Apache HTTP Server 2.2.6 mod_proxy_balancer cross site request forgery
2341| [40398] Apache HTTP Server up to 2.2 mod_proxy_balancer cross site scripting
2342| [40397] Apache HTTP Server up to 2.2 mod_proxy_balancer balancer_handler denial of service
2343| [40234] Apache Tomcat up to 6.0.15 directory traversal
2344| [40221] Apache HTTP Server 2.2.6 information disclosure
2345| [40027] David Castro Apache Authcas 0.4 sql injection
2346| [3495] Apache OpenOffice up to 2.3 Database Document Processor Designfehler
2347| [3489] Apache HTTP Server 2.x HTTP Header cross site scripting
2348| [3414] Apache Tomcat WebDAV Stored Umgehungs-Angriff
2349| [39489] Apache Jakarta Slide up to 2.1 directory traversal
2350| [39540] Apache Geronimo 2.0/2.0.1/2.0.2/2.1 unknown vulnerability
2351| [3310] Apache OpenOffice 1.1.3/2.0.4/2.2.1 TIFF Image Parser Heap-based memory corruption
2352| [38768] Apache HTTP Server up to 2.1.7 mod_autoindex.c cross site scripting
2353| [38952] Apache Geronimo 2.0.1/2.1 unknown vulnerability
2354| [38658] Apache Tomcat 4.1.31 cal2.jsp cross site request forgery
2355| [38524] Apache Geronimo 2.0 unknown vulnerability
2356| [3256] Apache Tomcat up to 6.0.13 cross site scripting
2357| [38331] Apache Tomcat 4.1.24 information disclosure
2358| [38330] Apache Tomcat 4.1.24 information disclosure
2359| [38185] Apache Tomcat 3.3/3.3.1/3.3.1a/3.3.2 Error Message CookieExample cross site scripting
2360| [37967] Apache Tomcat up to 4.1.36 Error Message sendmail.jsp cross site scripting
2361| [37647] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 Authorization unknown vulnerability
2362| [37646] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 unknown vulnerability
2363| [3141] Apache Tomcat up to 4.1.31 Accept-Language Header cross site scripting
2364| [3133] Apache Tomcat up to 6.0 HTTP cross site scripting
2365| [37292] Apache Tomcat up to 5.5.1 cross site scripting
2366| [3130] Apache OpenOffice 2.2.1 RTF Document Heap-based memory corruption
2367| [36981] Apache Tomcat JK Web Server Connector up to 1.2.22 mod_jk directory traversal
2368| [36892] Apache Tomcat up to 4.0.0 hello.jsp cross site scripting
2369| [37320] Apache MyFaces Tomahawk up to 1.1.4 cross site scripting
2370| [36697] Apache Tomcat up to 5.5.17 implicit-objects.jsp cross site scripting
2371| [36491] Apache Axis 1.0 Installation javaioFileNotFoundException information disclosure
2372| [36400] Apache Tomcat 5.5.15 mod_jk cross site scripting
2373| [36698] Apache Tomcat up to 4.0.0 cal2.jsp cross site scripting
2374| [36224] XAMPP Apache Distribution up to 1.6.0a adodb.php connect memory corruption
2375| [36225] XAMPP Apache Distribution 1.6.0a sql injection
2376| [2997] Apache httpd/Tomcat 5.5/6.0 directory traversal
2377| [35896] Apache Apache Test up to 1.29 mod_perl denial of service
2378| [35653] Avaya S8300 Cm 3.1.2 Apache Tomcat unknown vulnerability
2379| [35402] Apache Tomcat JK Web Server Connector 1.2.19 mod_jk.so map_uri_to_worker memory corruption
2380| [35067] Apache Stats up to 0.0.2 extract unknown vulnerability
2381| [35025] Apache Stats up to 0.0.3 extract unknown vulnerability
2382| [34252] Apache HTTP Server denial of service
2383| [2795] Apache OpenOffice 2.0.4 WMF/EMF File Heap-based memory corruption
2384| [33877] Apache Opentaps 0.9.3 cross site scripting
2385| [33876] Apache Open For Business Project unknown vulnerability
2386| [33875] Apache Open For Business Project cross site scripting
2387| [2703] Apache Jakarta Tomcat up to 5.x der_get_oid() memory corruption
2388| [2611] Apache HTTP Server up to 1.0.1 set_var Format String
2389| [31827] XMB Extreme Message Board up to 1.9.6 Apache HTTP Server memcp.php directory traversal
2390| [2452] Apache HTTP Server up to 2.2.3 on Windows mod_alias unknown vulnerability
2391| [31663] vbPortal Apache HTTP Server index.php directory traversal
2392| [2414] Apache HTTP Server up to 2.2.3 mod_rewrite memory corruption
2393| [2393] Apache HTTP Server up to 2.2.2 HTTP Header cross site scripting
2394| [30623] Apache James 2.2.0 SMTP Server denial of service
2395| [30176] PHP-Fusion up to 6.00.306 Apache HTTP Server .php.gif privilege escalation
2396|
2397| MITRE CVE - https://cve.mitre.org:
2398| [CVE-2013-4156] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.
2399| [CVE-2013-4131] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.
2400| [CVE-2013-3239] phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
2401| [CVE-2013-3060] The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
2402| [CVE-2013-2765] The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
2403| [CVE-2013-2251] Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
2404| [CVE-2013-2249] mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.
2405| [CVE-2013-2248] Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
2406| [CVE-2013-2189] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.
2407| [CVE-2013-2135] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
2408| [CVE-2013-2134] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
2409| [CVE-2013-2115] Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
2410| [CVE-2013-2071] java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
2411| [CVE-2013-2067] java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
2412| [CVE-2013-1966] Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
2413| [CVE-2013-1965] Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
2414| [CVE-2013-1896] mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
2415| [CVE-2013-1884] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
2416| [CVE-2013-1879] Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
2417| [CVE-2013-1862] mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
2418| [CVE-2013-1849] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
2419| [CVE-2013-1847] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
2420| [CVE-2013-1846] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
2421| [CVE-2013-1845] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
2422| [CVE-2013-1814] The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
2423| [CVE-2013-1777] The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not property implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
2424| [CVE-2013-1768] The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
2425| [CVE-2013-1088] Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
2426| [CVE-2013-1048] The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
2427| [CVE-2013-0966] The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI.
2428| [CVE-2013-0942] Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2429| [CVE-2013-0941] EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
2430| [CVE-2013-0253] The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
2431| [CVE-2013-0248] The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
2432| [CVE-2013-0239] Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
2433| [CVE-2012-6573] Cross-site scripting (XSS) vulnerability in the Apache Solr Autocomplete module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving autocomplete results.
2434| [CVE-2012-6551] The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
2435| [CVE-2012-6092] Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
2436| [CVE-2012-5887] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
2437| [CVE-2012-5886] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
2438| [CVE-2012-5885] The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
2439| [CVE-2012-5786] The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
2440| [CVE-2012-5785] Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
2441| [CVE-2012-5784] Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
2442| [CVE-2012-5783] Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
2443| [CVE-2012-5633] The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
2444| [CVE-2012-5616] Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
2445| [CVE-2012-5568] Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
2446| [CVE-2012-5351] Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
2447| [CVE-2012-4558] Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
2448| [CVE-2012-4557] The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
2449| [CVE-2012-4556] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
2450| [CVE-2012-4555] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
2451| [CVE-2012-4534] org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
2452| [CVE-2012-4528] The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
2453| [CVE-2012-4501] Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
2454| [CVE-2012-4460] The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
2455| [CVE-2012-4459] Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
2456| [CVE-2012-4458] The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
2457| [CVE-2012-4446] The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
2458| [CVE-2012-4431] org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
2459| [CVE-2012-4418] Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
2460| [CVE-2012-4387] Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
2461| [CVE-2012-4386] The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
2462| [CVE-2012-4360] Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2463| [CVE-2012-4063] The Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying XML Signature transforms to documents, which allows remote attackers to cause a denial of service via unspecified vectors.
2464| [CVE-2012-4001] The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.
2465| [CVE-2012-3908] Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
2466| [CVE-2012-3546] org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
2467| [CVE-2012-3544] Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
2468| [CVE-2012-3526] The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
2469| [CVE-2012-3513] munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
2470| [CVE-2012-3506] Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
2471| [CVE-2012-3502] The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
2472| [CVE-2012-3499] Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
2473| [CVE-2012-3467] Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
2474| [CVE-2012-3451] Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
2475| [CVE-2012-3446] Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
2476| [CVE-2012-3376] DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
2477| [CVE-2012-3373] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
2478| [CVE-2012-3126] Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Apache Tomcat Agent.
2479| [CVE-2012-3123] Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, related to Apache HTTP Server.
2480| [CVE-2012-2760] mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.
2481| [CVE-2012-2733] java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
2482| [CVE-2012-2687] Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
2483| [CVE-2012-2381] Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
2484| [CVE-2012-2380] Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.
2485| [CVE-2012-2379] Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
2486| [CVE-2012-2378] Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
2487| [CVE-2012-2329] Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
2488| [CVE-2012-2145] Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
2489| [CVE-2012-2138] The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
2490| [CVE-2012-2098] Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
2491| [CVE-2012-1574] The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
2492| [CVE-2012-1181] fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
2493| [CVE-2012-1089] Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.
2494| [CVE-2012-1007] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
2495| [CVE-2012-1006] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
2496| [CVE-2012-0883] envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
2497| [CVE-2012-0840] tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
2498| [CVE-2012-0838] Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
2499| [CVE-2012-0788] The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
2500| [CVE-2012-0394] ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
2501| [CVE-2012-0393] The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
2502| [CVE-2012-0392] The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
2503| [CVE-2012-0391] The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
2504| [CVE-2012-0256] Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
2505| [CVE-2012-0216] The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
2506| [CVE-2012-0213] The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
2507| [CVE-2012-0053] protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
2508| [CVE-2012-0047] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.
2509| [CVE-2012-0031] scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
2510| [CVE-2012-0022] Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
2511| [CVE-2012-0021] The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
2512| [CVE-2011-5064] DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
2513| [CVE-2011-5063] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
2514| [CVE-2011-5062] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
2515| [CVE-2011-5057] Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
2516| [CVE-2011-5034] Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
2517| [CVE-2011-4905] Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.
2518| [CVE-2011-4858] Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
2519| [CVE-2011-4668] IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
2520| [CVE-2011-4449] actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
2521| [CVE-2011-4415] The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
2522| [CVE-2011-4317] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
2523| [CVE-2011-3639] The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
2524| [CVE-2011-3620] Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
2525| [CVE-2011-3607] Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
2526| [CVE-2011-3376] org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
2527| [CVE-2011-3375] Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
2528| [CVE-2011-3368] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
2529| [CVE-2011-3348] The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
2530| [CVE-2011-3192] The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
2531| [CVE-2011-3190] Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
2532| [CVE-2011-2729] native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
2533| [CVE-2011-2712] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
2534| [CVE-2011-2688] SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
2535| [CVE-2011-2526] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
2536| [CVE-2011-2516] Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
2537| [CVE-2011-2481] Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
2538| [CVE-2011-2329] The rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart/C 1.3.0 does not properly calculate the expiration of timestamp tokens, which allows remote attackers to bypass intended access restrictions by leveraging an expired token, a different vulnerability than CVE-2011-0730.
2539| [CVE-2011-2204] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
2540| [CVE-2011-2088] XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
2541| [CVE-2011-2087] Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
2542| [CVE-2011-1928] The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
2543| [CVE-2011-1921] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.
2544| [CVE-2011-1783] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.
2545| [CVE-2011-1772] Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
2546| [CVE-2011-1752] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.
2547| [CVE-2011-1610] Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
2548| [CVE-2011-1582] Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
2549| [CVE-2011-1571] Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
2550| [CVE-2011-1570] Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
2551| [CVE-2011-1503] The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
2552| [CVE-2011-1502] Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
2553| [CVE-2011-1498] Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
2554| [CVE-2011-1475] The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
2555| [CVE-2011-1419] Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
2556| [CVE-2011-1318] Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by accessing a JSP page of an application that is repeatedly stopped and restarted.
2557| [CVE-2011-1184] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
2558| [CVE-2011-1183] Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
2559| [CVE-2011-1176] The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
2560| [CVE-2011-1088] Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
2561| [CVE-2011-1077] Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2562| [CVE-2011-1026] Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.
2563| [CVE-2011-0715] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
2564| [CVE-2011-0534] Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
2565| [CVE-2011-0533] Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta
2566| [CVE-2011-0419] Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
2567| [CVE-2011-0013] Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
2568| [CVE-2010-4644] Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.
2569| [CVE-2010-4539] The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
2570| [CVE-2010-4476] The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
2571| [CVE-2010-4455] Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.2 and 11.1.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Apache Plugin.
2572| [CVE-2010-4408] Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
2573| [CVE-2010-4312] The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
2574| [CVE-2010-4172] Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
2575| [CVE-2010-3872] The fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.6 for the Apache HTTP Server does not use bytewise pointer arithmetic in certain circumstances, which has unspecified impact and attack vectors related to "untrusted FastCGI applications" and a "stack buffer overwrite."
2576| [CVE-2010-3863] Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
2577| [CVE-2010-3854] Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2578| [CVE-2010-3718] Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
2579| [CVE-2010-3449] Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1
2580| [CVE-2010-3315] authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
2581| [CVE-2010-3083] sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
2582| [CVE-2010-2952] Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.
2583| [CVE-2010-2791] mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
2584| [CVE-2010-2375] Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
2585| [CVE-2010-2234] Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
2586| [CVE-2010-2227] Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
2587| [CVE-2010-2103] Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
2588| [CVE-2010-2086] Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
2589| [CVE-2010-2076] Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
2590| [CVE-2010-2068] mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
2591| [CVE-2010-2057] shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
2592| [CVE-2010-1632] Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
2593| [CVE-2010-1623] Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
2594| [CVE-2010-1587] The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
2595| [CVE-2010-1452] The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
2596| [CVE-2010-1325] Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting. NOTE: some sources report that this is a vulnerability in a product named "Apache SLMS," but that is incorrect.
2597| [CVE-2010-1244] Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
2598| [CVE-2010-1157] Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
2599| [CVE-2010-1151] Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.
2600| [CVE-2010-0684] Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
2601| [CVE-2010-0434] The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
2602| [CVE-2010-0432] Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
2603| [CVE-2010-0425] modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
2604| [CVE-2010-0408] The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
2605| [CVE-2010-0390] Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions, allows remote attackers to execute arbitrary code by uploading a file with a pjpeg or jpeg extension, then accessing it via a direct request to the file in original/. NOTE: some of these details are obtained from third party information.
2606| [CVE-2010-0219] Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
2607| [CVE-2010-0010] Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
2608| [CVE-2010-0009] Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
2609| [CVE-2009-5120] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
2610| [CVE-2009-5119] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
2611| [CVE-2009-5006] The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote authenticated users to cause a denial of service (NULL pointer dereference, daemon crash, and cluster outage) by attempting to modify the alternate of an exchange.
2612| [CVE-2009-5005] The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.
2613| [CVE-2009-4355] Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
2614| [CVE-2009-4269] The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
2615| [CVE-2009-3923] The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.
2616| [CVE-2009-3890] Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.
2617| [CVE-2009-3843] HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
2618| [CVE-2009-3821] Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2619| [CVE-2009-3555] The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
2620| [CVE-2009-3548] The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
2621| [CVE-2009-3250] The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.
2622| [CVE-2009-3095] The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
2623| [CVE-2009-3094] The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
2624| [CVE-2009-2902] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
2625| [CVE-2009-2901] The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
2626| [CVE-2009-2823] The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the HTTP TRACE method, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software.
2627| [CVE-2009-2699] The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
2628| [CVE-2009-2696] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
2629| [CVE-2009-2693] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
2630| [CVE-2009-2625] XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
2631| [CVE-2009-2412] Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR
2632| [CVE-2009-2299] The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
2633| [CVE-2009-1956] Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
2634| [CVE-2009-1955] The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
2635| [CVE-2009-1903] The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.
2636| [CVE-2009-1891] The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
2637| [CVE-2009-1890] The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
2638| [CVE-2009-1885] Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
2639| [CVE-2009-1462] The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.
2640| [CVE-2009-1275] Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
2641| [CVE-2009-1195] The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
2642| [CVE-2009-1191] mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
2643| [CVE-2009-1012] Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
2644| [CVE-2009-0918] Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
2645| [CVE-2009-0796] Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
2646| [CVE-2009-0783] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
2647| [CVE-2009-0781] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
2648| [CVE-2009-0754] PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
2649| [CVE-2009-0580] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
2650| [CVE-2009-0486] Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
2651| [CVE-2009-0039] Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
2652| [CVE-2009-0038] Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring
2653| [CVE-2009-0033] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
2654| [CVE-2009-0026] Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
2655| [CVE-2009-0023] The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
2656| [CVE-2008-6879] Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
2657| [CVE-2008-6755] ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.
2658| [CVE-2008-6722] Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.
2659| [CVE-2008-6682] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
2660| [CVE-2008-6505] Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
2661| [CVE-2008-6504] ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
2662| [CVE-2008-5696] Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the ApacheAdmin console, which allows remote attackers to reconfigure the Apache HTTP Server via console operations.
2663| [CVE-2008-5676] Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to "transformation caching."
2664| [CVE-2008-5519] The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
2665| [CVE-2008-5518] Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet)
2666| [CVE-2008-5515] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
2667| [CVE-2008-5457] Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
2668| [CVE-2008-4308] The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
2669| [CVE-2008-4008] Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
2670| [CVE-2008-3666] Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-dependent attackers to cause a denial of service (panic) via vectors involving creation of a crafted file and use of the sendfilev system call, as demonstrated by a file served by an Apache 2.2.x web server with EnableSendFile configured
2671| [CVE-2008-3271] Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
2672| [CVE-2008-3257] Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
2673| [CVE-2008-2939] Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
2674| [CVE-2008-2938] Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
2675| [CVE-2008-2742] Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory. NOTE: this is only a vulnerability in environments that support multiple extensions, such as Apache with the mod_mime module enabled.
2676| [CVE-2008-2717] TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
2677| [CVE-2008-2579] Unspecified vulnerability in the WebLogic Server Plugins for Apache, Sun and IIS web servers component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 has unknown impact and remote attack vectors.
2678| [CVE-2008-2384] SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
2679| [CVE-2008-2370] Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
2680| [CVE-2008-2364] The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
2681| [CVE-2008-2168] Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
2682| [CVE-2008-2025] Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
2683| [CVE-2008-1947] Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
2684| [CVE-2008-1734] Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.
2685| [CVE-2008-1678] Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
2686| [CVE-2008-1232] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
2687| [CVE-2008-0869] Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
2688| [CVE-2008-0732] The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
2689| [CVE-2008-0555] The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.
2690| [CVE-2008-0457] Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
2691| [CVE-2008-0456] CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
2692| [CVE-2008-0455] Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
2693| [CVE-2008-0128] The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
2694| [CVE-2008-0005] mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
2695| [CVE-2008-0002] Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
2696| [CVE-2007-6750] The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.
2697| [CVE-2007-6726] Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
2698| [CVE-2007-6514] Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive.
2699| [CVE-2007-6423] ** DISPUTED ** Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue.
2700| [CVE-2007-6422] The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.
2701| [CVE-2007-6421] Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
2702| [CVE-2007-6420] Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
2703| [CVE-2007-6388] Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2704| [CVE-2007-6361] Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote attackers to read certain files under temp/, as demonstrated by a log file that records the titles of blog entries. NOTE: access to temp/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
2705| [CVE-2007-6342] SQL injection vulnerability in the David Castro AuthCAS module (AuthCAS.pm) 0.4 for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the SESSION_COOKIE_NAME (session ID) in a cookie.
2706| [CVE-2007-6286] Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
2707| [CVE-2007-6258] Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.
2708| [CVE-2007-6231] Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4) status_top_x.inc.php, or (5) libchart-1.1/libchart.php in include/. NOTE: access to include/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
2709| [CVE-2007-6203] Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
2710| [CVE-2007-5797] SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
2711| [CVE-2007-5731] Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
2712| [CVE-2007-5461] Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
2713| [CVE-2007-5342] The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
2714| [CVE-2007-5333] Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
2715| [CVE-2007-5156] Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
2716| [CVE-2007-5085] Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.
2717| [CVE-2007-5000] Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2718| [CVE-2007-4724] Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
2719| [CVE-2007-4723] Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a "/...../" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.
2720| [CVE-2007-4641] Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting code into an Apache log file.
2721| [CVE-2007-4556] Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
2722| [CVE-2007-4548] The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
2723| [CVE-2007-4465] Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
2724| [CVE-2007-3847] The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
2725| [CVE-2007-3571] The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
2726| [CVE-2007-3386] Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
2727| [CVE-2007-3385] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
2728| [CVE-2007-3384] Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.
2729| [CVE-2007-3383] Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
2730| [CVE-2007-3382] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
2731| [CVE-2007-3304] Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
2732| [CVE-2007-3303] Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
2733| [CVE-2007-3101] Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.
2734| [CVE-2007-2450] Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
2735| [CVE-2007-2449] Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the '
2736| [CVE-2007-2353] Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
2737| [CVE-2007-2025] Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.
2738| [CVE-2007-1863] cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
2739| [CVE-2007-1862] The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.
2740| [CVE-2007-1860] mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
2741| [CVE-2007-1858] The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.
2742| [CVE-2007-1842] Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, a related issue to CVE-2006-2019.
2743| [CVE-2007-1801] Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by inc/lang.php.
2744| [CVE-2007-1743] suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.
2745| [CVE-2007-1742] suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
2746| [CVE-2007-1741] Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
2747| [CVE-2007-1720] Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
2748| [CVE-2007-1636] Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.
2749| [CVE-2007-1633] Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by bbcode_ref.php.
2750| [CVE-2007-1577] Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tplname] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
2751| [CVE-2007-1539] Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the module_name parameter, as demonstrated via a static PHP code injection attack in an Apache log file.
2752| [CVE-2007-1524] Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the settings[skin] parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via themes/default/.
2753| [CVE-2007-1491] Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties.
2754| [CVE-2007-1358] Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
2755| [CVE-2007-1349] PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
2756| [CVE-2007-0975] Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the _REQUEST superglobal array.
2757| [CVE-2007-0930] Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function.
2758| [CVE-2007-0792] The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
2759| [CVE-2007-0774] Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
2760| [CVE-2007-0637] Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the galeria parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by zd_numer.php.
2761| [CVE-2007-0451] Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
2762| [CVE-2007-0450] Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
2763| [CVE-2007-0419] The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
2764| [CVE-2007-0173] Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
2765| [CVE-2007-0098] Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
2766| [CVE-2007-0086] ** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
2767| [CVE-2006-7217] Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
2768| [CVE-2006-7216] Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
2769| [CVE-2006-7197] The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.
2770| [CVE-2006-7196] Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
2771| [CVE-2006-7195] Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
2772| [CVE-2006-7098] The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.
2773| [CVE-2006-6869] Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang cookie to error.php, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
2774| [CVE-2006-6675] Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecifeid parameters in Welcome web-app.
2775| [CVE-2006-6613] Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_lang[include_file] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
2776| [CVE-2006-6589] Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCH_STRING parameter, a different issue than CVE-2006-6587. NOTE: some of these details are obtained from third party information.
2777| [CVE-2006-6588] The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown impact.
2778| [CVE-2006-6587] Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
2779| [CVE-2006-6445] Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
2780| [CVE-2006-6071] TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
2781| [CVE-2006-6047] Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
2782| [CVE-2006-5894] Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by lang.php.
2783| [CVE-2006-5752] Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.
2784| [CVE-2006-5733] Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
2785| [CVE-2006-5263] Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter, as demonstrated by a parameter value naming an Apache HTTP Server log file that apparently contains PHP code.
2786| [CVE-2006-4994] Multiple unquoted Windows search path vulnerabilities in Apache Friends XAMPP 1.5.2 might allow local users to gain privileges via a malicious program file in %SYSTEMDRIVE%, which is run when XAMPP attempts to execute (1) FileZillaServer.exe, (2) mysqld-nt.exe, (3) Perl.exe, or (4) xamppcontrol.exe with an unquoted "Program Files" pathname.
2787| [CVE-2006-4636] Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
2788| [CVE-2006-4625] PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
2789| [CVE-2006-4558] DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
2790| [CVE-2006-4191] Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by header.php.
2791| [CVE-2006-4154] Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.
2792| [CVE-2006-4110] Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.
2793| [CVE-2006-4004] Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
2794| [CVE-2006-3918] http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
2795| [CVE-2006-3835] Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (
2796| [CVE-2006-3747] Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
2797| [CVE-2006-3362] Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
2798| [CVE-2006-3102] Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles directory.
2799| [CVE-2006-3070] write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
2800| [CVE-2006-2831] Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
2801| [CVE-2006-2806] The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.
2802| [CVE-2006-2743] Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.
2803| [CVE-2006-2514] Coppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.
2804| [CVE-2006-2330] PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
2805| [CVE-2006-1777] Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.
2806| [CVE-2006-1564] Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory.
2807| [CVE-2006-1548] Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
2808| [CVE-2006-1547] ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
2809| [CVE-2006-1546] Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
2810| [CVE-2006-1393] Multiple cross-site scripting (XSS) vulnerabilities in the mod_pubcookie Apache application server module in University of Washington Pubcookie 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.
2811| [CVE-2006-1346] Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang[*][file] parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by index.php.
2812| [CVE-2006-1292] Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.
2813| [CVE-2006-1243] Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included using install05.php.
2814| [CVE-2006-1095] Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
2815| [CVE-2006-1079] htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
2816| [CVE-2006-1078] Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
2817| [CVE-2006-0743] Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
2818| [CVE-2006-0254] Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
2819| [CVE-2006-0150] Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
2820| [CVE-2006-0144] The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
2821| [CVE-2006-0042] Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.
2822| [CVE-2005-4857] eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error".
2823| [CVE-2005-4849] Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
2824| [CVE-2005-4836] The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
2825| [CVE-2005-4814] Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory.
2826| [CVE-2005-4703] Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
2827| [CVE-2005-3745] Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
2828| [CVE-2005-3630] Fedora Directory Server before 10 allows remote attackers to obtain sensitive information, such as the password from adm.conf via an IFRAME element, probably involving an Apache httpd.conf configuration that orders "allow" directives before "deny" directives.
2829| [CVE-2005-3510] Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
2830| [CVE-2005-3392] Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.
2831| [CVE-2005-3357] mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
2832| [CVE-2005-3352] Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
2833| [CVE-2005-3319] The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
2834| [CVE-2005-3164] The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
2835| [CVE-2005-2970] Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.
2836| [CVE-2005-2963] The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.
2837| [CVE-2005-2728] The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
2838| [CVE-2005-2660] apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
2839| [CVE-2005-2088] The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
2840| [CVE-2005-1754] ** DISPUTED ** JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
2841| [CVE-2005-1753] ** DISPUTED ** ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
2842| [CVE-2005-1344] Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
2843| [CVE-2005-1268] Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
2844| [CVE-2005-1266] Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.
2845| [CVE-2005-0808] Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
2846| [CVE-2005-0182] The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.
2847| [CVE-2005-0108] Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.
2848| [CVE-2004-2734] webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
2849| [CVE-2004-2680] mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.
2850| [CVE-2004-2650] Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
2851| [CVE-2004-2343] ** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.
2852| [CVE-2004-2336] Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
2853| [CVE-2004-2115] Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
2854| [CVE-2004-1834] mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.
2855| [CVE-2004-1765] Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.
2856| [CVE-2004-1545] UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.hwp, which allows remote attackers to upload and execute arbitrary code.
2857| [CVE-2004-1438] The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.
2858| [CVE-2004-1405] MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
2859| [CVE-2004-1404] Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
2860| [CVE-2004-1387] The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
2861| [CVE-2004-1084] Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles.
2862| [CVE-2004-1083] Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
2863| [CVE-2004-1082] mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
2864| [CVE-2004-0942] Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.
2865| [CVE-2004-0940] Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
2866| [CVE-2004-0885] The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
2867| [CVE-2004-0811] Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.
2868| [CVE-2004-0809] The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
2869| [CVE-2004-0786] The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
2870| [CVE-2004-0751] The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).
2871| [CVE-2004-0748] mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.
2872| [CVE-2004-0747] Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.
2873| [CVE-2004-0700] Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
2874| [CVE-2004-0646] Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod_jrun and (2) mod_jrun20 for Apache, with verbose logging enabled, allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.
2875| [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
2876| [CVE-2004-0493] The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
2877| [CVE-2004-0492] Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
2878| [CVE-2004-0490] cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
2879| [CVE-2004-0488] Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
2880| [CVE-2004-0263] PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.
2881| [CVE-2004-0174] Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."
2882| [CVE-2004-0173] Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.
2883| [CVE-2004-0113] Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
2884| [CVE-2004-0009] Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user.
2885| [CVE-2003-1581] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
2886| [CVE-2003-1580] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
2887| [CVE-2003-1573] The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
2888| [CVE-2003-1521] Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
2889| [CVE-2003-1516] The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
2890| [CVE-2003-1502] mod_throttle 3.0 allows local users with Apache privileges to access shared memory that points to a file that is writable by the apache user, which could allow local users to gain privileges.
2891| [CVE-2003-1418] Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child proccess IDs (PID).
2892| [CVE-2003-1307] ** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP."
2893| [CVE-2003-1172] Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
2894| [CVE-2003-1171] Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data.
2895| [CVE-2003-1138] The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).
2896| [CVE-2003-1054] mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname, as parsed by the ap_parse_uri_components function in Apache, which triggers a null dereference.
2897| [CVE-2003-0993] mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
2898| [CVE-2003-0987] mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
2899| [CVE-2003-0866] The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
2900| [CVE-2003-0844] mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
2901| [CVE-2003-0843] Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode and using the Apache log, allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header.
2902| [CVE-2003-0789] mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.
2903| [CVE-2003-0771] Gallery.pm in Apache::Gallery (aka A::G) uses predictable temporary filenames when running Inline::C, which allows local users to execute arbitrary code by creating and modifying the files before Apache::Gallery does.
2904| [CVE-2003-0658] Docview before 1.1-18 in Caldera OpenLinux 3.1.1, SCO Linux 4.0, OpenServer 5.0.7, configures the Apache web server in a way that allows remote attackers to read arbitrary publicly readable files via a certain URL, possibly related to rewrite rules.
2905| [CVE-2003-0542] Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.
2906| [CVE-2003-0460] The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.
2907| [CVE-2003-0254] Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.
2908| [CVE-2003-0253] The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.
2909| [CVE-2003-0249] ** DISPUTED ** PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report."
2910| [CVE-2003-0245] Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.
2911| [CVE-2003-0192] Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.
2912| [CVE-2003-0189] The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.
2913| [CVE-2003-0134] Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.
2914| [CVE-2003-0132] A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
2915| [CVE-2003-0083] Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
2916| [CVE-2003-0020] Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.
2917| [CVE-2003-0017] Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
2918| [CVE-2003-0016] Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
2919| [CVE-2002-2310] ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than Apache, which allows remote attackers to obtain usernames and passwords.
2920| [CVE-2002-2309] php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
2921| [CVE-2002-2272] Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
2922| [CVE-2002-2103] Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
2923| [CVE-2002-2029] PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
2924| [CVE-2002-2012] Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
2925| [CVE-2002-2009] Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
2926| [CVE-2002-2008] Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
2927| [CVE-2002-2007] The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
2928| [CVE-2002-2006] The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
2929| [CVE-2002-1895] The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
2930| [CVE-2002-1850] mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
2931| [CVE-2002-1793] HTTP Server mod_ssl module running on HP-UX 11.04 with Virtualvault OS (VVOS) 4.5 through 4.6 closes the connection when the Apache server times out during an SSL request, which may allow attackers to cause a denial of service.
2932| [CVE-2002-1658] Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
2933| [CVE-2002-1635] The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
2934| [CVE-2002-1593] mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.
2935| [CVE-2002-1592] The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
2936| [CVE-2002-1567] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
2937| [CVE-2002-1394] Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
2938| [CVE-2002-1233] A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
2939| [CVE-2002-1157] Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
2940| [CVE-2002-1156] Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
2941| [CVE-2002-1148] The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
2942| [CVE-2002-0935] Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
2943| [CVE-2002-0843] Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
2944| [CVE-2002-0840] Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
2945| [CVE-2002-0839] The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
2946| [CVE-2002-0682] Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
2947| [CVE-2002-0661] Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
2948| [CVE-2002-0658] OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.
2949| [CVE-2002-0654] Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
2950| [CVE-2002-0653] Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
2951| [CVE-2002-0513] The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
2952| [CVE-2002-0493] Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
2953| [CVE-2002-0392] Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
2954| [CVE-2002-0259] InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache directory, or (2) mplog.txt, which could allow local users to gain privileges.
2955| [CVE-2002-0249] PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.
2956| [CVE-2002-0240] PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
2957| [CVE-2002-0082] The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
2958| [CVE-2002-0061] Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
2959| [CVE-2001-1556] The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
2960| [CVE-2001-1534] mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
2961| [CVE-2001-1510] Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
2962| [CVE-2001-1449] The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
2963| [CVE-2001-1385] The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
2964| [CVE-2001-1342] Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.
2965| [CVE-2001-1217] Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
2966| [CVE-2001-1216] Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
2967| [CVE-2001-1072] Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.
2968| [CVE-2001-1013] Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
2969| [CVE-2001-0925] The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
2970| [CVE-2001-0829] A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
2971| [CVE-2001-0766] Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.
2972| [CVE-2001-0731] Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.
2973| [CVE-2001-0730] split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header.
2974| [CVE-2001-0729] Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash) characters.
2975| [CVE-2001-0590] Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
2976| [CVE-2001-0131] htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
2977| [CVE-2001-0108] PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
2978| [CVE-2001-0042] PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequences.
2979| [CVE-2000-1247] The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.
2980| [CVE-2000-1210] Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
2981| [CVE-2000-1206] Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
2982| [CVE-2000-1205] Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.
2983| [CVE-2000-1204] Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root.
2984| [CVE-2000-1168] IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.
2985| [CVE-2000-1016] The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL.
2986| [CVE-2000-0913] mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.
2987| [CVE-2000-0883] The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory.
2988| [CVE-2000-0869] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary diretories via the PROPFIND HTTP request method.
2989| [CVE-2000-0868] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/.
2990| [CVE-2000-0791] Trustix installs the httpsd program for Apache-SSL with world-writeable permissions, which allows local users to replace it with a Trojan horse.
2991| [CVE-2000-0760] The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
2992| [CVE-2000-0759] Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
2993| [CVE-2000-0628] The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files.
2994| [CVE-2000-0505] The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
2995| [CVE-1999-1412] A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.
2996| [CVE-1999-1293] mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
2997| [CVE-1999-1237] Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
2998| [CVE-1999-1199] Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.
2999| [CVE-1999-1053] guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
3000| [CVE-1999-0926] Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
3001| [CVE-1999-0678] A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.
3002| [CVE-1999-0448] IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.
3003| [CVE-1999-0289] The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL.
3004| [CVE-1999-0236] ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
3005| [CVE-1999-0107] Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.
3006| [CVE-1999-0071] Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.
3007|
3008| SecurityFocus - https://www.securityfocus.com/bid/:
3009| [104554] Apache HBase CVE-2018-8025 Security Bypass Vulnerability
3010| [104465] Apache Geode CVE-2017-15695 Remote Code Execution Vulnerability
3011| [104418] Apache Storm CVE-2018-8008 Arbitrary File Write Vulnerability
3012| [104399] Apache Storm CVE-2018-1332 User Impersonation Vulnerability
3013| [104348] Apache UIMA CVE-2017-15691 XML External Entity Injection Vulnerability
3014| [104313] Apache NiFi XML External Entity Injection and Denial of Service Vulnerability
3015| [104259] Apache Geode CVE-2017-12622 Authorization Bypass Vulnerability
3016| [104257] Apache Sling XSS Protection API CVE-2017-15717 Cross Site Scripting Vulnerability
3017| [104253] Apache ZooKeeper CVE-2018-8012 Security Bypass Vulnerability
3018| [104252] Apache Batik CVE-2018-8013 Information Disclosure Vulnerability
3019| [104239] Apache Solr CVE-2018-8010 XML External Entity Multiple Information Disclosure Vulnerabilities
3020| [104215] Apache ORC CVE-2018-8015 Denial of Service Vulnerability
3021| [104203] Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability
3022| [104161] Apache Ambari CVE-2018-8003 Directory Traversal Vulnerability
3023| [104140] Apache Derby CVE-2018-1313 Security Bypass Vulnerability
3024| [104135] Apache Tika CVE-2018-1338 Denial of Service Vulnerability
3025| [104008] Apache Fineract CVE-2018-1291 SQL Injection Vulnerability
3026| [104007] Apache Fineract CVE-2018-1292 SQL Injection Vulnerability
3027| [104005] Apache Fineract CVE-2018-1289 SQL Injection Vulnerability
3028| [104001] Apache Tika CVE-2018-1335 Remote Command Injection Vulnerability
3029| [103975] Apache Fineract CVE-2018-1290 SQL Injection Vulnerability
3030| [103974] Apache Solr CVE-2018-1308 XML External Entity Injection Vulnerability
3031| [103772] Apache Traffic Server CVE-2017-7671 Denial of Service Vulnerability
3032| [103770] Apache Traffic Server CVE-2017-5660 Security Bypass Vulnerability
3033| [103751] Apache Hive CVE-2018-1282 SQL Injection Vulnerability
3034| [103750] Apache Hive CVE-2018-1284 Security Bypass Vulnerability
3035| [103692] Apache Ignite CVE-2018-1295 Arbitrary Code Execution Vulnerability
3036| [103528] Apache HTTP Server CVE-2018-1302 Denial of Service Vulnerability
3037| [103525] Apache HTTP Server CVE-2017-15715 Remote Security Bypass Vulnerability
3038| [103524] Apache HTTP Server CVE-2018-1312 Remote Security Bypass Vulnerability
3039| [103522] Apache HTTP Server CVE-2018-1303 Denial of Service Vulnerability
3040| [103520] Apache HTTP Server CVE-2018-1283 Remote Security Vulnerability
3041| [103516] Apache Struts CVE-2018-1327 Denial of Service Vulnerability
3042| [103515] Apache HTTP Server CVE-2018-1301 Denial of Service Vulnerability
3043| [103512] Apache HTTP Server CVE-2017-15710 Denial of Service Vulnerability
3044| [103508] Apache Syncope CVE-2018-1321 Multiple Remote Code Execution Vulnerabilities
3045| [103507] Apache Syncope CVE-2018-1322 Multiple Information Disclosure Vulnerabilities
3046| [103490] Apache Commons Compress CVE-2018-1324 Multiple Denial Of Service Vulnerabilities
3047| [103434] APACHE Allura CVE-2018-1319 HTTP Response Splitting Vulnerability
3048| [103389] Apache Tomcat JK Connector CVE-2018-1323 Directory Traversal Vulnerability
3049| [103222] Apache CloudStack CVE-2013-4317 Information Disclosure Vulnerability
3050| [103219] Apache Xerces-C CVE-2017-12627 Null Pointer Dereference Denial of Service Vulnerability
3051| [103206] Apache Geode CVE-2017-15693 Remote Code Execution Vulnerability
3052| [103205] Apache Geode CVE-2017-15692 Remote Code Execution Vulnerability
3053| [103170] Apache Tomcat CVE-2018-1304 Security Bypass Vulnerability
3054| [103144] Apache Tomcat CVE-2018-1305 Security Bypass Vulnerability
3055| [103102] Apache Oozie CVE-2017-15712 Information Disclosure Vulnerability
3056| [103098] Apache Karaf CVE-2016-8750 LDAP Injection Vulnerability
3057| [103069] Apache Tomcat CVE-2017-15706 Remote Security Weakness
3058| [103068] Apache JMeter CVE-2018-1287 Security Bypass Vulnerability
3059| [103067] Apache Qpid Dispatch Router 'router_core/connections.c' Denial of Service Vulnerability
3060| [103036] Apache CouchDB CVE-2017-12636 Remote Code Execution Vulnerability
3061| [103025] Apache Thrift CVE-2016-5397 Remote Command Injection Vulnerability
3062| [102879] Apache POI CVE-2017-12626 Multiple Denial of Service Vulnerabilities
3063| [102842] Apache NiFi CVE-2017-12632 Host Header Injection Vulnerability
3064| [102815] Apache NiFi CVE-2017-15697 Multiple Cross Site Scripting Vulnerabilities
3065| [102488] Apache Geode CVE-2017-9795 Remote Code Execution Vulnerability
3066| [102229] Apache Sling CVE-2017-15700 Information Disclosure Vulnerability
3067| [102226] Apache Drill CVE-2017-12630 Cross Site Scripting Vulnerability
3068| [102154] Multiple Apache Products CVE-2017-15708 Remote Code Execution Vulnerability
3069| [102127] Apache CXF Fediz CVE-2017-12631 Multiple Cross Site Request Forgery Vulnerabilities
3070| [102041] Apache Qpid Broker-J CVE-2017-15701 Denial of Service Vulnerability
3071| [102040] Apache Qpid Broker CVE-2017-15702 Security Weakness
3072| [102021] Apache Struts CVE-2017-15707 Denial of Service Vulnerability
3073| [101980] EMC RSA Authentication Agent for Web: Apache Web Server Authentication Bypass Vulnerability
3074| [101876] Apache Camel CVE-2017-12634 Deserialization Remote Code Execution Vulnerability
3075| [101874] Apache Camel CVE-2017-12633 Deserialization Remote Code Execution Vulnerability
3076| [101872] Apache Karaf CVE-2014-0219 Local Denial of Service Vulnerability
3077| [101868] Apache CouchDB CVE-2017-12635 Remote Privilege Escalation Vulnerability
3078| [101859] Apache CXF CVE-2017-12624 Denial of Service Vulnerability
3079| [101844] Apache Sling Servlets Post CVE-2017-11296 Cross Site Scripting Vulnerability
3080| [101686] Apache Hive CVE-2017-12625 Information Disclosure Vulnerability
3081| [101644] Apache Wicket CVE-2012-5636 Cross Site Scripting Vulnerability
3082| [101631] Apache Traffic Server CVE-2015-3249 Multiple Remote Code Execution Vulnerabilities
3083| [101630] Apache Traffic Server CVE-2014-3624 Access Bypass Vulnerability
3084| [101625] Apache jUDDI CVE-2009-1197 Security Bypass Vulnerability
3085| [101623] Apache jUDDI CVE-2009-1198 Cross Site Scripting Vulnerability
3086| [101620] Apache Subversion 'libsvn_fs_fs/fs_fs.c' Denial of Service Vulnerability
3087| [101585] Apache OpenOffice Multiple Remote Code Execution Vulnerabilities
3088| [101577] Apache Wicket CVE-2016-6806 Cross Site Request Forgery Vulnerability
3089| [101575] Apache Wicket CVE-2014-0043 Information Disclosure Vulnerability
3090| [101570] Apache Geode CVE-2017-9797 Information Disclosure Vulnerability
3091| [101562] Apache Derby CVE-2010-2232 Arbitrary File Overwrite Vulnerability
3092| [101560] Apache Portable Runtime Utility CVE-2017-12613 Multiple Information Disclosure Vulnerabilities
3093| [101558] Apache Portable Runtime Utility Local Out-of-Bounds Read Denial of Service Vulnerability
3094| [101532] Apache James CVE-2017-12628 Arbitrary Command Execution Vulnerability
3095| [101516] Apache HTTP Server CVE-2017-12171 Security Bypass Vulnerability
3096| [101261] Apache Solr/Lucene CVE-2017-12629 Information Disclosure and Remote Code Execution Vulnerabilities
3097| [101230] Apache Roller CVE-2014-0030 XML External Entity Injection Vulnerability
3098| [101173] Apache IMPALA CVE-2017-9792 Information Disclosure Vulnerability
3099| [101052] Apache Commons Jelly CVE-2017-12621 Security Bypass Vulnerability
3100| [101027] Apache Mesos CVE-2017-7687 Denial of Service Vulnerability
3101| [101023] Apache Mesos CVE-2017-9790 Denial of Service Vulnerability
3102| [100954] Apache Tomcat CVE-2017-12617 Incomplete Fix Remote Code Execution Vulnerability
3103| [100946] Apache Wicket CVE-2014-7808 Cross Site Request Forgery Vulnerability
3104| [100901] Apache Tomcat CVE-2017-12615 Remote Code Execution Vulnerability
3105| [100897] Apache Tomcat CVE-2017-12616 Information Disclosure Vulnerability
3106| [100880] Apache Directory LDAP API CVE-2015-3250 Unspecified Information Disclosure Vulnerability
3107| [100872] Apache HTTP Server CVE-2017-9798 Information Disclosure Vulnerability
3108| [100870] Apache Solr CVE-2017-9803 Remote Privilege Escalation Vulnerability
3109| [100859] puppetlabs-apache CVE-2017-2299 Information Disclosure Vulnerability
3110| [100829] Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability
3111| [100823] Apache Spark CVE-2017-12612 Deserialization Remote Code Execution Vulnerability
3112| [100612] Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability
3113| [100611] Apache Struts CVE-2017-9793 Denial of Service Vulnerability
3114| [100609] Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability
3115| [100587] Apache Atlas CVE-2017-3155 Cross Frame Scripting Vulnerability
3116| [100581] Apache Atlas CVE-2017-3154 Information Disclosure Vulnerability
3117| [100578] Apache Atlas CVE-2017-3153 Cross Site Scripting Vulnerability
3118| [100577] Apache Atlas CVE-2017-3152 Cross Site Scripting Vulnerability
3119| [100547] Apache Atlas CVE-2017-3151 HTML Injection Vulnerability
3120| [100536] Apache Atlas CVE-2017-3150 Cross Site Scripting Vulnerability
3121| [100449] Apache Pony Mail CVE-2016-4460 Authentication Bypass Vulnerability
3122| [100447] Apache2Triad Multiple Security Vulnerabilities
3123| [100284] Apache Sling Servlets Post CVE-2017-9802 Cross Site Scripting Vulnerability
3124| [100280] Apache Tomcat CVE-2017-7674 Security Bypass Vulnerability
3125| [100259] Apache Subversion CVE-2017-9800 Remote Command Execution Vulnerability
3126| [100256] Apache Tomcat CVE-2017-7675 Directory Traversal Vulnerability
3127| [100235] Apache Storm CVE-2017-9799 Remote Code Execution Vulnerability
3128| [100082] Apache Commons Email CVE-2017-9801 SMTP Header Injection Vulnerability
3129| [99873] Apache Sling XSS Protection API CVE-2016-6798 XML External Entity Injection Vulnerability
3130| [99870] Apache Sling API CVE-2016-5394 Cross Site Scripting Vulnerability
3131| [99603] Apache Spark CVE-2017-7678 Cross Site Scripting Vulnerability
3132| [99592] Apache OpenMeetings CVE-2017-7685 Security Bypass Vulnerability
3133| [99587] Apache OpenMeetings CVE-2017-7673 Security Bypass Vulnerability
3134| [99586] Apache OpenMeetings CVE-2017-7688 Security Bypass Vulnerability
3135| [99584] Apache OpenMeetings CVE-2017-7684 Denial of Service Vulnerability
3136| [99577] Apache OpenMeetings CVE-2017-7663 Cross Site Scripting Vulnerability
3137| [99576] Apache OpenMeetings CVE-2017-7664 XML External Entity Injection Vulnerability
3138| [99569] Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability
3139| [99568] Apache HTTP Server CVE-2017-9789 Denial of Service Vulnerability
3140| [99563] Apache Struts CVE-2017-7672 Denial of Service Vulnerability
3141| [99562] Apache Struts Spring AOP Functionality Denial of Service Vulnerability
3142| [99509] Apache Impala CVE-2017-5652 Information Disclosure Vulnerability
3143| [99508] Apache IMPALA CVE-2017-5640 Authentication Bypass Vulnerability
3144| [99486] Apache Traffic Control CVE-2017-7670 Denial of Service Vulnerability
3145| [99485] Apache Solr CVE-2017-7660 Security Bypass Vulnerability
3146| [99484] Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability
3147| [99292] Apache Ignite CVE-2017-7686 Information Disclosure Vulnerability
3148| [99170] Apache HTTP Server CVE-2017-7679 Buffer Overflow Vulnerability
3149| [99137] Apache HTTP Server CVE-2017-7668 Denial of Service Vulnerability
3150| [99135] Apache HTTP Server CVE-2017-3167 Authentication Bypass Vulnerability
3151| [99134] Apache HTTP Server CVE-2017-3169 Denial of Service Vulnerability
3152| [99132] Apache HTTP Server CVE-2017-7659 Denial of Service Vulnerability
3153| [99112] Apache Thrift CVE-2015-3254 Denial of Service Vulnerability
3154| [99067] Apache Ranger CVE-2016-8751 HTML Injection Vulnerability
3155| [99018] Apache NiFi CVE-2017-7667 Cross Frame Scripting Vulnerability
3156| [99009] Apache NiFi CVE-2017-7665 Cross Site Scripting Vulnerability
3157| [98961] Apache Ranger CVE-2017-7677 Security Bypass Vulnerability
3158| [98958] Apache Ranger CVE-2017-7676 Security Bypass Vulnerability
3159| [98888] Apache Tomcat CVE-2017-5664 Security Bypass Vulnerability
3160| [98814] Apache Zookeeper CVE-2017-5637 Denial of Service Vulnerability
3161| [98795] Apache Hadoop CVE-2017-7669 Remote Privilege Escalation Vulnerability
3162| [98739] Apache Knox CVE-2017-5646 User Impersonation Vulnerability
3163| [98669] Apache Hive CVE-2016-3083 Security Bypass Vulnerability
3164| [98646] Apache Atlas CVE-2016-8752 Information Disclosure Vulnerability
3165| [98570] Apache Archiva CVE-2017-5657 Multiple Cross-Site Request Forgery Vulnerabilities
3166| [98489] Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities
3167| [98485] Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability
3168| [98466] Apache Ambari CVE-2017-5655 Insecure Temporary File Handling Vulnerability
3169| [98365] Apache Cordova For Android CVE-2016-6799 Information Disclosure Vulnerability
3170| [98025] Apache Hadoop CVE-2017-3161 Cross Site Scripting Vulnerability
3171| [98017] Apache Hadoop CVE-2017-3162 Input Validation Vulnerability
3172| [97971] Apache CXF CVE-2017-5656 Information Disclosure Vulnerability
3173| [97968] Apache CXF CVE-2017-5653 Spoofing Vulnerability
3174| [97967] Apache ActiveMQ CVE-2015-7559 Denial of Service Vulnerability
3175| [97949] Apache Traffic Server CVE-2017-5659 Denial of Service Vulnerability
3176| [97948] Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability
3177| [97947] Apache FOP CVE-2017-5661 XML External Entity Information Disclosure Vulnerability
3178| [97945] Apache Traffic Server CVE-2016-5396 Denial of Service Vulnerability
3179| [97702] Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability
3180| [97582] Apache CXF CVE-2016-6812 Cross Site Scripting Vulnerability
3181| [97579] Apache CXF JAX-RS CVE-2016-8739 XML External Entity Injection Vulnerability
3182| [97544] Apache Tomcat CVE-2017-5651 Information Disclosure Vulnerability
3183| [97531] Apache Tomcat CVE-2017-5650 Denial of Service Vulnerability
3184| [97530] Apache Tomcat CVE-2017-5648 Information Disclosure Vulnerability
3185| [97509] Apache Ignite CVE-2016-6805 Information Disclosure and XML External Entity Injection Vulnerabilities
3186| [97383] Apache Flex BlazeDS CVE-2017-5641 Remote Code Execution Vulnerability
3187| [97378] Apache Geode CVE-2017-5649 Information Disclosure Vulnerability
3188| [97229] Apache Ambari CVE-2016-4976 Local Information Disclosure Vulnerability
3189| [97226] Apache Camel CVE-2017-5643 Server Side Request Forgery Security Bypass Vulnerability
3190| [97184] Apache Ambari CVE-2016-6807 Remote Command Execution Vulnerability
3191| [97179] Apache Camel CVE-2016-8749 Java Deserialization Multiple Remote Code Execution Vulnerabilities
3192| [96983] Apache POI CVE-2017-5644 Denial Of Service Vulnerability
3193| [96895] Apache Tomcat CVE-2016-8747 Information Disclosure Vulnerability
3194| [96731] Apache NiFi CVE-2017-5636 Remote Code Injection Vulnerability
3195| [96730] Apache NiFi CVE-2017-5635 Security Bypass Vulnerability
3196| [96729] Apache Struts CVE-2017-5638 Remote Code Execution Vulnerability
3197| [96540] IBM Development Package for Apache Spark CVE-2016-4970 Denial of Service Vulnerability
3198| [96398] Apache CXF CVE-2017-3156 Information Disclosure Vulnerability
3199| [96321] Apache Camel CVE-2017-3159 Remote Code Execution Vulnerability
3200| [96293] Apache Tomcat 'http11/AbstractInputBuffer.java' Denial of Service Vulnerability
3201| [96228] Apache Brooklyn Cross Site Request Forgery and Multiple Cross Site Scripting Vulnerabilities
3202| [95998] Apache Ranger CVE-2016-8746 Security Bypass Vulnerability
3203| [95929] Apache Groovy CVE-2016-6497 Information Disclosure Vulnerability
3204| [95838] Apache Cordova For Android CVE-2017-3160 Man in the Middle Security Bypass Vulnerability
3205| [95675] Apache Struts Remote Code Execution Vulnerability
3206| [95621] Apache NiFi CVE-2106-8748 Cross Site Scripting Vulnerability
3207| [95429] Apache Groovy CVE-2016-6814 Remote Code Execution Vulnerability
3208| [95335] Apache Hadoop CVE-2016-3086 Information Disclosure Vulnerability
3209| [95168] Apache Wicket CVE-2016-6793 Denial of Service Vulnerability
3210| [95136] Apache Qpid Broker for Java CVE-2016-8741 Remote Information Disclosure Vulnerability
3211| [95078] Apache HTTP Server CVE-2016-0736 Remote Security Vulnerability
3212| [95077] Apache HTTP Server CVE-2016-8743 Security Bypass Vulnerability
3213| [95076] Apache HTTP Server CVE-2016-2161 Denial of Service Vulnerability
3214| [95020] Apache Tika CVE-2015-3271 Remote Information Disclosure Vulnerability
3215| [94950] Apache Hadoop CVE-2016-5001 Local Information Disclosure Vulnerability
3216| [94882] Apache ActiveMQ CVE-2016-6810 HTML Injection Vulnerability
3217| [94828] Apache Tomcat CVE-2016-8745 Information Disclosure Vulnerability
3218| [94766] Apache CouchDB CVE-2016-8742 Local Privilege Escalation Vulnerability
3219| [94657] Apache Struts CVE-2016-8738 Denial of Service Vulnerability
3220| [94650] Apache HTTP Server CVE-2016-8740 Denial of Service Vulnerability
3221| [94588] Apache Subversion CVE-2016-8734 XML External Entity Denial of Service Vulnerability
3222| [94513] Apache Karaf CVE-2016-8648 Remote Code Execution Vulnerability
3223| [94463] Apache Tomcat CVE-2016-8735 Remote Code Execution Vulnerability
3224| [94462] Apache Tomcat CVE-2016-6817 Denial of Service Vulnerability
3225| [94461] Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability
3226| [94418] Apache OpenOffice CVE-2016-6803 Local Privilege Escalation Vulnerability
3227| [94247] Apache Tika CVE-2016-6809 Remote Code Execution Vulnerability
3228| [94221] Apache Ranger CVE-2016-6815 Local Privilege Escalation Vulnerability
3229| [94145] Apache OpenMeetings CVE-2016-8736 Remote Code Execution Vulnerability
3230| [93945] Apache CloudStack CVE-2016-6813 Authorization Bypass Vulnerability
3231| [93944] Apache Tomcat Security Manager CVE-2016-6796 Security Bypass Vulnerability
3232| [93943] Apache Tomcat CVE-2016-6794 Security Bypass Vulnerability
3233| [93942] Apache Tomcat Security Manager CVE-2016-5018 Security Bypass Vulnerability
3234| [93940] Apache Tomcat CVE-2016-6797 Security Bypass Vulnerability
3235| [93939] Apache Tomcat CVE-2016-0762 Information Disclosure Vulnerability
3236| [93774] Apache OpenOffice CVE-2016-6804 DLL Loading Remote Code Execution Vulnerability
3237| [93773] Apache Struts CVE-2016-6795 Directory Traversal Vulnerability
3238| [93478] Apache Tomcat CVE-2016-6325 Local Privilege Escalation Vulnerability
3239| [93472] Apache Tomcat CVE-2016-5425 Insecure File Permissions Vulnerability
3240| [93429] Apache Tomcat JK Connector CVE-2016-6808 Remote Buffer Overflow Vulnerability
3241| [93263] Apache Tomcat CVE-2016-1240 Local Privilege Escalation Vulnerability
3242| [93236] Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability
3243| [93142] Apache ActiveMQ Artemis CVE-2016-4978 Remote Code Execution Vulnerability
3244| [93132] Apache Derby CVE-2015-1832 XML External Entity Information Disclosure Vulnerability
3245| [93044] Apache Zookeeper CVE-2016-5017 Buffer Overflow Vulnerability
3246| [92966] Apache Jackrabbit CVE-2016-6801 Cross-Site Request Forgery Vulnerability
3247| [92947] Apache Shiro CVE-2016-6802 Remote Security Bypass Vulnerability
3248| [92905] Apache CXF Fediz CVE-2016-4464 Security Bypass Vulnerability
3249| [92577] Apache Ranger CVE-2016-5395 HTML Injection Vulnerability
3250| [92331] Apache HTTP Server CVE-2016-1546 Remote Denial of Service Vulnerability
3251| [92328] Apache Hive CVE-2016-0760 Multiple Remote Code Execution Vulnerabilities
3252| [92320] Apache APR-util and httpd CVE-2016-6312 Denial of Service Vulnerability
3253| [92100] Apache POI CVE-2016-5000 XML External Entity Injection Vulnerability
3254| [92079] Apache OpenOffice CVE-2016-1513 Remote Code Execution Vulnerability
3255| [91818] Apache Tomcat CVE-2016-5388 Security Bypass Vulnerability
3256| [91816] Apache HTTP Server CVE-2016-5387 Security Bypass Vulnerability
3257| [91788] Apache Qpid Proton CVE-2016-4467 Certificate Verification Security Bypass Vulnerability
3258| [91738] Apache XML-RPC CVE-2016-5003 Remote Code Execution Vulnerability
3259| [91736] Apache XML-RPC Multiple Security Vulnerabilities
3260| [91707] Apache Archiva CVE-2016-5005 HTML Injection Vulnerability
3261| [91703] Apache Archiva CVE-2016-4469 Multiple Cross-Site Request Forgery Vulnerabilities
3262| [91566] Apache HTTP Server CVE-2016-4979 Authentication Bypass Vulnerability
3263| [91537] Apache QPID CVE-2016-4974 Deserialization Security Bypass Vulnerability
3264| [91501] Apache Xerces-C CVE-2016-4463 Stack Buffer Overflow Vulnerability
3265| [91453] Apache Commons FileUpload CVE-2016-3092 Denial Of Service Vulnerability
3266| [91284] Apache Struts CVE-2016-4431 Security Bypass Vulnerability
3267| [91282] Apache Struts CVE-2016-4433 Security Bypass Vulnerability
3268| [91281] Apache Struts CVE-2016-4430 Cross-Site Request Forgery Vulnerability
3269| [91280] Apache Struts CVE-2016-4436 Security Bypass Vulnerability
3270| [91278] Apache Struts CVE-2016-4465 Denial of Service Vulnerability
3271| [91277] Apache Struts Incomplete Fix Remote Code Execution Vulnerability
3272| [91275] Apache Struts CVE-2016-4438 Remote Code Execution Vulnerability
3273| [91217] Apache Continuum 'saveInstallation.action' Command Execution Vulnerability
3274| [91141] Apache CloudStack CVE-2016-3085 Authentication Bypass Vulnerability
3275| [91068] Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability
3276| [91067] Apache Struts CVE-2016-1182 Security Bypass Vulnerability
3277| [91024] Apache Shiro CVE-2016-4437 Information Disclosure Vulnerability
3278| [90988] Apache Ranger CVE-2016-2174 SQL Injection Vulnerability
3279| [90961] Apache Struts CVE-2016-3093 Denial of Service Vulnerability
3280| [90960] Apache Struts CVE-2016-3087 Remote Code Execution Vulnerability
3281| [90921] Apache Qpid CVE-2016-4432 Authentication Bypass Vulnerability
3282| [90920] Apache Qpid CVE-2016-3094 Denial of Service Vulnerability
3283| [90902] Apache PDFBox CVE-2016-2175 XML External Entity Injection Vulnerability
3284| [90897] Apache Tika CVE-2016-4434 XML External Entity Injection Vulnerability
3285| [90827] Apache ActiveMQ CVE-2016-3088 Multiple Arbitrary File Upload Vulnerabilities
3286| [90755] Apache Ambari CVE-2016-0707 Multiple Local Information Disclosure Vulnerabilities
3287| [90482] Apache CVE-2004-1387 Local Security Vulnerability
3288| [89762] Apache CVE-2001-1556 Remote Security Vulnerability
3289| [89417] Apache Subversion CVE-2016-2167 Authentication Bypass Vulnerability
3290| [89326] RETIRED: Apache Subversion CVE-2016-2167 Security Bypass Vulnerability
3291| [89320] Apache Subversion CVE-2016-2168 Remote Denial of Service Vulnerability
3292| [88826] Apache Struts CVE-2016-3082 Remote Code Execution Vulnerability
3293| [88797] Apache Cordova For iOS CVE-2015-5208 Arbitrary Code Execution Vulnerability
3294| [88764] Apache Cordova iOS CVE-2015-5207 Multiple Security Bypass Vulnerabilities
3295| [88701] Apache CVE-2001-1449 Remote Security Vulnerability
3296| [88635] Apache CVE-2000-1204 Remote Security Vulnerability
3297| [88590] Apache WWW server CVE-1999-1199 Denial-Of-Service Vulnerability
3298| [88496] Apache CVE-2000-1206 Remote Security Vulnerability
3299| [87828] Apache CVE-1999-1237 Remote Security Vulnerability
3300| [87784] Apache CVE-1999-1293 Denial-Of-Service Vulnerability
3301| [87327] Apache Struts CVE-2016-3081 Remote Code Execution Vulnerability
3302| [86622] Apache Stats CVE-2007-0975 Remote Security Vulnerability
3303| [86399] Apache CVE-2007-1743 Local Security Vulnerability
3304| [86397] Apache CVE-2007-1742 Local Security Vulnerability
3305| [86311] Apache Struts CVE-2016-4003 Cross Site Scripting Vulnerability
3306| [86174] Apache Wicket CVE-2015-5347 Cross Site Scripting Vulnerability
3307| [85971] Apache OFBiz CVE-2016-2170 Java Deserialization Remote Code Execution Vulnerability
3308| [85967] Apache OFBiz CVE-2015-3268 HTML Injection Vulnerability
3309| [85759] Apache Jetspeed CVE-2016-2171 Unauthorized Access Vulnerability
3310| [85758] Apache Jetspeed CVE-2016-0712 Cross Site Scripting Vulnerability
3311| [85756] Apache Jetspeed CVE-2016-0710 Multiple SQL Injection Vulnerabilities
3312| [85755] Apache Jetspeed CVE-2016-0711 Mulitple HTML Injection Vulnerabilities
3313| [85754] Apache Jetspeed CVE-2016-0709 Directory Traversal Vulnerability
3314| [85730] Apache Subversion CVE-2015-5343 Integer Overflow Vulnerability
3315| [85691] Apache Ranger CVE-2016-0735 Security Bypass Vulnerability
3316| [85578] Apache ActiveMQ CVE-2010-1244 Cross-Site Request Forgery Vulnerability
3317| [85554] Apache OpenMeetings CVE-2016-2164 Multiple Information Disclosure Vulnerabilities
3318| [85553] Apache OpenMeetings CVE-2016-0783 Information Disclosure Vulnerability
3319| [85552] Apache OpenMeetings CVE-2016-2163 HTML Injection Vulnerability
3320| [85550] Apache OpenMeetings CVE-2016-0784 Directory Traversal Vulnerability
3321| [85386] Apache Hadoop CVE-2015-7430 Local Privilege Escalation Vulnerability
3322| [85377] Apache Qpid Proton Python API CVE-2016-2166 Man in the Middle Security Bypass Vulnerability
3323| [85205] Apache Solr CVE-2015-8796 Cross Site Scripting Vulnerability
3324| [85203] Apache Solr CVE-2015-8795 Mulitple HTML Injection Vulnerabilities
3325| [85163] Apache Geronimo CVE-2008-0732 Local Security Vulnerability
3326| [85131] Apache Struts 'TextParseUtil.translateVariables()' Method Remote Code Execution Vulnerability
3327| [85070] Apache Struts CVE-2016-2162 Cross Site Scripting Vulnerability
3328| [85066] Apache Struts CVE-2016-0785 Remote Code Execution Vulnerability
3329| [84422] Apache TomEE CVE-2016-0779 Unspecified Security Vulnerability
3330| [84321] Apache ActiveMQ CVE-2016-0734 Clickjacking Vulnerability
3331| [84316] Apache ActiveMQ CVE-2016-0782 Multiple Cross Site Scripting Vulnerabilities
3332| [83910] Apache Wicket CVE-2015-7520 Cross Site Scripting Vulnerability
3333| [83423] Apache Xerces-C CVE-2016-0729 Buffer Overflow Vulnerability
3334| [83330] Apache Tomcat CVE-2015-5351 Cross Site Request Forgery Vulnerability
3335| [83329] Apache Tomcat CVE-2015-5174 Directory Traversal Vulnerability
3336| [83328] Apache Tomcat CVE-2015-5345 Directory Traversal Vulnerability
3337| [83327] Apache Tomcat Security Manager CVE-2016-0714 Remote Code Execution Vulnerability
3338| [83326] Apache Tomcat CVE-2016-0763 Security Bypass Vulnerability
3339| [83324] Apache Tomcat Security Manager CVE-2016-0706 Information Disclosure Vulnerability
3340| [83323] Apache Tomcat CVE-2015-5346 Session Fixation Vulnerability
3341| [83259] Apache Hadoop CVE-2015-1776 Information Disclosure Vulnerability
3342| [83243] Apache Solr CVE-2015-8797 Cross Site Scripting Vulnerability
3343| [83119] Apache Sling CVE-2016-0956 Information Disclosure Vulnerability
3344| [83002] Apache CVE-2000-1205 Cross-Site Scripting Vulnerability
3345| [82871] Apache Ranger Authentication Bypass and Security Bypass Vulnerabilities
3346| [82800] Apache CloudStack CVE-2015-3251 Information Disclosure Vulnerability
3347| [82798] Apache CloudStack CVE-2015-3252 Authentication Bypass Vulnerability
3348| [82732] Apache Gallery CVE-2003-0771 Local Security Vulnerability
3349| [82676] Apache CVE-2003-1581 Cross-Site Scripting Vulnerability
3350| [82550] Apache Struts CVE-2015-5209 Security Bypass Vulnerability
3351| [82300] Apache Subversion CVE-2015-5259 Integer Overflow Vulnerability
3352| [82260] Apache Camel CVE-2015-5344 Remote Code Execution Vulnerability
3353| [82234] Apache Hive CVE-2015-7521 Security Bypass Vulnerability
3354| [82082] Apache CVE-1999-0289 Remote Security Vulnerability
3355| [81821] Apache Distribution for Solaris CVE-2007-2080 SQL-Injection Vulnerability
3356| [80696] Apache Camel CVE-2015-5348 Information Disclosure Vulnerability
3357| [80525] Apache CVE-2003-1580 Remote Security Vulnerability
3358| [80354] Drupal Apache Solr Search Module Access Bypass Vulnerability
3359| [80193] Apache CVE-1999-0107 Denial-Of-Service Vulnerability
3360| [79812] Apache Directory Studio CVE-2015-5349 Command Injection Vulnerability
3361| [79744] Apache HBase CVE-2015-1836 Unauthorized Access Vulnerability
3362| [79204] Apache TomEE 'EjbObjectInputStream' Remote Code Execution Vulnerability
3363| [77679] Apache Cordova For Android CVE-2015-8320 Weak Randomization Security Bypass Vulnerability
3364| [77677] Apache Cordova For Android CVE-2015-5256 Security Bypass Vulnerability
3365| [77591] Apache CXF SAML SSO Processing CVE-2015-5253 Security Bypass Vulnerability
3366| [77521] Apache Commons Collections 'InvokerTransformer.java' Remote Code Execution Vulnerability
3367| [77110] Apache HttpComponents HttpClient CVE-2015-5262 Denial of Service Vulnerability
3368| [77086] Apache Ambari CVE-2015-1775 Server Side Request Forgery Security Bypass Vulnerability
3369| [77085] Apache Ambari CVE-2015-3270 Remote Privilege Escalation Vulnerability
3370| [77082] Apache Ambari 'targetURI' Parameter Open Redirection Vulnerability
3371| [77059] Apache Ambari CVE-2015-3186 Cross Site Scripting Vulnerability
3372| [76933] Apache James Server Unspecified Command Execution Vulnerability
3373| [76832] Apache cordova-plugin-file-transfer CVE-2015-5204 HTTP Header Injection Vulnerability
3374| [76625] Apache Struts CVE-2015-5169 Cross Site Scripting Vulnerability
3375| [76624] Apache Struts CVE-2015-2992 Cross Site Scripting Vulnerability
3376| [76522] Apache Tapestry CVE-2014-1972 Security Bypass Vulnerability
3377| [76486] Apache CXF Fediz CVE-2015-5175 Denial of Service Vulnerability
3378| [76452] Apache ActiveMQ CVE-2015-1830 Directory Traversal Vulnerability
3379| [76446] Apache Subversion 'libsvn_fs_fs/tree.c' Denial of Service Vulnerability
3380| [76274] Apache Subversion CVE-2015-3184 Information Disclosure Vulnerability
3381| [76273] Apache Subversion CVE-2015-3187 Information Disclosure Vulnerability
3382| [76272] Apache ActiveMQ CVE-2014-3576 Denial of Service Vulnerability
3383| [76221] Apache Ranger CVE-2015-0266 Access Bypass Vulnerability
3384| [76208] Apache Ranger CVE-2015-0265 JavaScript Code Injection Vulnerability
3385| [76025] Apache ActiveMQ Artemis CVE-2015-3208 XML External Entity Information Disclosure Vulnerability
3386| [75965] Apache HTTP Server CVE-2015-3185 Security Bypass Vulnerability
3387| [75964] Apache HTTP Server CVE-2015-0253 Remote Denial of Service Vulnerability
3388| [75963] Apache HTTP Server CVE-2015-3183 Security Vulnerability
3389| [75940] Apache Struts CVE-2015-1831 Security Bypass Vulnerability
3390| [75919] Apache Groovy CVE-2015-3253 Remote Code Execution Vulnerability
3391| [75338] Apache Storm CVE-2015-3188 Remote Code Execution Vulnerability
3392| [75275] Drupal Apache Solr Real-Time Module Access Bypass Vulnerability
3393| [74866] Apache Cordova For Android CVE-2015-1835 Security Bypass Vulnerability
3394| [74839] Apache Sling API and Sling Servlets CVE-2015-2944 Cross Site Scripting Vulnerability
3395| [74761] Apache Jackrabbit CVE-2015-1833 XML External Entity Information Disclosure Vulnerability
3396| [74686] Apache Ambari '/var/lib/ambari-server/ambari-env.sh' Local Privilege Escalation Vulnerability
3397| [74665] Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability
3398| [74475] Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability
3399| [74423] Apache Struts CVE-2015-0899 Security Bypass Vulnerability
3400| [74338] Apache OpenOffice HWP Filter Memory Corruption Vulnerability
3401| [74265] Apache Tomcat 'mod_jk' CVE-2014-8111 Information Disclosure Vulnerability
3402| [74260] Apache Subversion CVE-2015-0248 Multiple Denial of Service Vulnerabilities
3403| [74259] Apache Subversion 'deadprops.c' Security Bypass Vulnerability
3404| [74204] PHP 'sapi/apache2handler/sapi_apache2.c' Remote Code Execution Vulnerability
3405| [74158] Apache HTTP Server 'protocol.c' Remote Denial of Service Vulnerability
3406| [73954] Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability
3407| [73851] Apache2 CVE-2012-0216 Cross-Site Scripting Vulnerability
3408| [73478] Apache Cassandra CVE-2015-0225 Remote Code Execution Vulnerability
3409| [73041] Apache HTTP Server 'mod_lua' Module Denial of Service Vulnerability
3410| [73040] Apache HTTP Server 'mod_lua.c' Local Access Bypass Vulnerability
3411| [72809] Apache Standard Taglibs CVE-2015-0254 XML External Entity Injection Vulnerability
3412| [72717] Apache Tomcat CVE-2014-0227 Chunk Request Remote Denial Of Service Vulnerability
3413| [72557] Apache WSS4J CVE-2015-0227 Security Bypass Vulnerability
3414| [72553] Apache WSS4J CVE-2015-0226 Information Disclosure Vulnerability
3415| [72513] Apache ActiveMQ CVE-2014-3612 LDAP Authentication Bypass Vulnerability
3416| [72511] Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities
3417| [72510] Apache ActiveMQ CVE-2014-3600 XML External Entity Injection Vulnerability
3418| [72508] Apache ActiveMQ Apollo CVE-2014-3579 XML External Entity Injection Vulnerability
3419| [72319] Apache Qpid CVE-2015-0223 Security Bypass Vulnerability
3420| [72317] Apache Qpid CVE-2015-0224 Incomplete Fix Multiple Denial of Service Vulnerabilities
3421| [72115] Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability
3422| [72053] Apache HTTP Server 'mod_remoteip.c' IP Address Spoofing Vulnerability
3423| [72030] Apache Qpid CVE-2015-0203 Multiple Denial of Service Vulnerabilities
3424| [71879] Apache Traffic Server 'HttpTransact.cc' Denial of Service Vulnerability
3425| [71726] Apache Subversion CVE-2014-3580 Remote Denial of Service Vulnerability
3426| [71725] Apache Subversion CVE-2014-8108 Remote Denial of Service Vulnerability
3427| [71657] Apache HTTP Server 'mod_proxy_fcgi' Module Denial of Service Vulnerability
3428| [71656] Apache HTTP Server 'mod_cache' Module Denial of Service Vulnerability
3429| [71548] Apache Struts CVE-2014-7809 Security Bypass Vulnerability
3430| [71466] Apache Hadoop CVE-2014-3627 Information Disclosure Vulnerability
3431| [71353] Apache HTTP Server 'LuaAuthzProvider' Authorization Bypass Vulnerability
3432| [71004] Apache Qpid CVE-2014-3629 XML External Entity Injection Vulnerability
3433| [70970] Apache Traffic Server Cross Site Scripting Vulnerability
3434| [70738] Apache CXF CVE-2014-3584 Denial of Service Vulnerability
3435| [70736] Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
3436| [69728] Apache Tomcat CVE-2013-4444 Arbitrary File Upload Vulnerability
3437| [69648] Apache POI CVE-2014-3574 Denial Of Service Vulnerability
3438| [69647] Apache POI OpenXML parser CVE-2014-3529 XML External Entity Information Disclosure Vulnerability
3439| [69351] Apache OpenOffice Calc CVE-2014-3524 Command Injection Vulnerability
3440| [69295] Apache Axis Incomplete Fix CVE-2014-3596 SSL Certificate Validation Security Bypass Vulnerability
3441| [69286] Apache OFBiz CVE-2014-0232 Multiple Cross Site Scripting Vulnerabilities
3442| [69258] Apache HttpComponents Incomplete Fix CVE-2014-3577 SSL Validation Security Bypass Vulnerability
3443| [69257] Apache HttpComponents Incomplete Fix SSL Certificate Validation Security Bypass Vulnerability
3444| [69248] Apache HTTP Server CVE-2013-4352 Remote Denial of Service Vulnerability
3445| [69237] Apache Subversion CVE-2014-3522 SSL Certificate Validation Information Disclosure Vulnerability
3446| [69173] Apache Traffic Server CVE-2014-3525 Unspecified Security Vulnerability
3447| [69046] Apache Cordova For Android CVE-2014-3502 Information Disclosure Vulnerability
3448| [69041] Apache Cordova For Android CVE-2014-3501 Security Bypass Vulnerability
3449| [69038] Apache Cordova For Android CVE-2014-3500 Security Bypass Vulnerability
3450| [68995] Apache Subversion CVE-2014-3528 Insecure Authentication Weakness
3451| [68966] Apache Subversion 'irkerbridge.py' Local Privilege Escalation Vulnerability
3452| [68965] Apache Subversion 'svnwcsub.py' Local Privilege Escalation Vulnerability
3453| [68863] Apache HTTP Server 'mod_cache' Module Remote Denial of Service Vulnerability
3454| [68747] Apache HTTP Server CVE-2014-3523 Remote Denial of Service Vulnerability
3455| [68745] Apache HTTP Server CVE-2014-0118 Remote Denial of Service Vulnerability
3456| [68742] Apache HTTP Server CVE-2014-0231 Remote Denial of Service Vulnerability
3457| [68740] Apache HTTP Server CVE-2014-0117 Remote Denial of Service Vulnerability
3458| [68678] Apache HTTP Server 'mod_status' CVE-2014-0226 Remote Code Execution Vulnerability
3459| [68445] Apache CXF UsernameToken Information Disclosure Vulnerability
3460| [68441] Apache CXF SAML Tokens Validation Security Bypass Vulnerability
3461| [68431] Apache Syncope CVE-2014-3503 Insecure Password Generation Weakness
3462| [68229] Apache Harmony PRNG Entropy Weakness
3463| [68111] Apache 'mod_wsgi' Module Privilege Escalation Vulnerability
3464| [68072] Apache Tomcat CVE-2014-0186 Remote Denial of Service Vulnerability
3465| [68039] Apache Hive CVE-2014-0228 Security Bypass Vulnerability
3466| [67673] Apache Tomcat CVE-2014-0095 AJP Request Remote Denial Of Service Vulnerability
3467| [67671] Apache Tomcat CVE-2014-0075 Chunk Request Remote Denial Of Service Vulnerability
3468| [67669] Apache Tomcat CVE-2014-0119 XML External Entity Information Disclosure Vulnerability
3469| [67668] Apache Tomcat CVE-2014-0099 Request Processing Information Disclosure Vulnerability
3470| [67667] Apache Tomcat CVE-2014-0096 XML External Entity Information Disclosure Vulnerability
3471| [67534] Apache 'mod_wsgi' Module CVE-2014-0242 Information Disclosure Vulnerability
3472| [67532] Apache 'mod_wsgi' Module Local Privilege Escalation Vulnerability
3473| [67530] Apache Solr Search Template Cross Site Scripting Vulnerability
3474| [67236] Apache CXF CVE-2014-0109 Remote Denial of Service Vulnerability
3475| [67232] Apache CXF CVE-2014-0110 Denial of Service Vulnerability
3476| [67121] Apache Struts ClassLoader Manipulation CVE-2014-0114 Security Bypass Vulnerability
3477| [67081] Apache Struts 'getClass()' Method Security Bypass Vulnerability
3478| [67064] Apache Struts ClassLoader Manipulation Incomplete Fix Security Bypass Vulnerability
3479| [67013] Apache Zookeeper CVE-2014-0085 Local Information Disclosure Vulnerability
3480| [66998] Apache Archiva CVE-2013-2187 Unspecified Cross Site Scripting Vulnerability
3481| [66991] Apache Archiva CVE-2013-2187 HTML Injection Vulnerability
3482| [66927] Apache Syncope CVE-2014-0111 Remote Code Execution Vulnerability
3483| [66474] Apache CouchDB Universally Unique IDentifier (UUID) Remote Denial of Service Vulnerability
3484| [66397] Apache Xalan-Java Library CVE-2014-0107 Security Bypass Vulnerability
3485| [66303] Apache HTTP Server Multiple Denial of Service Vulnerabilities
3486| [66041] RETIRED: Apache Struts CVE-2014-0094 Classloader Manipulation Security Bypass Vulnerability
3487| [65999] Apache Struts ClassLoader Manipulation CVE-2014-0094 Security Bypass Vulnerability
3488| [65967] Apache Cordova File-Transfer Unspecified Security Vulnerability
3489| [65959] Apache Cordova InAppBrowser Remote Privilege Escalation Vulnerability
3490| [65935] Apache Shiro 'login.jsp' Authentication Bypass Vulnerability
3491| [65902] Apache Camel CVE-2014-0003 Remote Code Execution Vulnerability
3492| [65901] Apache Camel CVE-2014-0002 XML External Entity Information Disclosure Vulnerability
3493| [65773] Apache Tomcat CVE-2013-4286 Security Bypass Vulnerability
3494| [65769] Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability
3495| [65768] Apache Tomcat CVE-2013-4590 XML External Entity Information Disclosure Vulnerability
3496| [65767] Apache Tomcat CVE-2013-4322 Incomplete Fix Denial of Service Vulnerability
3497| [65615] Apache ActiveMQ 'refresh' Parameter Cross Site Scripting Vulnerability
3498| [65434] Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability
3499| [65431] Apache Wicket CVE-2013-2055 Information Disclosure Vulnerability
3500| [65400] Apache Commons FileUpload CVE-2014-0050 Denial Of Service Vulnerability
3501| [64782] Apache CloudStack Virtual Router Component Security Bypass Vulnerability
3502| [64780] Apache CloudStack Unauthorized Access Vulnerability
3503| [64617] Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
3504| [64437] Apache Santuario XML Security For JAVA XML Signature Denial of Service Vulnerability
3505| [64427] Apache Solr Multiple XML External Entity Injection Vulnerabilities
3506| [64009] Apache Solr CVE-2013-6408 XML External Entity Injection Vulnerability
3507| [64008] Apache Solr CVE-2013-6407 XML External Entity Injection Vulnerability
3508| [63981] Apache Subversion 'mod_dav_svn' Module Denial of Service Vulnerability
3509| [63966] Apache Subversion CVE-2013-4505 Security Bypass Vulnerability
3510| [63963] Apache Roller CVE-2013-4171 Cross Site Scripting Vulnerability
3511| [63935] Apache Solr 'SolrResourceLoader' Directory Traversal Vulnerability
3512| [63928] Apache Roller CVE-2013-4212 OGNL Expression Injection Remote Code Execution Vulnerability
3513| [63515] Apache Tomcat Manager Component CVE-2013-6357 Cross Site Request Forgery Vulnerability
3514| [63403] Apache Struts Multiple Cross Site Scripting Vulnerabilities
3515| [63400] Apache 'mod_pagespeed' Module Unspecified Cross Site Scripting Vulnerability
3516| [63260] Apache Shindig CVE-2013-4295 XML External Entity Information Disclosure Vulnerability
3517| [63241] Apache Sling 'AbstractAuthenticationFormServlet' Open Redirection Vulnerability
3518| [63174] Apache Commons FileUpload 'DiskFileItem' Class Null Byte Arbitrary File Write Vulnerability
3519| [62939] Apache 'mod_fcgid' Module CVE-2013-4365 Heap Buffer Overflow Vulnerability
3520| [62903] Apache Sling 'deepGetOrCreateNode()' Function Denial Of Service Vulnerability
3521| [62706] Apache Camel CVE-2013-4330 Information Disclosure Vulnerability
3522| [62677] Apache 'mod_accounting' Module CVE-2013-5697 SQL Injection Vulnerability
3523| [62674] TYPO3 Apache Solr Unspecified Cross Site Scripting and PHP Code Execution Vulnerabilities
3524| [62587] Apache Struts CVE-2013-4316 Remote Code Execution Vulnerability
3525| [62584] Apache Struts CVE-2013-4310 Security Bypass Vulnerability
3526| [62266] Apache Subversion CVE-2013-4277 Insecure Temporary File Creation Vulnerability
3527| [61984] Apache Hadoop RPC Authentication CVE-2013-2192 Man in the Middle Security Bypass Vulnerability
3528| [61981] Apache HBase RPC Authentication Man In The Middle Security Bypass Vulnerability
3529| [61638] Apache CloudStack CVE-2013-2136 Multiple Cross Site Scripting Vulnerabilities
3530| [61454] Apache Subversion CVE-2013-4131 Denial Of Service Vulnerability
3531| [61379] Apache HTTP Server CVE-2013-2249 Unspecified Remote Security Vulnerability
3532| [61370] Apache OFBiz CVE-2013-2317 'View Log' Cross Site Scripting Vulnerability
3533| [61369] Apache OFBiz Nested Expression Remote Code Execution Vulnerability
3534| [61196] Apache Struts CVE-2013-2248 Multiple Open Redirection Vulnerabilities
3535| [61189] Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities
3536| [61129] Apache HTTP Server CVE-2013-1896 Remote Denial of Service Vulnerability
3537| [61030] Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities
3538| [60875] Apache Geronimo RMI Classloader Security Bypass Vulnerability
3539| [60846] Apache Santuario XML Security for JAVA XML Signature CVE-2013-2172 Security Bypass Vulnerability
3540| [60817] Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability
3541| [60800] Apache Qpid Python Client SSL Certificate Verification Information Disclosure Vulnerability
3542| [60599] Apache Santuario XML Security for C++ CVE-2013-2156 Remote Heap Buffer Overflow Vulnerability
3543| [60595] Apache Santuario XML Security for C++ XML Signature CVE-2013-2155 Denial of Service Vulnerability
3544| [60594] Apache Santuario XML Security for C++ CVE-2013-2154 Stack Buffer Overflow Vulnerability
3545| [60592] Apache Santuario XML Security for C++ XML Signature CVE-2013-2153 Security Bypass Vulnerability
3546| [60534] Apache OpenJPA Object Deserialization Arbitrary File Creation or Overwrite Vulnerability
3547| [60346] Apache Struts CVE-2013-2134 OGNL Expression Injection Vulnerability
3548| [60345] Apache Struts CVE-2013-2135 OGNL Expression Injection Vulnerability
3549| [60267] Apache Subversion CVE-2013-1968 Remote Denial of Service Vulnerability
3550| [60265] Apache Subversion CVE-2013-2088 Command Injection Vulnerability
3551| [60264] Apache Subversion CVE-2013-2112 Remote Denial of Service Vulnerability
3552| [60187] Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness
3553| [60186] Apache Tomcat CVE-2013-1976 Insecure Temporary File Handling Vulnerability
3554| [60167] Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability
3555| [60166] Apache Struts 'includeParams' CVE-2013-1966 Security Bypass Vulnerability
3556| [60082] Apache Struts 'ParameterInterceptor' Class OGNL CVE-2013-1965 Security Bypass Vulnerability
3557| [59826] Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability
3558| [59799] Apache Tomcat CVE-2013-2067 Session Fixation Vulnerability
3559| [59798] Apache Tomcat CVE-2013-2071 Information Disclosure Vulnerability
3560| [59797] Apache Tomcat CVE-2012-3544 Denial of Service Vulnerability
3561| [59670] Apache VCL Multiple Input Validation Vulnerabilities
3562| [59464] Apache CloudStack CVE-2013-2758 Hash Information Disclosure Vulnerability
3563| [59463] Apache CloudStack CVE-2013-2756 Authentication Bypass Vulnerability
3564| [59402] Apache ActiveMQ CVE-2013-3060 Information Disclosure and Denial of Service Vulnerability
3565| [59401] Apache ActiveMQ CVE-2012-6551 Denial of Service Vulnerability
3566| [59400] Apache ActiveMQ CVE-2012-6092 Multiple Cross Site Scripting Vulnerabilities
3567| [58898] Apache Subversion CVE-2013-1884 Remote Denial of Service Vulnerability
3568| [58897] Apache Subversion 'mod_dav_svn/lock.c' Remote Denial of Service Vulnerability
3569| [58895] Apache Subversion 'mod_dav_svn' Remote Denial of Service Vulnerability
3570| [58455] Apache Rave User RPC API CVE-2013-1814 Information Disclosure Vulnerability
3571| [58379] Apache Qpid CVE-2012-4446 Authentication Bypass Vulnerability
3572| [58378] Apache Qpid CVE-2012-4460 Denial of Service Vulnerability
3573| [58376] Apache Qpid CVE-2012-4458 Denial of Service Vulnerability
3574| [58337] Apache Qpid CVE-2012-4459 Denial of Service Vulnerability
3575| [58326] Apache Commons FileUpload CVE-2013-0248 Insecure Temporary File Creation Vulnerability
3576| [58325] Debian Apache HTTP Server CVE-2013-1048 Symlink Attack Local Privilege Escalation Vulnerability
3577| [58323] Apache Subversion 'svn_fs_file_length()' Remote Denial of Service Vulnerability
3578| [58165] Apache HTTP Server Multiple Cross Site Scripting Vulnerabilities
3579| [58136] Apache Maven CVE-2013-0253 SSL Certificate Validation Security Bypass Vulnerability
3580| [58124] Apache Tomcat 'log/logdir' Directory Insecure File Permissions Vulnerability
3581| [58073] Apache Commons HttpClient CVE-2012-5783 SSL Certificate Validation Security Bypass Vulnerability
3582| [57876] Apache CXF WS-SecurityPolicy Authentication Bypass Vulnerability
3583| [57874] Apache CXF CVE-2012-5633 Security Bypass Vulnerability
3584| [57463] Apache OFBiz CVE-2013-0177 Multiple Cross Site Scripting Vulnerabilities
3585| [57425] Apache CXF CVE-2012-5786 SSL Certificate Validation Security Bypass Vulnerability
3586| [57321] Apache CouchDB CVE-2012-5650 Cross Site Scripting Vulnerability
3587| [57314] Apache CouchDB CVE-2012-5649 Remote Code Execution Vulnerability
3588| [57267] Apache Axis2/C SSL Certificate Validation Security Bypass Vulnerability
3589| [57259] Apache CloudStack CVE-2012-5616 Local Information Disclosure Vulnerability
3590| [56814] Apache Tomcat CVE-2012-4431 Cross-Site Request Forgery Vulnerability
3591| [56813] Apache Tomcat CVE-2012-4534 Denial of Service Vulnerability
3592| [56812] Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability
3593| [56753] Apache Apache HTTP Server 'mod_proxy_ajp Module Denial Of Service Vulnerability
3594| [56686] Apache Tomcat CVE-2012-5568 Denial of Service Vulnerability
3595| [56408] Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability
3596| [56403] Apache Tomcat DIGEST Authentication Multiple Security Weaknesses
3597| [56402] Apache Tomcat CVE-2012-2733 Denial of Service Vulnerability
3598| [56171] Apache OFBiz CVE-2012-3506 Unspecified Security Vulnerability
3599| [55876] Apache CloudStack CVE-2012-4501 Security Bypass Vulnerability
3600| [55628] Apache CXF SOAP Action Spoofing Security Bypass Vulnerability
3601| [55608] Apache Qpid (qpidd) Denial of Service Vulnerability
3602| [55536] Apache 'mod_pagespeed' Module Cross Site Scripting and Security Bypass Vulnerabilities
3603| [55508] Apache Axis2 XML Signature Wrapping Security Vulnerability
3604| [55445] Apache Wicket CVE-2012-3373 Cross Site Scripting Vulnerability
3605| [55346] Apache Struts Cross Site Request Forgery and Denial of Service Vulnerabilities
3606| [55290] Drupal Apache Solr Autocomplete Module Cross Site Scripting Vulnerability
3607| [55165] Apache Struts2 Skill Name Remote Code Execution Vulnerability
3608| [55154] Apache 'mod-rpaf' Module Denial of Service Vulnerability
3609| [55131] Apache HTTP Server HTML-Injection And Information Disclosure Vulnerabilities
3610| [54954] Apache QPID NullAuthenticator Authentication Bypass Vulnerability
3611| [54798] Apache Libcloud Man In The Middle Vulnerability
3612| [54358] Apache Hadoop CVE-2012-3376 Information Disclosure Vulnerability
3613| [54341] Apache Sling CVE-2012-2138 Denial Of Service Vulnerability
3614| [54268] Apache Hadoop Symlink Attack Local Privilege Escalation Vulnerability
3615| [54189] Apache Roller Cross Site Request Forgery Vulnerability
3616| [54187] Apache Roller CVE-2012-2381 Cross Site Scripting Vulnerability
3617| [53880] Apache CXF Child Policies Security Bypass Vulnerability
3618| [53877] Apache CXF Elements Validation Security Bypass Vulnerability
3619| [53676] Apache Commons Compress and Apache Ant CVE-2012-2098 Denial Of Service Vulnerability
3620| [53487] Apache POI CVE-2012-0213 Denial Of Service Vulnerability
3621| [53455] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability
3622| [53305] Apache Qpid CVE-2011-3620 Unauthorized Access Security Bypass Vulnerability
3623| [53046] Apache HTTP Server 'LD_LIBRARY_PATH' Insecure Library Loading Arbitrary Code Execution Vulnerability
3624| [53025] Apache OFBiz Unspecified Remote Code Execution Vulnerability
3625| [53023] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
3626| [52939] Apache Hadoop CVE-2012-1574 Unspecified User Impersonation Vulnerability
3627| [52702] Apache Struts2 'XSLTResult.java' Remote Arbitrary File Upload Vulnerability
3628| [52696] Apache Traffic Server HTTP Host Header Handling Heap Based Buffer Overflow Vulnerability
3629| [52680] Apache Wicket 'pageMapName' Parameter Cross Site Scripting Vulnerability
3630| [52679] Apache Wicket Hidden Files Information Disclosure Vulnerability
3631| [52565] Apache 'mod_fcgid' Module Denial Of Service Vulnerability
3632| [52146] TYPO3 Apache Solr Extension Unspecified Cross Site Scripting Vulnerability
3633| [51939] Apache MyFaces 'ln' Parameter Information Disclosure Vulnerability
3634| [51917] Apache APR Hash Collision Denial Of Service Vulnerability
3635| [51902] Apache Struts Multiple HTML Injection Vulnerabilities
3636| [51900] Apache Struts CVE-2012-1007 Multiple Cross Site Scripting Vulnerabilities
3637| [51886] Apache CXF UsernameToken Policy Validation Security Bypass Vulnerability
3638| [51869] Apache HTTP Server CVE-2011-3639 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
3639| [51706] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
3640| [51705] Apache HTTP Server CVE-2012-0021 mod_log_config Denial Of Service Vulnerability
3641| [51628] Apache Struts 'ParameterInterceptor' Class OGNL (CVE-2011-3923) Security Bypass Vulnerability
3642| [51447] Apache Tomcat Parameter Handling Denial of Service Vulnerability
3643| [51442] Apache Tomcat Request Object Security Bypass Vulnerability
3644| [51407] Apache HTTP Server Scoreboard Local Security Bypass Vulnerability
3645| [51257] Apache Struts Remote Command Execution and Arbitrary File Overwrite Vulnerabilities
3646| [51238] Apache Geronimo Hash Collision Denial Of Service Vulnerability
3647| [51200] Apache Tomcat Hash Collision Denial Of Service Vulnerability
3648| [50940] Apache Struts Session Tampering Security Bypass Vulnerability
3649| [50912] RETIRED: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability
3650| [50904] Apache ActiveMQ Failover Mechanism Remote Denial Of Service Vulnerability
3651| [50848] Apache MyFaces EL Expression Evaluation Security Bypass Vulnerability
3652| [50802] Apache HTTP Server 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
3653| [50639] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
3654| [50603] Apache Tomcat Manager Application Security Bypass Vulnerability
3655| [50494] Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
3656| [49957] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
3657| [49762] Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses
3658| [49728] Apache Struts Conversion Error OGNL Expression Evaluation Vulnerability
3659| [49616] Apache HTTP Server CVE-2011-3348 Denial Of Service Vulnerability
3660| [49470] Apache Tomcat CVE-2007-6286 Duplicate Request Processing Security Vulnerability
3661| [49353] Apache Tomcat AJP Protocol Security Bypass Vulnerability
3662| [49303] Apache HTTP Server CVE-2011-3192 Denial Of Service Vulnerability
3663| [49290] Apache Wicket Cross Site Scripting Vulnerability
3664| [49147] Apache Tomcat CVE-2011-2481 Information Disclosure Vulnerability
3665| [49143] Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability
3666| [48667] Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
3667| [48653] Apache 'mod_authnz_external' Module SQL Injection Vulnerability
3668| [48611] Apache XML Security for C++ Signature Key Parsing Denial of Service Vulnerability
3669| [48456] Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability
3670| [48015] Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities
3671| [48011] Apache Archiva Multiple Cross Site Scripting and HTML Injection Vulnerabilities
3672| [47929] Apache APR 'apr_fnmatch.c' Denial of Service Vulnerability
3673| [47890] Apache Struts 'javatemplates' Plugin Multiple Cross Site Scripting Vulnerabilities
3674| [47886] Apache Tomcat SecurityConstraints Security Bypass Vulnerability
3675| [47820] Apache APR 'apr_fnmatch()' Denial of Service Vulnerability
3676| [47784] Apache Struts XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability
3677| [47199] Apache Tomcat HTTP BIO Connector Information Disclosure Vulnerability
3678| [47196] Apache Tomcat Login Constraints Security Bypass Vulnerability
3679| [46974] Apache HttpComponents 'HttpClient' Information Disclosure Vulnerability
3680| [46953] Apache MPM-ITK Module Security Weakness
3681| [46734] Subversion 'mod_dav_svn' Apache Server NULL Pointer Dereference Denial Of Service Vulnerability
3682| [46685] Apache Tomcat '@ServletSecurity' Annotations Security Bypass Vulnerability
3683| [46311] Apache Continuum and Archiva Cross Site Scripting Vulnerability
3684| [46177] Apache Tomcat SecurityManager Security Bypass Vulnerability
3685| [46174] Apache Tomcat HTML Manager Interface HTML Injection Vulnerability
3686| [46166] Apache Tomcat JVM Denial of Service Vulnerability
3687| [46164] Apache Tomcat NIO Connector Denial of Service Vulnerability
3688| [46066] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
3689| [45655] Apache Subversion Server Component Multiple Remote Denial Of Service Vulnerabilities
3690| [45123] Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
3691| [45095] Apache Archiva Cross Site Request Forgery Vulnerability
3692| [45015] Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities
3693| [44900] Apache 'mod_fcgid' Module Unspecified Stack Buffer Overflow Vulnerability
3694| [44616] Apache Shiro Directory Traversal Vulnerability
3695| [44355] Apache MyFaces Encrypted View State Oracle Padding Security Vulnerability
3696| [44068] Apache::AuthenHook Local Information Disclosure Vulnerability
3697| [43862] Apache QPID SSL Connection Denial of Service Vulnerability
3698| [43673] Apache APR-util 'apr_brigade_split_line()' Denial of Service Vulnerability
3699| [43637] Apache XML-RPC SAX Parser Information Disclosure Vulnerability
3700| [43111] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
3701| [42637] Apache Derby 'BUILTIN' Authentication Insecure Password Hashing Vulnerability
3702| [42501] Apache CouchDB Cross Site Request Forgery Vulnerability
3703| [42492] Apache CXF XML DTD Processing Security Vulnerability
3704| [42121] Apache SLMS Insufficient Quoting Cross Site Request Forgery Vulnerability
3705| [42102] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
3706| [41963] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
3707| [41544] Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities
3708| [41076] Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability
3709| [40976] Apache Axis2 Document Type Declaration Processing Security Vulnerability
3710| [40827] Apache 'mod_proxy_http' Timeout Handling Information Disclosure Vulnerability
3711| [40343] Apache Axis2 'xsd' Parameter Directory Traversal Vulnerability
3712| [40327] Apache Axis2 'engagingglobally' Cross-Site Scripting Vulnerability
3713| [39771] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
3714| [39636] Apache ActiveMQ Source Code Information Disclosure Vulnerability
3715| [39635] Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability
3716| [39538] Apache mod_auth_shadow Race Condition Security Bypass Vulnerability
3717| [39489] Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities
3718| [39119] Apache ActiveMQ 'createDestination.action' HTML Injection Vulnerability
3719| [38580] Apache Subrequest Handling Information Disclosure Vulnerability
3720| [38494] Apache 'mod_isapi' Memory Corruption Vulnerability
3721| [38491] Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability
3722| [37966] Apache 1.3 mod_proxy HTTP Chunked Encoding Integer Overflow Vulnerability
3723| [37945] Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability
3724| [37944] Apache Tomcat WAR File Directory Traversal Vulnerability
3725| [37942] Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability
3726| [37149] Apache Tomcat 404 Error Page Cross Site Scripting Vulnerability
3727| [37027] RETIRED: Apache APR 'apr_uri_parse_hostinfo' Off By One Remote Code Execution Vulnerability
3728| [36990] Apache HTTP TRACE Cross Site Scripting Vulnerability
3729| [36954] Apache Tomcat Windows Installer Insecure Password Vulnerability
3730| [36889] TYPO3 Apache Solr Search Extension Unspecified Cross Site Scripting Vulnerability
3731| [36596] Apache HTTP Server Solaris Event Port Pollset Support Remote Denial Of Service Vulnerability
3732| [36260] Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
3733| [36254] Apache mod_proxy_ftp Remote Command Injection Vulnerability
3734| [35949] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
3735| [35840] Apache HTTP Server HTTP-Basic Authentication Bypass Vulnerability
3736| [35623] Apache 'mod_deflate' Remote Denial Of Service Vulnerability
3737| [35565] Apache 'mod_proxy' Remote Denial Of Service Vulnerability
3738| [35416] Apache Tomcat XML Parser Information Disclosure Vulnerability
3739| [35263] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
3740| [35253] Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
3741| [35251] Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
3742| [35221] Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
3743| [35196] Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
3744| [35193] Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
3745| [35115] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
3746| [34686] Apache Struts Multiple Cross Site Scripting Vulnerabilities
3747| [34663] Apache 'mod_proxy_ajp' Information Disclosure Vulnerability
3748| [34657] Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities
3749| [34562] Apache Geronimo Application Server Multiple Remote Vulnerabilities
3750| [34552] Apache ActiveMQ Web Console Multiple Unspecified HTML Injection Vulnerabilities
3751| [34412] Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability
3752| [34399] Apache Struts Unspecified Cross Site Scripting Vulnerability
3753| [34383] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
3754| [33913] Apache Tomcat POST Data Information Disclosure Vulnerability
3755| [33360] Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities
3756| [33110] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
3757| [32657] Novell NetWare ApacheAdmin Security Bypass Vulnerability
3758| [31805] Apache HTTP Server OS Fingerprinting Unspecified Security Vulnerability
3759| [31761] Oracle WebLogic Server Apache Connector Stack Based Buffer Overflow Vulnerability
3760| [31698] Apache Tomcat 'RemoteFilterValve' Security Bypass Vulnerability
3761| [31165] Kolab Groupware Server Apache Log File User Password Information Disclosure Vulnerability
3762| [30560] Apache 'mod_proxy_ftp' Wildcard Characters Cross-Site Scripting Vulnerability
3763| [30496] Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability
3764| [30494] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
3765| [29653] Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
3766| [29502] Apache Tomcat Host Manager Cross Site Scripting Vulnerability
3767| [28576] Apache-SSL Environment Variable Information Disclosure and Privilege Escalation Vulnerability
3768| [28484] Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability
3769| [28483] Apache Tomcat 'allowLinking' Accepts NULL Byte in URI Information Disclosure Vulnerability
3770| [28482] Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability
3771| [28481] Apache Tomcat Cross-Site Scripting Vulnerability
3772| [28477] Apache Tomcat AJP Connector Information Disclosure Vulnerability
3773| [27752] Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulnerabilities
3774| [27706] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
3775| [27703] Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
3776| [27409] Apache 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
3777| [27365] Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
3778| [27237] Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
3779| [27236] Apache 'mod_proxy_balancer' Multiple Vulnerabilities
3780| [27234] Apache 'mod_proxy_ftp' Undefined Charset UTF-7 Cross-Site Scripting Vulnerability
3781| [27006] Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
3782| [26939] Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
3783| [26838] Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
3784| [26762] Apache::AuthCAS Cookie SQL Injection Vulnerability
3785| [26663] Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness
3786| [26287] Apache Geronimo SQLLoginModule Authentication Bypass Vulnerability
3787| [26070] Apache Tomcat WebDav Remote Information Disclosure Vulnerability
3788| [25804] Apache Geronimo Management EJB Security Bypass Vulnerability
3789| [25653] Apache Mod_AutoIndex.C Undefined Charset Cross-Site Scripting Vulnerability
3790| [25531] Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
3791| [25489] Apache HTTP Server Mod_Proxy Denial of Service Vulnerability
3792| [25316] Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
3793| [25314] Apache Tomcat Host Manager Servlet Cross Site Scripting Vulnerability
3794| [25174] Apache Tomcat Error Message Reporting Cross Site Scripting Vulnerability
3795| [24999] Apache Tomcat SendMailServlet Cross-Site Scripting Vulnerability
3796| [24759] MySQLDumper Apache Access Control Authentication Bypass Vulnerability
3797| [24649] Apache HTTP Server Mod_Cache Denial of Service Vulnerability
3798| [24645] Apache HTTP Server Mod_Status Cross-Site Scripting Vulnerability
3799| [24553] Apache Mod_Mem_Cache Information Disclosure Vulnerability
3800| [24524] Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
3801| [24480] Apache MyFaces Tomahawk JSF Framework Autoscroll Parameter Cross Site Scripting Vulnerability
3802| [24476] Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
3803| [24475] Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability
3804| [24215] Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
3805| [24147] Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
3806| [24058] Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
3807| [23687] Apache AXIS Non-Existent WSDL Path Information Disclosure Vulnerability
3808| [23438] Apache HTTPD suEXEC Local Multiple Privilege Escalation Weaknesses
3809| [22960] Apache HTTP Server Tomcat Directory Traversal Vulnerability
3810| [22849] Apache mod_python Output Filter Mode Information Disclosure Vulnerability
3811| [22791] Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability
3812| [22732] Debian Apache Root Shell Local Privilege Escalation Vulnerabilities
3813| [22388] Apache Stats Extract Function Multiple Input Validation Vulnerabilities
3814| [21865] Apache And Microsoft IIS Range Denial of Service Vulnerability
3815| [21214] Apache Mod_Auth_Kerb Off-By-One Denial of Service Vulnerability
3816| [20527] Apache Mod_TCL Remote Format String Vulnerability
3817| [19661] Apache HTTP Server Arbitrary HTTP Request Headers Security Weakness
3818| [19447] Apache CGI Script Source Code Information Disclosure Vulnerability
3819| [19204] Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
3820| [19106] Apache Tomcat Information Disclosure Vulnerability
3821| [18138] Apache James SMTP Denial Of Service Vulnerability
3822| [17342] Apache Struts Multiple Remote Vulnerabilities
3823| [17095] Apache Log4Net Denial Of Service Vulnerability
3824| [16916] Apache mod_python FileSession Code Execution Vulnerability
3825| [16710] Apache Libapreq2 Quadratic Behavior Denial of Service Vulnerability
3826| [16260] Apache Geronimo Multiple Input Validation Vulnerabilities
3827| [16153] Apache mod_auth_pgsql Multiple Format String Vulnerabilities
3828| [16152] Apache Mod_SSL Custom Error Document Remote Denial Of Service Vulnerability
3829| [15834] Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability
3830| [15765] Apache James Spooler Memory Leak Denial Of Service Vulnerability
3831| [15762] Apache MPM Worker.C Denial Of Service Vulnerability
3832| [15512] Apache Struts Error Response Cross-Site Scripting Vulnerability
3833| [15413] PHP Apache 2 Virtual() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
3834| [15325] Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
3835| [15224] Apache Mod_Auth_Shadow Authentication Bypass Vulnerability
3836| [15177] PHP Apache 2 Local Denial of Service Vulnerability
3837| [14982] ApacheTop Insecure Temporary File Creation Vulnerability
3838| [14721] Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
3839| [14660] Apache CGI Byterange Request Denial of Service Vulnerability
3840| [14366] Apache mod_ssl CRL Handling Off-By-One Buffer Overflow Vulnerability
3841| [14106] Apache HTTP Request Smuggling Vulnerability
3842| [13778] Apache HTPasswd Password Command Line Argument Buffer Overflow Vulnerability
3843| [13777] Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability
3844| [13756] Apache Tomcat Java Security Manager Bypass Vulnerability
3845| [13537] Apache HTDigest Realm Command Line Argument Buffer Overflow Vulnerability
3846| [12877] Apache mod_ssl ssl_io_filter_cleanup Remote Denial Of Service Vulnerability
3847| [12795] Apache Tomcat Remote Malformed Request Denial Of Service Vulnerability
3848| [12619] Apache Software Foundation Batik Squiggle Browser Access Validation Vulnerability
3849| [12519] Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
3850| [12308] Apache Utilities Insecure Temporary File Creation Vulnerability
3851| [12217] Apache mod_auth_radius Malformed RADIUS Server Reply Integer Overflow Vulnerability
3852| [12181] Mod_DOSEvasive Apache Module Local Insecure Temporary File Creation Vulnerability
3853| [11803] Apache Jakarta Results.JSP Remote Cross-Site Scripting Vulnerability
3854| [11471] Apache mod_include Local Buffer Overflow Vulnerability
3855| [11360] Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
3856| [11239] Apache Satisfy Directive Access Control Bypass Vulnerability
3857| [11187] Apache Web Server Remote IPv6 Buffer Overflow Vulnerability
3858| [11185] Apache Mod_DAV LOCK Denial Of Service Vulnerability
3859| [11182] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
3860| [11154] Apache mod_ssl Remote Denial of Service Vulnerability
3861| [11094] Apache mod_ssl Denial Of Service Vulnerability
3862| [10789] Apache mod_userdir Module Information Disclosure Vulnerability
3863| [10736] Apache 'mod_ssl' Log Function Format String Vulnerability
3864| [10619] Apache ap_escape_html Memory Allocation Denial Of Service Vulnerability
3865| [10508] Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
3866| [10478] ClueCentral Apache Suexec Patch Security Weakness
3867| [10355] Apache 'mod_ssl' 'ssl_util_uuencode_binary()' Stack Buffer Overflow Vulnerability
3868| [10212] Apache mod_auth Malformed Password Potential Memory Corruption Vulnerability
3869| [9933] Apache mod_disk_cache Module Client Authentication Credential Storage Weakness
3870| [9930] Apache Error and Access Logs Escape Sequence Injection Vulnerability
3871| [9921] Apache Connection Blocking Denial Of Service Vulnerability
3872| [9885] Apache Mod_Security Module SecFilterScanPost Off-By-One Buffer Overflow Vulnerability
3873| [9874] Apache HTAccess LIMIT Directive Bypass Configuration Error Weakness
3874| [9829] Apache Mod_Access Access Control Rule Bypass Vulnerability
3875| [9826] Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnerability
3876| [9733] Apache Cygwin Directory Traversal Vulnerability
3877| [9599] Apache mod_php Global Variables Information Disclosure Weakness
3878| [9590] Apache-SSL Client Certificate Forging Vulnerability
3879| [9571] Apache mod_digest Client-Supplied Nonce Verification Vulnerability
3880| [9471] Apache mod_perl Module File Descriptor Leakage Vulnerability
3881| [9404] Mod-Auth-Shadow Apache Module Expired User Credential Weakness
3882| [9302] Apache mod_php Module File Descriptor Leakage Vulnerability
3883| [9129] Apache mod_python Module Malformed Query Denial of Service Vulnerability
3884| [8926] Apache Web Server mod_cgid Module CGI Data Redirection Vulnerability
3885| [8919] Apache Mod_Security Module Heap Corruption Vulnerability
3886| [8911] Apache Web Server Multiple Module Local Buffer Overflow Vulnerability
3887| [8898] Red Hat Apache Directory Index Default Configuration Error
3888| [8883] Apache Cocoon Directory Traversal Vulnerability
3889| [8824] Apache Tomcat Non-HTTP Request Denial Of Service Vulnerability
3890| [8822] Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
3891| [8725] Apache2 MOD_CGI STDERR Denial Of Service Vulnerability
3892| [8707] Apache htpasswd Password Entropy Weakness
3893| [8561] Apache::Gallery Insecure Local File Storage Privilege Escalation Vulnerability
3894| [8287] Mod_Mylo Apache Module REQSTR Buffer Overflow Vulnerability
3895| [8226] Apache HTTP Server Multiple Vulnerabilities
3896| [8138] Apache Web Server Type-Map Recursive Loop Denial Of Service Vulnerability
3897| [8137] Apache Web Server Prefork MPM Denial Of Service Vulnerability
3898| [8136] Macromedia Apache Web Server Encoded Space Source Disclosure Vulnerability
3899| [8135] Apache Web Server FTP Proxy IPV6 Denial Of Service Vulnerability
3900| [8134] Apache Web Server SSLCipherSuite Weak CipherSuite Renegotiation Weakness
3901| [7768] Apache Tomcat Insecure Directory Permissions Vulnerability
3902| [7725] Apache Basic Authentication Module Valid User Login Denial Of Service Vulnerability
3903| [7723] Apache APR_PSPrintf Memory Corruption Vulnerability
3904| [7448] Apache Mod_Auth_Any Remote Command Execution Vulnerability
3905| [7375] Apache Mod_Access_Referer NULL Pointer Dereference Denial of Service Vulnerability
3906| [7332] Apache Web Server OS2 Filestat Denial Of Service Vulnerability
3907| [7255] Apache Web Server File Descriptor Leakage Vulnerability
3908| [7254] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
3909| [6943] Apache Web Server MIME Boundary Information Disclosure Vulnerability
3910| [6939] Apache Web Server ETag Header Information Disclosure Weakness
3911| [6722] Apache Tomcat Web.XML File Contents Disclosure Vulnerability
3912| [6721] Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
3913| [6720] Apache Tomcat Example Web Application Cross Site Scripting Vulnerability
3914| [6662] Apache Web Server MS-DOS Device Name Denial Of Service Vulnerability
3915| [6661] Apache Web Server Default Script Mapping Bypass Vulnerability
3916| [6660] Apache Web Server Illegal Character HTTP Request File Disclosure Vulnerability
3917| [6659] Apache Web Server MS-DOS Device Name Arbitrary Code Execution Vulnerability
3918| [6562] Apache Tomcat Invoker Servlet File Disclosure Vulnerability
3919| [6320] Apache/Tomcat Mod_JK Chunked Encoding Denial Of Service Vulnerability
3920| [6117] Apache mod_php File Descriptor Leakage Vulnerability
3921| [6065] Apache 2 WebDAV CGI POST Request Information Disclosure Vulnerability
3922| [5996] Apache AB.C Web Benchmarking Buffer Overflow Vulnerability
3923| [5995] Apache AB.C Web Benchmarking Read_Connection() Buffer Overflow Vulnerability
3924| [5993] Multiple Apache HTDigest Buffer Overflow Vulnerabilities
3925| [5992] Apache HTDigest Insecure Temporary File Vulnerability
3926| [5991] Apache HTDigest Arbitrary Command Execution Vulnerability
3927| [5990] Apache HTPasswd Insecure Temporary File Vulnerability
3928| [5981] Multiple Apache HTDigest and HTPassWD Component Vulnerabilites
3929| [5884] Apache Web Server Scoreboard Memory Segment Overwriting SIGUSR1 Sending Vulnerability
3930| [5847] Apache Server Side Include Cross Site Scripting Vulnerability
3931| [5838] Apache Tomcat 3.2 Directory Disclosure Vulnerability
3932| [5816] Apache 2 mod_dav Denial Of Service Vulnerability
3933| [5791] HP VirtualVault Apache mod_ssl Denial Of Service Vulnerability
3934| [5787] Apache Oversized STDERR Buffer Denial Of Service Vulnerability
3935| [5786] Apache Tomcat DefaultServlet File Disclosure Vulnerability
3936| [5542] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
3937| [5486] Apache 2.0 CGI Path Disclosure Vulnerability
3938| [5485] Apache 2.0 Path Disclosure Vulnerability
3939| [5434] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
3940| [5256] Apache httpd 2.0 CGI Error Path Disclosure Vulnerability
3941| [5194] Apache Tomcat DOS Device Name Cross Site Scripting Vulnerability
3942| [5193] Apache Tomcat Servlet Mapping Cross Site Scripting Vulnerability
3943| [5067] Apache Tomcat Null Character Malformed Request Denial Of Service Vulnerability
3944| [5054] Apache Tomcat Web Root Path Disclosure Vulnerability
3945| [5033] Apache Chunked-Encoding Memory Corruption Vulnerability
3946| [4995] Apache Tomcat JSP Engine Denial of Service Vulnerability
3947| [4878] Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
3948| [4877] Apache Tomcat Example Files Web Root Path Disclosure Vulnerability
3949| [4876] Apache Tomcat Source.JSP Malformed Request Information Disclosure Vulnerability
3950| [4575] Apache Tomcat Servlet Path Disclosure Vulnerability
3951| [4557] Apache Tomcat System Path Information Disclosure Vulnerability
3952| [4437] Apache Error Message Cross-Site Scripting Vulnerability
3953| [4431] Apache PrintEnv/Test_CGI Script Injection Vulnerability
3954| [4358] Apache Double-Reverse Lookup Log Entry Spoofing Vulnerability
3955| [4335] Apache Win32 Batch File Remote Command Execution Vulnerability
3956| [4292] Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
3957| [4189] Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
3958| [4057] Apache 2 for Windows OPTIONS request Path Disclosure Vulnerability
3959| [4056] Apache 2 for Windows php.exe Path Disclosure Vulnerability
3960| [4037] Oracle 9iAS Apache PL/SQL Module Denial of Service Vulnerability
3961| [4032] Oracle 9iAS Apache PL/SQL Module Multiple Buffer Overflows Vulnerability
3962| [3796] Apache HTTP Request Unexpected Behavior Vulnerability
3963| [3790] Apache Non-Existent Log Directory Denial Of Service Vulnerability
3964| [3786] Apache Win32 PHP.EXE Remote File Disclosure Vulnerability
3965| [3727] Oracle 9I Application Server PL/SQL Apache Module Directory Traversal Vulnerability
3966| [3726] Oracle 9I Application Server PL/SQL Apache Module Buffer Overflow Vulnerability
3967| [3596] Apache Split-Logfile File Append Vulnerability
3968| [3521] Apache mod_usertrack Predictable ID Generation Vulnerability
3969| [3335] Red Hat Linux Apache Remote Username Enumeration Vulnerability
3970| [3316] MacOS X Client Apache Directory Contents Disclosure Vulnerability
3971| [3256] Apache mod_auth_oracle Remote SQL Query Manipulation Vulnerability
3972| [3255] Apache mod_auth_mysql Remote SQL Query Manipulation Vulnerability
3973| [3254] Apache AuthPG Remote SQL Query Manipulation Vulnerability
3974| [3253] Apache mod_auth_pgsql_sys Remote SQL Query Manipulation Vulnerability
3975| [3251] Apache mod_auth_pgsql Remote SQL Query Manipulation Vulnerability
3976| [3176] Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
3977| [3169] Apache Server Address Disclosure Vulnerability
3978| [3009] Apache Possible Directory Index Disclosure Vulnerability
3979| [2982] Apache Tomcat Cross-Site Scripting Vulnerability
3980| [2852] MacOS X Client Apache File Protection Bypass Vulnerability
3981| [2740] Apache Web Server HTTP Request Denial of Service Vulnerability
3982| [2518] Apache Tomcat 3.0 Directory Traversal Vulnerability
3983| [2503] Apache Artificially Long Slash Path Directory Listing Vulnerability
3984| [2300] NCSA/Apache httpd ScriptAlias Source Retrieval Vulnerability
3985| [2216] Apache Web Server DoS Vulnerability
3986| [2182] Apache /tmp File Race Vulnerability
3987| [2171] Oracle Apache+WebDB Documented Backdoor Vulnerability
3988| [2060] Apache Web Server with Php 3 File Disclosure Vulnerability
3989| [1821] Apache mod_cookies Buffer Overflow Vulnerability
3990| [1728] Apache Rewrite Module Arbitrary File Disclosure Vulnerability
3991| [1658] SuSE Apache CGI Source Code Viewing Vulnerability
3992| [1656] SuSE Apache WebDAV Directory Listings Vulnerability
3993| [1575] Trustix Apache-SSL RPM Permissions Vulnerability
3994| [1548] Apache Jakarta-Tomcat /admin Context Vulnerability
3995| [1532] Apache Tomcat Snoop Servlet Information Disclosure Vulnerability
3996| [1531] Apache Tomcat 3.1 Path Revealing Vulnerability
3997| [1457] Apache::ASP source.asp Example Script Vulnerability
3998| [1284] Apache HTTP Server (win32) Root Directory Access Vulnerability
3999| [1083] Cobalt Raq Apache .htaccess Disclosure Vulnerability
4000|
4001| IBM X-Force - https://exchange.xforce.ibmcloud.com:
4002| [86258] Apache CloudStack text fields cross-site scripting
4003| [85983] Apache Subversion mod_dav_svn module denial of service
4004| [85875] Apache OFBiz UEL code execution
4005| [85874] Apache OFBiz Webtools View Log screen cross-site scripting
4006| [85871] Apache HTTP Server mod_session_dbd unspecified
4007| [85756] Apache Struts OGNL expression command execution
4008| [85755] Apache Struts DefaultActionMapper class open redirect
4009| [85586] Apache ActiveMQ CVE-2013-1879 cross-site scripting
4010| [85574] Apache HTTP Server mod_dav denial of service
4011| [85573] Apache Struts Showcase App OGNL code execution
4012| [85496] Apache CXF denial of service
4013| [85423] Apache Geronimo RMI classloader code execution
4014| [85326] Apache Santuario XML Security for C++ buffer overflow
4015| [85323] Apache Santuario XML Security for Java spoofing
4016| [85319] Apache Qpid Python client SSL spoofing
4017| [85019] Apache Santuario XML Security for C++ CVE-2013-2156 buffer overflow
4018| [85018] Apache Santuario XML Security for C++ CVE-2013-2155 denial of service
4019| [85017] Apache Santuario XML Security for C++ CVE-2013-2154 buffer overflow
4020| [85016] Apache Santuario XML Security for C++ CVE-2013-2153 spoofing
4021| [84952] Apache Tomcat CVE-2012-3544 denial of service
4022| [84763] Apache Struts CVE-2013-2135 security bypass
4023| [84762] Apache Struts CVE-2013-2134 security bypass
4024| [84719] Apache Subversion CVE-2013-2088 command execution
4025| [84718] Apache Subversion CVE-2013-2112 denial of service
4026| [84717] Apache Subversion CVE-2013-1968 denial of service
4027| [84577] Apache Tomcat security bypass
4028| [84576] Apache Tomcat symlink
4029| [84543] Apache Struts CVE-2013-2115 security bypass
4030| [84542] Apache Struts CVE-2013-1966 security bypass
4031| [84154] Apache Tomcat session hijacking
4032| [84144] Apache Tomcat denial of service
4033| [84143] Apache Tomcat information disclosure
4034| [84111] Apache HTTP Server command execution
4035| [84043] Apache Virtual Computing Lab cross-site scripting
4036| [84042] Apache Virtual Computing Lab cross-site scripting
4037| [83782] Apache CloudStack information disclosure
4038| [83781] Apache CloudStack security bypass
4039| [83720] Apache ActiveMQ cross-site scripting
4040| [83719] Apache ActiveMQ denial of service
4041| [83718] Apache ActiveMQ denial of service
4042| [83263] Apache Subversion denial of service
4043| [83262] Apache Subversion denial of service
4044| [83261] Apache Subversion denial of service
4045| [83259] Apache Subversion denial of service
4046| [83035] Apache mod_ruid2 security bypass
4047| [82852] Apache Qpid federation_tag security bypass
4048| [82851] Apache Qpid qpid::framing::Buffer denial of service
4049| [82758] Apache Rave User RPC API information disclosure
4050| [82663] Apache Subversion svn_fs_file_length() denial of service
4051| [82642] Apache Qpid qpid::framing::Buffer::checkAvailable() denial of service
4052| [82641] Apache Qpid AMQP denial of service
4053| [82626] Apache HTTP Server on Debian GNU/Linux Debian apache2ctl symlink
4054| [82618] Apache Commons FileUpload symlink
4055| [82360] Apache HTTP Server manager interface cross-site scripting
4056| [82359] Apache HTTP Server hostnames cross-site scripting
4057| [82338] Apache Tomcat log/logdir information disclosure
4058| [82328] Apache Maven and Apache Maven Wagon SSL spoofing
4059| [82268] Apache OpenJPA deserialization command execution
4060| [81981] Apache CXF UsernameTokens security bypass
4061| [81980] Apache CXF WS-Security security bypass
4062| [81398] Apache OFBiz cross-site scripting
4063| [81240] Apache CouchDB directory traversal
4064| [81226] Apache CouchDB JSONP code execution
4065| [81225] Apache CouchDB Futon user interface cross-site scripting
4066| [81211] Apache Axis2/C SSL spoofing
4067| [81167] Apache CloudStack DeployVM information disclosure
4068| [81166] Apache CloudStack AddHost API information disclosure
4069| [81165] Apache CloudStack createSSHKeyPair API information disclosure
4070| [80518] Apache Tomcat cross-site request forgery security bypass
4071| [80517] Apache Tomcat FormAuthenticator security bypass
4072| [80516] Apache Tomcat NIO denial of service
4073| [80408] Apache Tomcat replay-countermeasure security bypass
4074| [80407] Apache Tomcat HTTP Digest Access Authentication security bypass
4075| [80317] Apache Tomcat slowloris denial of service
4076| [79984] Apache Commons HttpClient SSL spoofing
4077| [79983] Apache CXF SSL spoofing
4078| [79830] Apache Axis2/Java SSL spoofing
4079| [79829] Apache Axis SSL spoofing
4080| [79809] Apache Tomcat DIGEST security bypass
4081| [79806] Apache Tomcat parseHeaders() denial of service
4082| [79540] Apache OFBiz unspecified
4083| [79487] Apache Axis2 SAML security bypass
4084| [79212] Apache Cloudstack code execution
4085| [78734] Apache CXF SOAP Action security bypass
4086| [78730] Apache Qpid broker denial of service
4087| [78617] Eucalyptus Apache Santuario (XML Security for Java) denial of service
4088| [78563] Apache mod_pagespeed module unspecified cross-site scripting
4089| [78562] Apache mod_pagespeed module security bypass
4090| [78454] Apache Axis2 security bypass
4091| [78452] Websense Web Security and Web Filter Apache Tomcat information disclosure
4092| [78451] Websense Web Security and Web Filter Apache Tomcat cross-site scripting
4093| [78321] Apache Wicket unspecified cross-site scripting
4094| [78183] Apache Struts parameters denial of service
4095| [78182] Apache Struts cross-site request forgery
4096| [78153] Apache Solr Autocomplete module for Drupal autocomplete results cross-site scripting
4097| [77987] mod_rpaf module for Apache denial of service
4098| [77958] Apache Struts skill name code execution
4099| [77914] Apache HTTP Server mod_negotiation module cross-site scripting
4100| [77913] Apache HTTP Server mod_proxy_ajp information disclosure
4101| [77568] Apache Qpid broker security bypass
4102| [77421] Apache Libcloud spoofing
4103| [77059] Oracle Solaris Cluster Apache Tomcat Agent unspecified
4104| [77046] Oracle Solaris Apache HTTP Server information disclosure
4105| [76837] Apache Hadoop information disclosure
4106| [76802] Apache Sling CopyFrom denial of service
4107| [76692] Apache Hadoop symlink
4108| [76535] Apache Roller console cross-site request forgery
4109| [76534] Apache Roller weblog cross-site scripting
4110| [76152] Apache CXF elements security bypass
4111| [76151] Apache CXF child policies security bypass
4112| [75983] MapServer for Windows Apache file include
4113| [75857] Apache Commons Compress and Apache Ant bzip2 denial of service
4114| [75558] Apache POI denial of service
4115| [75545] PHP apache_request_headers() buffer overflow
4116| [75302] Apache Qpid SASL security bypass
4117| [75211] Debian GNU/Linux apache 2 cross-site scripting
4118| [74901] Apache HTTP Server LD_LIBRARY_PATH privilege escalation
4119| [74871] Apache OFBiz FlexibleStringExpander code execution
4120| [74870] Apache OFBiz multiple cross-site scripting
4121| [74750] Apache Hadoop unspecified spoofing
4122| [74319] Apache Struts XSLTResult.java file upload
4123| [74313] Apache Traffic Server header buffer overflow
4124| [74276] Apache Wicket directory traversal
4125| [74273] Apache Wicket unspecified cross-site scripting
4126| [74181] Apache HTTP Server mod_fcgid module denial of service
4127| [73690] Apache Struts OGNL code execution
4128| [73432] Apache Solr extension for TYPO3 unspecified cross-site scripting
4129| [73100] Apache MyFaces in directory traversal
4130| [73096] Apache APR hash denial of service
4131| [73052] Apache Struts name cross-site scripting
4132| [73030] Apache CXF UsernameToken security bypass
4133| [72888] Apache Struts lastName cross-site scripting
4134| [72758] Apache HTTP Server httpOnly information disclosure
4135| [72757] Apache HTTP Server MPM denial of service
4136| [72585] Apache Struts ParameterInterceptor security bypass
4137| [72438] Apache Tomcat Digest security bypass
4138| [72437] Apache Tomcat Digest security bypass
4139| [72436] Apache Tomcat DIGEST security bypass
4140| [72425] Apache Tomcat parameter denial of service
4141| [72422] Apache Tomcat request object information disclosure
4142| [72377] Apache HTTP Server scoreboard security bypass
4143| [72345] Apache HTTP Server HTTP request denial of service
4144| [72229] Apache Struts ExceptionDelegator command execution
4145| [72089] Apache Struts ParameterInterceptor directory traversal
4146| [72088] Apache Struts CookieInterceptor command execution
4147| [72047] Apache Geronimo hash denial of service
4148| [72016] Apache Tomcat hash denial of service
4149| [71711] Apache Struts OGNL expression code execution
4150| [71654] Apache Struts interfaces security bypass
4151| [71620] Apache ActiveMQ failover denial of service
4152| [71617] Apache HTTP Server mod_proxy module information disclosure
4153| [71508] Apache MyFaces EL security bypass
4154| [71445] Apache HTTP Server mod_proxy security bypass
4155| [71203] Apache Tomcat servlets privilege escalation
4156| [71181] Apache HTTP Server ap_pregsub() denial of service
4157| [71093] Apache HTTP Server ap_pregsub() buffer overflow
4158| [70336] Apache HTTP Server mod_proxy information disclosure
4159| [69804] Apache HTTP Server mod_proxy_ajp denial of service
4160| [69472] Apache Tomcat AJP security bypass
4161| [69396] Apache HTTP Server ByteRange filter denial of service
4162| [69394] Apache Wicket multi window support cross-site scripting
4163| [69176] Apache Tomcat XML information disclosure
4164| [69161] Apache Tomcat jsvc information disclosure
4165| [68799] mod_authnz_external module for Apache mysql-auth.pl SQL injection
4166| [68541] Apache Tomcat sendfile information disclosure
4167| [68420] Apache XML Security denial of service
4168| [68238] Apache Tomcat JMX information disclosure
4169| [67860] Apache Rampart/C rampart_timestamp_token_validate security bypass
4170| [67804] Apache Subversion control rules information disclosure
4171| [67803] Apache Subversion control rules denial of service
4172| [67802] Apache Subversion baselined denial of service
4173| [67672] Apache Archiva multiple cross-site scripting
4174| [67671] Apache Archiva multiple cross-site request forgery
4175| [67564] Apache APR apr_fnmatch() denial of service
4176| [67532] IBM WebSphere Application Server org.apache.jasper.runtime.JspWriterImpl.response denial of service
4177| [67515] Apache Tomcat annotations security bypass
4178| [67480] Apache Struts s:submit information disclosure
4179| [67414] Apache APR apr_fnmatch() denial of service
4180| [67356] Apache Struts javatemplates cross-site scripting
4181| [67354] Apache Struts Xwork cross-site scripting
4182| [66676] Apache Tomcat HTTP BIO information disclosure
4183| [66675] Apache Tomcat web.xml security bypass
4184| [66640] Apache HttpComponents HttpClient Proxy-Authorization information disclosure
4185| [66241] Apache HttpComponents information disclosure
4186| [66154] Apache Tomcat ServletSecurity security bypass
4187| [65971] Apache Tomcat ServletSecurity security bypass
4188| [65876] Apache Subversion mod_dav_svn denial of service
4189| [65343] Apache Continuum unspecified cross-site scripting
4190| [65162] Apache Tomcat NIO connector denial of service
4191| [65161] Apache Tomcat javax.servlet.ServletRequest.getLocale() denial of service
4192| [65160] Apache Tomcat HTML Manager interface cross-site scripting
4193| [65159] Apache Tomcat ServletContect security bypass
4194| [65050] Apache CouchDB web-based administration UI cross-site scripting
4195| [64773] Oracle HTTP Server Apache Plugin unauthorized access
4196| [64473] Apache Subversion blame -g denial of service
4197| [64472] Apache Subversion walk() denial of service
4198| [64407] Apache Axis2 CVE-2010-0219 code execution
4199| [63926] Apache Archiva password privilege escalation
4200| [63785] Apache CouchDB LD_LIBRARY_PATH privilege escalation
4201| [63493] Apache Archiva credentials cross-site request forgery
4202| [63477] Apache Tomcat HttpOnly session hijacking
4203| [63422] Apache Tomcat sessionsList.jsp cross-site scripting
4204| [63303] Apache mod_fcgid module fcgid_header_bucket_read() buffer overflow
4205| [62959] Apache Shiro filters security bypass
4206| [62790] Apache Perl cgi module denial of service
4207| [62576] Apache Qpid exchange denial of service
4208| [62575] Apache Qpid AMQP denial of service
4209| [62354] Apache Qpid SSL denial of service
4210| [62235] Apache APR-util apr_brigade_split_line() denial of service
4211| [62181] Apache XML-RPC SAX Parser information disclosure
4212| [61721] Apache Traffic Server cache poisoning
4213| [61202] Apache Derby BUILTIN authentication functionality information disclosure
4214| [61186] Apache CouchDB Futon cross-site request forgery
4215| [61169] Apache CXF DTD denial of service
4216| [61070] Apache Jackrabbit search.jsp SQL injection
4217| [61006] Apache SLMS Quoting cross-site request forgery
4218| [60962] Apache Tomcat time cross-site scripting
4219| [60883] Apache mod_proxy_http information disclosure
4220| [60671] Apache HTTP Server mod_cache and mod_dav denial of service
4221| [60264] Apache Tomcat Transfer-Encoding denial of service
4222| [59746] Apache Axis2 axis2/axis2-admin page session hijacking
4223| [59588] Apache Axis2/Java XML DTD (Document Type Declaration) data denial of service
4224| [59413] Apache mod_proxy_http timeout information disclosure
4225| [59058] Apache MyFaces unencrypted view state cross-site scripting
4226| [58827] Apache Axis2 xsd file include
4227| [58790] Apache Axis2 modules cross-site scripting
4228| [58299] Apache ActiveMQ queueBrowse cross-site scripting
4229| [58169] Apache Tomcat Web Application Manager / Host Manager cross-site request forgery
4230| [58056] Apache ActiveMQ .jsp source code disclosure
4231| [58055] Apache Tomcat realm name information disclosure
4232| [58046] Apache HTTP Server mod_auth_shadow security bypass
4233| [57841] Apache Open For Business Project (OFBiz) subject cross-site scripting
4234| [57840] Apache Open For Business Project (OFBiz) multiple parameters cross-site scripting
4235| [57429] Apache CouchDB algorithms information disclosure
4236| [57398] Apache ActiveMQ Web console cross-site request forgery
4237| [57397] Apache ActiveMQ createDestination.action cross-site scripting
4238| [56653] Apache HTTP Server DNS spoofing
4239| [56652] Apache HTTP Server DNS cross-site scripting
4240| [56625] Apache HTTP Server request header information disclosure
4241| [56624] Apache HTTP Server mod_isapi orphaned callback pointer code execution
4242| [56623] Apache HTTP Server mod_proxy_ajp denial of service
4243| [55941] mod_proxy module for Apache ap_proxy_send_fb() buffer overflow
4244| [55857] Apache Tomcat WAR files directory traversal
4245| [55856] Apache Tomcat autoDeploy attribute security bypass
4246| [55855] Apache Tomcat WAR directory traversal
4247| [55210] Intuit component for Joomla! Apache information disclosure
4248| [54533] Apache Tomcat 404 error page cross-site scripting
4249| [54182] Apache Tomcat admin default password
4250| [53878] Apache Solr Search (solr) extension for TYPO3 unspecified cross-site scripting
4251| [53666] Apache HTTP Server Solaris pollset support denial of service
4252| [53650] Apache HTTP Server HTTP basic-auth module security bypass
4253| [53124] mod_proxy_ftp module for Apache HTTP header security bypass
4254| [53041] mod_proxy_ftp module for Apache denial of service
4255| [52540] Apache Portable Runtime and Apache Portable Utility library multiple buffer overflow
4256| [51953] Apache Tomcat Path Disclosure
4257| [51952] Apache Tomcat Path Traversal
4258| [51951] Apache stronghold-status Information Disclosure
4259| [51950] Apache stronghold-info Information Disclosure
4260| [51949] Apache PHP Source Code Disclosure
4261| [51948] Apache Multiviews Attack
4262| [51946] Apache JServ Environment Status Information Disclosure
4263| [51945] Apache error_log Information Disclosure
4264| [51944] Apache Default Installation Page Pattern Found
4265| [51943] Apache AXIS XML Parser echoheaders.jws Sample Web Service Denial of Service
4266| [51942] Apache AXIS XML External Entity File Retrieval
4267| [51941] Apache AXIS Sample Servlet Information Leak
4268| [51940] Apache access_log Information Disclosure
4269| [51626] Apache mod_deflate denial of service
4270| [51532] mod_proxy module for the Apache HTTP Server stream_reqbody_cl denial of service
4271| [51365] Apache Tomcat RequestDispatcher security bypass
4272| [51273] Apache HTTP Server Incomplete Request denial of service
4273| [51195] Apache Tomcat XML information disclosure
4274| [50994] Apache APR-util xml/apr_xml.c denial of service
4275| [50993] Apache APR-util apr_brigade_vprintf denial of service
4276| [50964] Apache APR-util apr_strmatch_precompile() denial of service
4277| [50930] Apache Tomcat j_security_check information disclosure
4278| [50928] Apache Tomcat AJP denial of service
4279| [50884] Apache HTTP Server XML ENTITY denial of service
4280| [50808] Apache HTTP Server AllowOverride privilege escalation
4281| [50108] Apache Struts s:a tag and s:url tag cross-site scripting
4282| [50059] Apache mod_proxy_ajp information disclosure
4283| [49951] Apache Tiles Expression Language (EL) expressions cross-site scripting
4284| [49925] Apache Geronimo Web Administrative Console cross-site request forgery
4285| [49924] Apache Geronimo console/portal/Server/Monitoring cross-site scripting
4286| [49921] Apache ActiveMQ Web interface cross-site scripting
4287| [49898] Apache Geronimo Services/Repository directory traversal
4288| [49725] Apache Tomcat mod_jk module information disclosure
4289| [49715] Apache mod_perl Apache::Status and Apache2::Status modules cross-site scripting
4290| [49712] Apache Struts unspecified cross-site scripting
4291| [49213] Apache Tomcat cal2.jsp cross-site scripting
4292| [48934] Apache Tomcat POST doRead method information disclosure
4293| [48211] Apache Tomcat header HTTP request smuggling
4294| [48163] libapache2-mod-auth-mysql module for Debian multibyte encoding SQL injection
4295| [48110] Apache Jackrabbit search.jsp and swr.jsp cross-site scripting
4296| [47709] Apache Roller "
4297| [47104] Novell Netware ApacheAdmin console security bypass
4298| [47086] Apache HTTP Server OS fingerprinting unspecified
4299| [46329] Apache Struts FilterDispatcher and DefaultStaticContentLoader class directory traversal
4300| [45791] Apache Tomcat RemoteFilterValve security bypass
4301| [44435] Oracle WebLogic Apache Connector buffer overflow
4302| [44411] Apache Tomcat allowLinking UTF-8 directory traversal
4303| [44223] Apache HTTP Server mod_proxy_ftp cross-site scripting
4304| [44156] Apache Tomcat RequestDispatcher directory traversal
4305| [44155] Apache Tomcat HttpServletResponse.sendError() cross-site scripting
4306| [43885] Oracle WebLogic Server Apache Connector buffer overflow
4307| [42987] Apache HTTP Server mod_proxy module denial of service
4308| [42915] Apache Tomcat JSP files path disclosure
4309| [42914] Apache Tomcat MS-DOS path disclosure
4310| [42892] Apache Tomcat unspecified unauthorized access
4311| [42816] Apache Tomcat Host Manager cross-site scripting
4312| [42303] Apache 403 error cross-site scripting
4313| [41618] Apache-SSL ExpandCert() authentication bypass
4314| [40761] Apache Derby RDBNAM parameter and DatabaseMetaData.getURL information disclosure
4315| [40736] Apache Tomcat HTTP/1.1 connector information disclosure
4316| [40614] Apache mod_jk2 HTTP Host header buffer overflow
4317| [40562] Apache Geronimo init information disclosure
4318| [40478] Novell Web Manager webadmin-apache.conf security bypass
4319| [40411] Apache Tomcat exception handling information disclosure
4320| [40409] Apache Tomcat native (APR based) connector weak security
4321| [40403] Apache Tomcat quotes and %5C cookie information disclosure
4322| [40388] Sun Java Plug-In org.apache.crimson.tree.XmlDocument security bypass
4323| [39893] Apache HTTP Server mod_negotiation HTTP response splitting
4324| [39867] Apache HTTP Server mod_negotiation cross-site scripting
4325| [39804] Apache Tomcat SingleSignOn information disclosure
4326| [39615] Apache HTTP Server mod_proxy_ftp.c UTF-7 cross-site scripting
4327| [39612] Apache HTTP Server mod_proxy_balancer buffer overflow
4328| [39608] Apache HTTP Server balancer manager cross-site request forgery
4329| [39476] Apache mod_proxy_balancer balancer_handler function denial of service
4330| [39474] Apache HTTP Server mod_proxy_balancer cross-site scripting
4331| [39472] Apache HTTP Server mod_status cross-site scripting
4332| [39201] Apache Tomcat JULI logging weak security
4333| [39158] Apache HTTP Server Windows SMB shares information disclosure
4334| [39001] Apache HTTP Server mod_imap and mod_imagemap module cross-site scripting
4335| [38951] Apache::AuthCAS Perl module cookie SQL injection
4336| [38800] Apache HTTP Server 413 error page cross-site scripting
4337| [38211] Apache Geronimo SQLLoginModule authentication bypass
4338| [37243] Apache Tomcat WebDAV directory traversal
4339| [37178] RHSA update for Apache HTTP Server mod_status module cross-site scripting not installed
4340| [37177] RHSA update for Apache HTTP Server Apache child process denial of service not installed
4341| [37119] RHSA update for Apache mod_auth_kerb off-by-one buffer overflow not installed
4342| [37100] RHSA update for Apache and IBM HTTP Server Expect header cross-site scripting not installed
4343| [36782] Apache Geronimo MEJB unauthorized access
4344| [36586] Apache HTTP Server UTF-7 cross-site scripting
4345| [36468] Apache Geronimo LoginModule security bypass
4346| [36467] Apache Tomcat functions.jsp cross-site scripting
4347| [36402] Apache Tomcat calendar cross-site request forgery
4348| [36354] Apache HTTP Server mod_proxy module denial of service
4349| [36352] Apache HTTP Server ap_proxy_date_canon() denial of service
4350| [36336] Apache Derby lock table privilege escalation
4351| [36335] Apache Derby schema privilege escalation
4352| [36006] Apache Tomcat "
4353| [36001] Apache Tomcat Host Manager Servlet alias cross-site scripting
4354| [35999] Apache Tomcat \"
4355| [35795] Apache Tomcat CookieExample cross-site scripting
4356| [35536] Apache Tomcat SendMailServlet example cross-site scripting
4357| [35384] Apache HTTP Server mod_cache module denial of service
4358| [35097] Apache HTTP Server mod_status module cross-site scripting
4359| [35095] Apache HTTP Server Prefork MPM module denial of service
4360| [34984] Apache HTTP Server recall_headers information disclosure
4361| [34966] Apache HTTP Server MPM content spoofing
4362| [34965] Apache HTTP Server MPM information disclosure
4363| [34963] Apache HTTP Server MPM multiple denial of service
4364| [34872] Apache MyFaces Tomahawk autoscroll parameter cross-site scripting
4365| [34869] Apache Tomcat JSP example Web application cross-site scripting
4366| [34868] Apache Tomcat Manager and Host Manager cross-site scripting
4367| [34496] Apache Tomcat JK Connector security bypass
4368| [34377] Apache Tomcat hello.jsp cross-site scripting
4369| [34212] Apache Tomcat SSL configuration security bypass
4370| [34210] Apache Tomcat Accept-Language cross-site scripting
4371| [34209] Apache Tomcat calendar application cross-site scripting
4372| [34207] Apache Tomcat implicit-objects.jsp cross-site scripting
4373| [34167] Apache Axis WSDL file path disclosure
4374| [34068] Apache Tomcat AJP connector information disclosure
4375| [33584] Apache HTTP Server suEXEC privilege escalation
4376| [32988] Apache Tomcat proxy module directory traversal
4377| [32794] Apache Tomcat JK Web Server Connector map_uri_to_worker() buffer overflow
4378| [32708] Debian Apache tty privilege escalation
4379| [32441] ApacheStats extract() PHP call unspecified
4380| [32128] Apache Tomcat default account
4381| [31680] Apache Tomcat RequestParamExample cross-site scripting
4382| [31649] Apache Tomcat Sample Servlet TroubleShooter detected
4383| [31557] BEA WebLogic Server and WebLogic Express Apache proxy plug-in denial of service
4384| [31236] Apache HTTP Server htpasswd.c strcpy buffer overflow
4385| [30456] Apache mod_auth_kerb off-by-one buffer overflow
4386| [29550] Apache mod_tcl set_var() format string
4387| [28620] Apache and IBM HTTP Server Expect header cross-site scripting
4388| [28357] Apache HTTP Server mod_alias script source information disclosure
4389| [28063] Apache mod_rewrite off-by-one buffer overflow
4390| [27902] Apache Tomcat URL information disclosure
4391| [26786] Apache James SMTP server denial of service
4392| [25680] libapache2 /tmp/svn file upload
4393| [25614] Apache Struts lookupMap cross-site scripting
4394| [25613] Apache Struts ActionForm denial of service
4395| [25612] Apache Struts isCancelled() security bypass
4396| [24965] Apache mod_python FileSession command execution
4397| [24716] Apache James spooler memory leak denial of service
4398| [24159] Apache Geronimo Web-Access-Log Viewer cross-site scripting
4399| [24158] Apache Geronimo jsp-examples cross-site scripting
4400| [24030] Apache auth_ldap module multiple format strings
4401| [24008] Apache mod_ssl custom error message denial of service
4402| [24003] Apache mod_auth_pgsql module multiple syslog format strings
4403| [23612] Apache mod_imap referer field cross-site scripting
4404| [23173] Apache Struts error message cross-site scripting
4405| [22942] Apache Tomcat directory listing denial of service
4406| [22858] Apache Multi-Processing Module code allows denial of service
4407| [22602] RHSA-2005:582 updates for Apache httpd not installed
4408| [22520] Apache mod-auth-shadow "
4409| [22466] ApacheTop symlink
4410| [22109] Apache HTTP Server ssl_engine_kernel client certificate validation
4411| [22006] Apache HTTP Server byte-range filter denial of service
4412| [21567] Apache mod_ssl off-by-one buffer overflow
4413| [21195] Apache HTTP Server header HTTP request smuggling
4414| [20383] Apache HTTP Server htdigest buffer overflow
4415| [19681] Apache Tomcat AJP12 request denial of service
4416| [18993] Apache HTTP server check_forensic symlink attack
4417| [18790] Apache Tomcat Manager cross-site scripting
4418| [18349] Apache HTTP server Apple HFS+ filesystem obtain information
4419| [18348] Apache HTTP server Apple HFS+ filesystem .DS_Store and .ht file disclosure
4420| [18347] Apache HTTP server Apple Mac OS X Server mod_digest_apple module could allow an attacker to replay responses
4421| [17961] Apache Web server ServerTokens has not been set
4422| [17930] Apache HTTP Server HTTP GET request denial of service
4423| [17785] Apache mod_include module buffer overflow
4424| [17671] Apache HTTP Server SSLCipherSuite bypass restrictions
4425| [17473] Apache HTTP Server Satisfy directive allows access to resources
4426| [17413] Apache htpasswd buffer overflow
4427| [17384] Apache HTTP Server environment variable configuration file buffer overflow
4428| [17382] Apache HTTP Server IPv6 apr_util denial of service
4429| [17366] Apache HTTP Server mod_dav module LOCK denial of service
4430| [17273] Apache HTTP Server speculative mode denial of service
4431| [17200] Apache HTTP Server mod_ssl denial of service
4432| [16890] Apache HTTP Server server-info request has been detected
4433| [16889] Apache HTTP Server server-status request has been detected
4434| [16705] Apache mod_ssl format string attack
4435| [16524] Apache HTTP Server ap_get_mime_headers_core denial of service
4436| [16387] Apache HTTP Server mod_proxy Content-Length buffer overflow
4437| [16230] Apache HTTP Server PHP denial of service
4438| [16214] Apache mod_ssl ssl_util_uuencode_binary buffer overflow
4439| [15958] Apache HTTP Server authentication modules memory corruption
4440| [15547] Apache HTTP Server mod_disk_cache local information disclosure
4441| [15540] Apache HTTP Server socket starvation denial of service
4442| [15467] Novell GroupWise WebAccess using Apache Web server allows viewing of files on the server
4443| [15422] Apache HTTP Server mod_access information disclosure
4444| [15419] Apache HTTP Server mod_ssl plain HTTP request denial of service
4445| [15293] Apache for Cygwin "
4446| [15065] Apache-SSL has a default password
4447| [15041] Apache HTTP Server mod_digest module could allow an attacker to replay responses
4448| [15015] Apache httpd server httpd.conf could allow a local user to bypass restrictions
4449| [14751] Apache Mod_python output filter information disclosure
4450| [14125] Apache HTTP Server mod_userdir module information disclosure
4451| [14075] Apache HTTP Server mod_php file descriptor leak
4452| [13703] Apache HTTP Server account
4453| [13689] Apache HTTP Server configuration allows symlinks
4454| [13688] Apache HTTP Server configuration allows SSI
4455| [13687] Apache HTTP Server Server: header value
4456| [13685] Apache HTTP Server ServerTokens value
4457| [13684] Apache HTTP Server ServerSignature value
4458| [13672] Apache HTTP Server config allows directory autoindexing
4459| [13671] Apache HTTP Server default content
4460| [13670] Apache HTTP Server config file directive references outside content root
4461| [13668] Apache HTTP Server httpd not running in chroot environment
4462| [13666] Apache HTTP Server CGI directory contains possible command interpreter or compiler
4463| [13664] Apache HTTP Server config file contains ScriptAlias entry
4464| [13663] Apache HTTP Server CGI support modules loaded
4465| [13661] Apache HTTP Server config file contains AddHandler entry
4466| [13660] Apache HTTP Server 500 error page not CGI script
4467| [13659] Apache HTTP Server 413 error page not CGI script
4468| [13658] Apache HTTP Server 403 error page not CGI script
4469| [13657] Apache HTTP Server 401 error page not CGI script
4470| [13552] Apache HTTP Server mod_cgid module information disclosure
4471| [13550] Apache GET request directory traversal
4472| [13516] Apache Cocoon XMLForm and JXForm could allow execution of code
4473| [13499] Apache Cocoon directory traversal allows downloading of boot.ini file
4474| [13429] Apache Tomcat non-HTTP request denial of service
4475| [13400] Apache HTTP server mod_alias and mod_rewrite buffer overflow
4476| [13295] Apache weak password encryption
4477| [13254] Apache Tomcat .jsp cross-site scripting
4478| [13125] Apache::Gallery Inline::C could allow arbitrary code execution
4479| [13086] Apache Jakarta Tomcat mod_jk format string allows remote access
4480| [12681] Apache HTTP Server mod_proxy could allow mail relaying
4481| [12662] Apache HTTP Server rotatelogs denial of service
4482| [12554] Apache Tomcat stores password in plain text
4483| [12553] Apache HTTP Server redirects and subrequests denial of service
4484| [12552] Apache HTTP Server FTP proxy server denial of service
4485| [12551] Apache HTTP Server prefork MPM denial of service
4486| [12550] Apache HTTP Server weaker than expected encryption
4487| [12549] Apache HTTP Server type-map file denial of service
4488| [12206] Apache Tomcat /opt/tomcat directory insecure permissions
4489| [12102] Apache Jakarta Tomcat MS-DOS device name request denial of service
4490| [12091] Apache HTTP Server apr_password_validate denial of service
4491| [12090] Apache HTTP Server apr_psprintf code execution
4492| [11804] Apache HTTP Server mod_access_referer denial of service
4493| [11750] Apache HTTP Server could leak sensitive file descriptors
4494| [11730] Apache HTTP Server error log and access log terminal escape sequence injection
4495| [11703] Apache long slash path allows directory listing
4496| [11695] Apache HTTP Server LF (Line Feed) denial of service
4497| [11694] Apache HTTP Server filestat.c denial of service
4498| [11438] Apache HTTP Server MIME message boundaries information disclosure
4499| [11412] Apache HTTP Server error log terminal escape sequence injection
4500| [11196] Apache Tomcat examples and ROOT Web applications cross-site scripting
4501| [11195] Apache Tomcat web.xml could be used to read files
4502| [11194] Apache Tomcat URL appended with a null character could list directories
4503| [11139] Apache HTTP Server mass virtual hosting with mod_rewrite or mod_vhost_alias could allow an attacker to obtain files
4504| [11126] Apache HTTP Server illegal character file disclosure
4505| [11125] Apache HTTP Server DOS device name HTTP POST code execution
4506| [11124] Apache HTTP Server DOS device name denial of service
4507| [11088] Apache HTTP Server mod_vhost_alias CGI source disclosure
4508| [10938] Apache HTTP Server printenv test CGI cross-site scripting
4509| [10771] Apache Tomcat mod_jk module multiple HTTP GET request buffer overflow
4510| [10575] Apache mod_php module could allow an attacker to take over the httpd process
4511| [10499] Apache HTTP Server WebDAV HTTP POST view source
4512| [10457] Apache HTTP Server mod_ssl "
4513| [10415] Apache HTTP Server htdigest insecure system() call could allow command execution
4514| [10414] Apache HTTP Server htdigest multiple buffer overflows
4515| [10413] Apache HTTP Server htdigest temporary file race condition
4516| [10412] Apache HTTP Server htpasswd temporary file race condition
4517| [10376] Apache Tomcat invoker servlet used in conjunction with the default servlet reveals source code
4518| [10348] Apache Tomcat HTTP GET request DOS device reference could cause a denial of service
4519| [10281] Apache HTTP Server ab.c ApacheBench long response buffer overflow
4520| [10280] Apache HTTP Server shared memory scorecard overwrite
4521| [10263] Apache Tomcat mod_jk or mod_jserv connector directory disclosure
4522| [10241] Apache HTTP Server Host: header cross-site scripting
4523| [10230] Slapper worm variants A, B, and C target OpenSSL/Apache systems
4524| [10208] Apache HTTP Server mod_dav denial of service
4525| [10206] HP VVOS Apache mod_ssl denial of service
4526| [10200] Apache HTTP Server stderr denial of service
4527| [10175] Apache Tomcat org.apache.catalina.servlets.DefaultServlet reveals source code
4528| [10169] Slapper worm variant (Slapper.C) targets OpenSSL/Apache systems
4529| [10154] Slapper worm variant (Slapper.B) targets OpenSSL/Apache systems
4530| [10098] Slapper worm targets OpenSSL/Apache systems
4531| [9876] Apache HTTP Server cgi/cgid request could disclose the path to a requested script
4532| [9875] Apache HTTP Server .var file request could disclose installation path
4533| [9863] Apache Tomcat web.xml file could allow a remote attacker to bypass restrictions
4534| [9808] Apache HTTP Server non-Unix version URL encoded directory traversal
4535| [9623] Apache HTTP Server ap_log_rerror() path disclosure
4536| [9520] Apache Tomcat /servlet/ mapping cross-site scripting
4537| [9415] Apache HTTP Server mod_ssl .htaccess off-by-one buffer overflow
4538| [9396] Apache Tomcat null character to threads denial of service
4539| [9394] Apache Tomcat HTTP request for LPT9 reveals Web root path
4540| [9249] Apache HTTP Server chunked encoding heap buffer overflow
4541| [9208] Apache Tomcat sample file requests could reveal directory listing and path to Web root directory
4542| [8932] Apache Tomcat example class information disclosure
4543| [8633] Apache HTTP Server with mod_rewrite could allow an attacker to bypass directives
4544| [8629] Apache HTTP Server double-reverse DNS lookup spoofing
4545| [8589] Apache HTTP Server for Windows DOS batch file remote command execution
4546| [8457] Oracle9i Application Server Apache PL/SQL HTTP Location header buffer overflow
4547| [8455] Oracle9i Application Server default installation could allow an attacker to access certain Apache Services
4548| [8400] Apache HTTP Server mod_frontpage buffer overflows
4549| [8326] Apache HTTP Server multiple MIME headers (sioux) denial of service
4550| [8308] Apache "
4551| [8275] Apache HTTP Server with Multiviews enabled could disclose directory contents
4552| [8119] Apache and PHP OPTIONS request reveals "
4553| [8054] Apache is running on the system
4554| [8029] Mandrake Linux default Apache configuration could allow an attacker to browse files and directories
4555| [8027] Mandrake Linux default Apache configuration has remote management interface enabled
4556| [8026] Mandrake Linux Apache sample programs could disclose sensitive information about the server
4557| [7836] Apache HTTP Server log directory denial of service
4558| [7815] Apache for Windows "
4559| [7810] Apache HTTP request could result in unexpected behavior
4560| [7599] Apache Tomcat reveals installation path
4561| [7494] Apache "
4562| [7419] Apache Web Server could allow remote attackers to overwrite .log files
4563| [7363] Apache Web Server hidden HTTP requests
4564| [7249] Apache mod_proxy denial of service
4565| [7129] Linux with Apache Web server could allow an attacker to determine if a specified username exists
4566| [7103] Apple Mac OS X used with Apache Web server could disclose directory contents
4567| [7059] Apache "
4568| [7057] Apache "
4569| [7056] Apache "
4570| [7055] Apache "
4571| [7054] Apache "
4572| [6997] Apache Jakarta Tomcat error message may reveal information
4573| [6971] Apache Jakarta Tomcat may reveal JSP source code with missing HTTP protocol specification
4574| [6970] Apache crafted HTTP request could reveal the internal IP address
4575| [6921] Apache long slash path allows directory listing
4576| [6687] Apple Mac OS X used with Apache Web server could allow arbitrary file disclosure
4577| [6527] Apache Web Server for Windows and OS2 denial of service
4578| [6316] Apache Jakarta Tomcat may reveal JSP source code
4579| [6305] Apache Jakarta Tomcat directory traversal
4580| [5926] Linux Apache symbolic link
4581| [5659] Apache Web server discloses files when used with php script
4582| [5310] Apache mod_rewrite allows attacker to view arbitrary files
4583| [5204] Apache WebDAV directory listings
4584| [5197] Apache Web server reveals CGI script source code
4585| [5160] Apache Jakarta Tomcat default installation
4586| [5099] Trustix Secure Linux installs Apache with world writable access
4587| [4968] Apache Jakarta Tomcat snoop servlet gives out information which could be used in attack
4588| [4967] Apache Jakarta Tomcat 404 error reveals the pathname of the requested file
4589| [4931] Apache source.asp example file allows users to write to files
4590| [4575] IBM HTTP Server running Apache allows users to directory listing and file retrieval
4591| [4205] Apache Jakarta Tomcat delivers file contents
4592| [2084] Apache on Debian by default serves the /usr/doc directory
4593| [1630] MessageMedia UnityMail and Apache Web server MIME header flood denial of service
4594| [697] Apache HTTP server beck exploit
4595| [331] Apache cookies buffer overflow
4596|
4597| Exploit-DB - https://www.exploit-db.com:
4598| [31130] Apache Tomcat <= 6.0.15 Cookie Quote Handling Remote Information Disclosure Vulnerability
4599| [31052] Apache <= 2.2.6 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
4600| [30901] Apache HTTP Server 2.2.6 Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
4601| [30835] Apache HTTP Server <= 2.2.4 413 Error HTTP Request Method Cross-Site Scripting Weakness
4602| [30563] Apache Tomcat <= 5.5.15 Cal2.JSP Cross-Site Scripting Vulnerability
4603| [30496] Apache Tomcat <= 6.0.13 Cookie Handling Quote Delimiter Session ID Disclosure
4604| [30495] Apache Tomcat <= 6.0.13 Host Manager Servlet Cross Site Scripting Vulnerability
4605| [30191] Apache MyFaces Tomahawk JSF Framework 1.1.5 Autoscroll Parameter Cross Site Scripting Vulnerability
4606| [30189] Apache Tomcat <= 6.0.13 JSP Example Web Applications Cross Site Scripting Vulnerability
4607| [30052] Apache Tomcat 6.0.10 Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
4608| [29930] Apache AXIS 1.0 Non-Existent WSDL Path Information Disclosure Vulnerability
4609| [29859] Apache Roller OGNL Injection
4610| [29739] Apache HTTP Server Tomcat 5.x/6.0.x Directory Traversal Vulnerability
4611| [29435] Apache Tomcat 5.5.25 - CSRF Vulnerabilities
4612| [29316] Apache + PHP 5.x - Remote Code Execution (Multithreaded Scanner) (2)
4613| [29290] Apache / PHP 5.x Remote Code Execution Exploit
4614| [28713] Apache Tomcat/JBoss EJBInvokerServlet / JMXInvokerServlet (RMI over HTTP) Marshalled Object RCE
4615| [28424] Apache 2.x HTTP Server Arbitrary HTTP Request Headers Security Weakness
4616| [28365] Apache 2.2.2 CGI Script Source Code Information Disclosure Vulnerability
4617| [28254] Apache Tomcat 5 Information Disclosure Vulnerability
4618| [27915] Apache James 2.2 SMTP Denial of Service Vulnerability
4619| [27397] Apache suEXEC Privilege Elevation / Information Disclosure
4620| [27135] Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
4621| [27096] Apache Geronimo 1.0 Error Page XSS
4622| [27095] Apache Tomcat / Geronimo 1.0 Sample Script cal2.jsp time Parameter XSS
4623| [26710] Apache CXF prior to 2.5.10, 2.6.7 and 2.7.4 - Denial of Service
4624| [26542] Apache Struts 1.2.7 Error Response Cross-Site Scripting Vulnerability
4625| [25986] Plesk Apache Zeroday Remote Exploit
4626| [25980] Apache Struts includeParams Remote Code Execution
4627| [25625] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (2)
4628| [25624] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (1)
4629| [24874] Apache Struts ParametersInterceptor Remote Code Execution
4630| [24744] Apache Rave 0.11 - 0.20 - User Information Disclosure
4631| [24694] Apache 1.3.x mod_include Local Buffer Overflow Vulnerability
4632| [24590] Apache 2.0.x mod_ssl Remote Denial of Service Vulnerability
4633| [23751] Apache Cygwin 1.3.x/2.0.x Directory Traversal Vulnerability
4634| [23581] Apache 2.0.4x mod_perl Module File Descriptor Leakage Vulnerability
4635| [23482] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (2)
4636| [23481] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (1)
4637| [23296] Red Hat Apache 2.0.40 Directory Index Default Configuration Error
4638| [23282] apache cocoon 2.14/2.2 - Directory Traversal vulnerability
4639| [23245] Apache Tomcat 4.0.x Non-HTTP Request Denial of Service Vulnerability
4640| [23119] Apache::Gallery 0.4/0.5/0.6 Insecure Local File Storage Privilege Escalation Vulnerability
4641| [22505] Apache Mod_Access_Referer 1.0.2 NULL Pointer Dereference Denial of Service Vulnerability
4642| [22205] Apache Tomcat 3.x Null Byte Directory/File Disclosure Vulnerability
4643| [22191] Apache Web Server 2.0.x MS-DOS Device Name Denial of Service Vulnerability
4644| [22068] Apache 1.3.x,Tomcat 4.0.x/4.1.x Mod_JK Chunked Encoding Denial of Service Vulnerability
4645| [21885] Apache 1.3/2.0.x Server Side Include Cross Site Scripting Vulnerability
4646| [21882] Apache Tomcat 3.2 Directory Disclosure Vulnerability
4647| [21854] Apache 2.0.39/40 Oversized STDERR Buffer Denial of Service Vulnerability
4648| [21853] Apache Tomcat 3/4 DefaultServlet File Disclosure Vulnerability
4649| [21734] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
4650| [21719] Apache 2.0 Path Disclosure Vulnerability
4651| [21697] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
4652| [21605] Apache Tomcat 4.0.3 DoS Device Name Cross Site Scripting Vulnerability
4653| [21604] Apache Tomcat 4.0.3 Servlet Mapping Cross Site Scripting Vulnerability
4654| [21560] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (2)
4655| [21559] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (1)
4656| [21534] Apache Tomcat 3/4 JSP Engine Denial of Service Vulnerability
4657| [21492] Apache Tomcat 3.2.3/3.2.4 RealPath.JSP Malformed Request Information Disclosure
4658| [21491] Apache Tomcat 3.2.3/3.2.4 Example Files Web Root Path Disclosure
4659| [21490] Apache Tomcat 3.2.3/3.2.4 Source.JSP Malformed Request Information Disclosure
4660| [21412] Apache Tomcat 4.0/4.1 Servlet Path Disclosure Vulnerability
4661| [21350] Apache Win32 1.3.x/2.0.x Batch File Remote Command Execution Vulnerability
4662| [21204] Apache 1.3.20 Win32 PHP.EXE Remote File Disclosure Vulnerability
4663| [21112] Red Hat Linux 7.0 Apache Remote Username Enumeration Vulnerability
4664| [21067] Apache 1.0/1.2/1.3 Server Address Disclosure Vulnerability
4665| [21002] Apache 1.3 Possible Directory Index Disclosure Vulnerability
4666| [20911] Apache 1.3.14 Mac File Protection Bypass Vulnerability
4667| [20716] apache tomcat 3.0 - Directory Traversal vulnerability
4668| [20695] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (4)
4669| [20694] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (3)
4670| [20693] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (2)
4671| [20692] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (1)
4672| [20595] NCSA 1.3/1.4.x/1.5,Apache httpd 0.8.11/0.8.14 ScriptAlias Source Retrieval Vulnerability
4673| [20558] Apache 1.2 Web Server DoS Vulnerability
4674| [20466] Apache 1.3 Web Server with Php 3 File Disclosure Vulnerability
4675| [20435] Apache 0.8.x/1.0.x,NCSA httpd 1.x test-cgi Directory Listing Vulnerability
4676| [20272] Apache 1.2.5/1.3.1,UnityMail 2.0 MIME Header DoS Vulnerability
4677| [20210] Apache 1.3.12 WebDAV Directory Listings Vulnerability
4678| [20131] Apache Tomcat 3.1 Path Revealing Vulnerability
4679| [19975] Apache 1.3.6/1.3.9/1.3.11/1.3.12/1.3.20 Root Directory Access Vulnerability
4680| [19828] Cobalt RaQ 2.0/3.0 Apache .htaccess Disclosure Vulnerability
4681| [19536] Apache <= 1.1,NCSA httpd <= 1.5.2,Netscape Server 1.12/1.1/2.0 a nph-test-cgi Vulnerability
4682| [19231] PHP apache_request_headers Function Buffer Overflow
4683| [18984] Apache Struts <= 2.2.1.1 - Remote Command Execution
4684| [18897] Oracle Weblogic Apache Connector POST Request Buffer Overflow
4685| [18619] Apache Tomcat Remote Exploit (PUT Request) and Account Scanner
4686| [18452] Apache Struts Multiple Persistent Cross-Site Scripting Vulnerabilities
4687| [18442] Apache httpOnly Cookie Disclosure
4688| [18329] Apache Struts2 <= 2.3.1 - Multiple Vulnerabilities
4689| [18221] Apache HTTP Server Denial of Service
4690| [17969] Apache mod_proxy Reverse Proxy Exposure Vulnerability PoC
4691| [17696] Apache httpd Remote Denial of Service (memory exhaustion)
4692| [17691] Apache Struts < 2.2.0 - Remote Command Execution
4693| [16798] Apache mod_jk 1.2.20 Buffer Overflow
4694| [16782] Apache Win32 Chunked Encoding
4695| [16752] Apache module mod_rewrite LDAP protocol Buffer Overflow
4696| [16317] Apache Tomcat Manager Application Deployer Authenticated Code Execution
4697| [15710] Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability
4698| [15319] Apache 2.2 (Windows) Local Denial of Service
4699| [14617] Apache JackRabbit 2.0.0 webapp XPath Injection
4700| [14489] Apache Tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
4701| [12721] Apache Axis2 1.4.1 - Local File Inclusion Vulnerability
4702| [12689] Authenticated Cross-Site Scripting Vulnerability (XSS) within Apache Axis2 administration console
4703| [12343] Apache Tomcat 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 - Information Disclosure Vulnerability
4704| [12330] Apache OFBiz - Multiple XSS
4705| [12264] Apache OFBiz - FULLADMIN Creator PoC Payload
4706| [12263] Apache OFBiz - SQL Remote Execution PoC Payload
4707| [11662] Apache Spamassassin Milter Plugin Remote Root Command Execution
4708| [11650] Apache 2.2.14 mod_isapi Dangling Pointer Remote SYSTEM Exploit
4709| [10811] Joomla.Tutorials GHDB: Apache directory listing Download Vulnerability
4710| [10292] Apache Tomcat 3.2.1 - 404 Error Page Cross Site Scripting Vulnerability
4711| [9995] Apache Tomcat Form Authentication Username Enumeration Weakness
4712| [9994] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
4713| [9993] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
4714| [8842] Apache mod_dav / svn Remote Denial of Service Exploit
4715| [8458] Apache Geronimo <= 2.1.3 - Multiple Directory Traversal Vulnerabilities
4716| [7264] Apache Tomcat runtime.getRuntime().exec() Privilege Escalation (win)
4717| [6229] apache tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
4718| [6100] Apache mod_jk 1.2.19 Remote Buffer Overflow Exploit (win32)
4719| [6089] Bea Weblogic Apache Connector Code Exec / Denial of Service Exploit
4720| [5386] Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit
4721| [5330] Apache 2.0 mod_jk2 2.0.2 - Remote Buffer Overflow Exploit (win32)
4722| [4552] Apache Tomcat (webdav) Remote File Disclosure Exploit (ssl support)
4723| [4530] Apache Tomcat (webdav) Remote File Disclosure Exploit
4724| [4162] Apache Tomcat Connector (mod_jk) Remote Exploit (exec-shield)
4725| [4093] Apache mod_jk 1.2.19/1.2.20 Remote Buffer Overflow Exploit
4726| [3996] Apache 2.0.58 mod_rewrite Remote Overflow Exploit (win2k3)
4727| [3680] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
4728| [3384] Ubuntu/Debian Apache 1.3.33/1.3.34 (CGI TTY) Local Root Exploit
4729| [2237] Apache < 1.3.37, 2.0.59, 2.2.3 (mod_rewrite) Remote Overflow PoC
4730| [2061] Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
4731| [1056] Apache <= 2.0.49 Arbitrary Long HTTP Headers Denial of Service
4732| [855] Apache <= 2.0.52 HTTP GET request Denial of Service Exploit
4733| [764] Apache OpenSSL - Remote Exploit (Multiple Targets) (OpenFuckV2.c)
4734| [587] Apache <= 1.3.31 mod_include Local Buffer Overflow Exploit
4735| [466] htpasswd Apache 1.3.31 - Local Exploit
4736| [371] Apache HTTPd Arbitrary Long HTTP Headers DoS (c version)
4737| [360] Apache HTTPd Arbitrary Long HTTP Headers DoS
4738| [132] Apache 1.3.x - 2.0.48 - mod_userdir Remote Users Disclosure Exploit
4739| [126] Apache mod_gzip (with debug_mode) <= 1.2.26.1a Remote Exploit
4740| [67] Apache 1.3.x mod_mylo Remote Code Execution Exploit
4741| [38] Apache <= 2.0.45 APR Remote Exploit -Apache-Knacker.pl
4742| [34] Webfroot Shoutbox < 2.32 (Apache) Remote Exploit
4743| [11] Apache <= 2.0.44 Linux Remote Denial of Service Exploit
4744| [9] Apache HTTP Server 2.x Memory Leak Exploit
4745|
4746| OpenVAS (Nessus) - http://www.openvas.org:
4747| [902924] Apache Struts2 Showcase Skill Name Remote Code Execution Vulnerability
4748| [902837] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability (Windows)
4749| [902830] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
4750| [902664] Apache Traffic Server HTTP Host Header Denial of Service Vulnerability
4751| [901203] Apache httpd Web Server Range Header Denial of Service Vulnerability
4752| [901110] Apache ActiveMQ Source Code Information Disclosure Vulnerability
4753| [901105] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
4754| [900842] Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux)
4755| [900841] Apache 'mod_proxy_ftp' Module Denial Of Service Vulnerability (Linux)
4756| [900573] Apache APR-Utils XML Parser Denial of Service Vulnerability
4757| [900572] Apache APR-Utils Multiple Denial of Service Vulnerabilities
4758| [900571] Apache APR-Utils Version Detection
4759| [900499] Apache mod_proxy_ajp Information Disclosure Vulnerability
4760| [900496] Apache Tiles Multiple XSS Vulnerability
4761| [900493] Apache Tiles Version Detection
4762| [900107] Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability
4763| [900021] Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities
4764| [880086] CentOS Update for apache CESA-2008:0004-01 centos2 i386
4765| [870175] RedHat Update for apache RHSA-2008:0004-01
4766| [864591] Fedora Update for apache-poi FEDORA-2012-10835
4767| [864383] Fedora Update for apache-commons-compress FEDORA-2012-8428
4768| [864280] Fedora Update for apache-commons-compress FEDORA-2012-8465
4769| [864250] Fedora Update for apache-poi FEDORA-2012-7683
4770| [864249] Fedora Update for apache-poi FEDORA-2012-7686
4771| [863993] Fedora Update for apache-commons-daemon FEDORA-2011-10880
4772| [863466] Fedora Update for apache-commons-daemon FEDORA-2011-10936
4773| [855821] Solaris Update for Apache 1.3 122912-19
4774| [855812] Solaris Update for Apache 1.3 122911-19
4775| [855737] Solaris Update for Apache 1.3 122911-17
4776| [855731] Solaris Update for Apache 1.3 122912-17
4777| [855695] Solaris Update for Apache 1.3 122911-16
4778| [855645] Solaris Update for Apache 1.3 122912-16
4779| [855587] Solaris Update for kernel update and Apache 108529-29
4780| [855566] Solaris Update for Apache 116973-07
4781| [855531] Solaris Update for Apache 116974-07
4782| [855524] Solaris Update for Apache 2 120544-14
4783| [855494] Solaris Update for Apache 1.3 122911-15
4784| [855478] Solaris Update for Apache Security 114145-11
4785| [855472] Solaris Update for Apache Security 113146-12
4786| [855179] Solaris Update for Apache 1.3 122912-15
4787| [855147] Solaris Update for kernel update and Apache 108528-29
4788| [855077] Solaris Update for Apache 2 120543-14
4789| [850196] SuSE Update for apache2 openSUSE-SU-2012:0314-1 (apache2)
4790| [850088] SuSE Update for apache2 SUSE-SA:2007:061
4791| [850009] SuSE Update for apache2,apache SUSE-SA:2008:021
4792| [841209] Ubuntu Update for apache2 USN-1627-1
4793| [840900] Ubuntu Update for apache2 USN-1368-1
4794| [840798] Ubuntu Update for apache2 USN-1259-1
4795| [840734] Ubuntu Update for apache2 USN-1199-1
4796| [840542] Ubuntu Update for apache2 vulnerabilities USN-1021-1
4797| [840504] Ubuntu Update for apache2 vulnerability USN-990-2
4798| [840399] Ubuntu Update for apache2 vulnerabilities USN-908-1
4799| [840304] Ubuntu Update for apache2 vulnerabilities USN-575-1
4800| [840118] Ubuntu Update for libapache2-mod-perl2 vulnerability USN-488-1
4801| [840092] Ubuntu Update for apache2 vulnerabilities USN-499-1
4802| [840039] Ubuntu Update for libapache2-mod-python vulnerability USN-430-1
4803| [835253] HP-UX Update for Apache Web Server HPSBUX02645
4804| [835247] HP-UX Update for Apache-based Web Server HPSBUX02612
4805| [835243] HP-UX Update for Apache Running Tomcat Servlet Engine HPSBUX02579
4806| [835236] HP-UX Update for Apache with PHP HPSBUX02543
4807| [835233] HP-UX Update for Apache-based Web Server HPSBUX02531
4808| [835224] HP-UX Update for Apache-based Web Server HPSBUX02465
4809| [835200] HP-UX Update for Apache Web Server Suite HPSBUX02431
4810| [835190] HP-UX Update for Apache Web Server Suite HPSBUX02401
4811| [835188] HP-UX Update for Apache HPSBUX02308
4812| [835181] HP-UX Update for Apache With PHP HPSBUX02332
4813| [835180] HP-UX Update for Apache with PHP HPSBUX02342
4814| [835172] HP-UX Update for Apache HPSBUX02365
4815| [835168] HP-UX Update for Apache HPSBUX02313
4816| [835148] HP-UX Update for Apache HPSBUX01064
4817| [835139] HP-UX Update for Apache with PHP HPSBUX01090
4818| [835131] HP-UX Update for Apache HPSBUX00256
4819| [835119] HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186
4820| [835104] HP-UX Update for Apache HPSBUX00224
4821| [835103] HP-UX Update for Apache mod_cgid HPSBUX00301
4822| [835101] HP-UX Update for Apache HPSBUX01232
4823| [835080] HP-UX Update for Apache HPSBUX02273
4824| [835078] HP-UX Update for ApacheStrong HPSBUX00255
4825| [835044] HP-UX Update for Apache HPSBUX01019
4826| [835040] HP-UX Update for Apache PHP HPSBUX00207
4827| [835025] HP-UX Update for Apache HPSBUX00197
4828| [835023] HP-UX Update for Apache HPSBUX01022
4829| [835022] HP-UX Update for Apache HPSBUX02292
4830| [835005] HP-UX Update for Apache HPSBUX02262
4831| [831759] Mandriva Update for apache-mod_security MDVSA-2012:182 (apache-mod_security)
4832| [831737] Mandriva Update for apache MDVSA-2012:154-1 (apache)
4833| [831534] Mandriva Update for apache MDVSA-2012:012 (apache)
4834| [831523] Mandriva Update for apache MDVSA-2012:003 (apache)
4835| [831491] Mandriva Update for apache MDVSA-2011:168 (apache)
4836| [831460] Mandriva Update for apache MDVSA-2011:144 (apache)
4837| [831449] Mandriva Update for apache MDVSA-2011:130 (apache)
4838| [831357] Mandriva Update for apache MDVSA-2011:057 (apache)
4839| [831132] Mandriva Update for apache MDVSA-2010:153 (apache)
4840| [831131] Mandriva Update for apache MDVSA-2010:152 (apache)
4841| [830989] Mandriva Update for apache-mod_auth_shadow MDVSA-2010:081 (apache-mod_auth_shadow)
4842| [830931] Mandriva Update for apache MDVSA-2010:057 (apache)
4843| [830926] Mandriva Update for apache MDVSA-2010:053 (apache)
4844| [830918] Mandriva Update for apache-mod_security MDVSA-2010:050 (apache-mod_security)
4845| [830799] Mandriva Update for apache-conf MDVSA-2009:300-2 (apache-conf)
4846| [830797] Mandriva Update for apache-conf MDVSA-2009:300-1 (apache-conf)
4847| [830791] Mandriva Update for apache-conf MDVA-2010:011 (apache-conf)
4848| [830652] Mandriva Update for apache MDVSA-2008:195 (apache)
4849| [830621] Mandriva Update for apache-conf MDVA-2008:129 (apache-conf)
4850| [830581] Mandriva Update for apache MDVSA-2008:016 (apache)
4851| [830294] Mandriva Update for apache MDKSA-2007:140 (apache)
4852| [830196] Mandriva Update for apache MDKSA-2007:235 (apache)
4853| [830112] Mandriva Update for apache MDKSA-2007:127 (apache)
4854| [830109] Mandriva Update for apache-mod_perl MDKSA-2007:083 (apache-mod_perl)
4855| [802425] Apache Struts2 Showcase Arbitrary Java Method Execution vulnerability
4856| [802423] Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities
4857| [802422] Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities
4858| [802415] Apache Tomcat Multiple Security Bypass Vulnerabilities (Win)
4859| [802385] Apache Tomcat Request Object Security Bypass Vulnerability (Win)
4860| [802384] Apache Tomcat Parameter Handling Denial of Service Vulnerability (Win)
4861| [802378] Apache Tomcat Hash Collision Denial Of Service Vulnerability
4862| [801942] Apache Archiva Multiple Vulnerabilities
4863| [801940] Apache Struts2 'XWork' Information Disclosure Vulnerability
4864| [801663] Apache Struts2/XWork Remote Command Execution Vulnerability
4865| [801521] Apache APR-util 'buckets/apr_brigade.c' Denial Of Service Vulnerability
4866| [801284] Apache Derby Information Disclosure Vulnerability
4867| [801203] Apache ActiveMQ Persistent Cross-Site Scripting Vulnerability
4868| [800837] Apache 'mod_deflate' Denial Of Service Vulnerability - July09
4869| [800827] Apache 'mod_proxy_http.c' Denial Of Service Vulnerability
4870| [800680] Apache APR Version Detection
4871| [800679] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
4872| [800678] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
4873| [800677] Apache Roller Version Detection
4874| [800279] Apache mod_jk Module Version Detection
4875| [800278] Apache Struts Cross Site Scripting Vulnerability
4876| [800277] Apache Tomcat mod_jk Information Disclosure Vulnerability
4877| [800276] Apache Struts Version Detection
4878| [800271] Apache Struts Directory Traversal Vulnerability
4879| [800024] Apache Tomcat RemoteFilterValve Security Bypass Vulnerability
4880| [103333] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
4881| [103293] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
4882| [103122] Apache Web Server ETag Header Information Disclosure Weakness
4883| [103074] Apache Continuum Cross Site Scripting Vulnerability
4884| [103073] Apache Continuum Detection
4885| [103053] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
4886| [101023] Apache Open For Business Weak Password security check
4887| [101020] Apache Open For Business HTML injection vulnerability
4888| [101019] Apache Open For Business service detection
4889| [100924] Apache Archiva Cross Site Request Forgery Vulnerability
4890| [100923] Apache Archiva Detection
4891| [100858] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
4892| [100814] Apache Axis2 Document Type Declaration Processing Security Vulnerability
4893| [100813] Apache Axis2 Detection
4894| [100797] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
4895| [100795] Apache Derby Detection
4896| [100762] Apache CouchDB Cross Site Request Forgery Vulnerability
4897| [100725] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
4898| [100613] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
4899| [100514] Apache Multiple Security Vulnerabilities
4900| [100211] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
4901| [100172] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
4902| [100171] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
4903| [100130] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
4904| [72626] Debian Security Advisory DSA 2579-1 (apache2)
4905| [72612] FreeBSD Ports: apache22
4906| [71551] Gentoo Security Advisory GLSA 201206-25 (apache)
4907| [71550] Gentoo Security Advisory GLSA 201206-24 (apache tomcat)
4908| [71512] FreeBSD Ports: apache
4909| [71485] Debian Security Advisory DSA 2506-1 (libapache-mod-security)
4910| [71256] Debian Security Advisory DSA 2452-1 (apache2)
4911| [71238] Debian Security Advisory DSA 2436-1 (libapache2-mod-fcgid)
4912| [70737] FreeBSD Ports: apache
4913| [70724] Debian Security Advisory DSA 2405-1 (apache2)
4914| [70600] FreeBSD Ports: apache
4915| [70253] FreeBSD Ports: apache, apache-event, apache-itk, apache-peruser, apache-worker
4916| [70235] Debian Security Advisory DSA 2298-2 (apache2)
4917| [70233] Debian Security Advisory DSA 2298-1 (apache2)
4918| [69988] Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)
4919| [69338] Debian Security Advisory DSA 2202-1 (apache2)
4920| [67868] FreeBSD Ports: apache
4921| [66816] FreeBSD Ports: apache
4922| [66553] Mandriva Security Advisory MDVSA-2009:189-1 (apache-mod_auth_mysql)
4923| [66414] Mandriva Security Advisory MDVSA-2009:323 (apache)
4924| [66106] SuSE Security Advisory SUSE-SA:2009:050 (apache2,libapr1)
4925| [66081] SLES11: Security update for Apache 2
4926| [66074] SLES10: Security update for Apache 2
4927| [66070] SLES9: Security update for Apache 2
4928| [65998] SLES10: Security update for apache2-mod_python
4929| [65893] SLES10: Security update for Apache 2
4930| [65888] SLES10: Security update for Apache 2
4931| [65575] SLES9: Security update for apache2,apache2-prefork,apache2-worker
4932| [65510] SLES9: Security update for Apache 2
4933| [65472] SLES9: Security update for Apache
4934| [65467] SLES9: Security update for Apache
4935| [65450] SLES9: Security update for apache2
4936| [65390] SLES9: Security update for Apache2
4937| [65363] SLES9: Security update for Apache2
4938| [65309] SLES9: Security update for Apache and mod_ssl
4939| [65296] SLES9: Security update for webdav apache module
4940| [65283] SLES9: Security update for Apache2
4941| [65249] SLES9: Security update for Apache 2
4942| [65230] SLES9: Security update for Apache 2
4943| [65228] SLES9: Security update for Apache 2
4944| [65212] SLES9: Security update for apache2-mod_python
4945| [65209] SLES9: Security update for apache2-worker
4946| [65207] SLES9: Security update for Apache 2
4947| [65168] SLES9: Security update for apache2-mod_python
4948| [65142] SLES9: Security update for Apache2
4949| [65136] SLES9: Security update for Apache 2
4950| [65132] SLES9: Security update for apache
4951| [65131] SLES9: Security update for Apache 2 oes/CORE
4952| [65113] SLES9: Security update for apache2
4953| [65072] SLES9: Security update for apache and mod_ssl
4954| [65017] SLES9: Security update for Apache 2
4955| [64950] Mandrake Security Advisory MDVSA-2009:240 (apache)
4956| [64783] FreeBSD Ports: apache
4957| [64774] Ubuntu USN-802-2 (apache2)
4958| [64653] Ubuntu USN-813-2 (apache2)
4959| [64559] Debian Security Advisory DSA 1834-2 (apache2)
4960| [64532] Mandrake Security Advisory MDVSA-2009:189 (apache-mod_auth_mysql)
4961| [64527] Mandrake Security Advisory MDVSA-2009:184 (apache-mod_security)
4962| [64526] Mandrake Security Advisory MDVSA-2009:183 (apache-mod_security)
4963| [64500] Mandrake Security Advisory MDVSA-2009:168 (apache)
4964| [64443] Ubuntu USN-802-1 (apache2)
4965| [64426] Gentoo Security Advisory GLSA 200907-04 (apache)
4966| [64423] Debian Security Advisory DSA 1834-1 (apache2)
4967| [64391] Mandrake Security Advisory MDVSA-2009:149 (apache)
4968| [64377] Mandrake Security Advisory MDVSA-2009:124-1 (apache)
4969| [64251] Debian Security Advisory DSA 1816-1 (apache2)
4970| [64201] Ubuntu USN-787-1 (apache2)
4971| [64140] Mandrake Security Advisory MDVSA-2009:124 (apache)
4972| [64136] Mandrake Security Advisory MDVSA-2009:102 (apache)
4973| [63565] FreeBSD Ports: apache
4974| [63562] Ubuntu USN-731-1 (apache2)
4975| [61381] Gentoo Security Advisory GLSA 200807-06 (apache)
4976| [61185] FreeBSD Ports: apache
4977| [60582] Gentoo Security Advisory GLSA 200803-19 (apache)
4978| [60387] Slackware Advisory SSA:2008-045-02 apache
4979| [58826] FreeBSD Ports: apache-tomcat
4980| [58825] FreeBSD Ports: apache-tomcat
4981| [58804] FreeBSD Ports: apache
4982| [58745] Gentoo Security Advisory GLSA 200711-06 (apache)
4983| [58360] Debian Security Advisory DSA 1312-1 (libapache-mod-jk)
4984| [57851] Gentoo Security Advisory GLSA 200608-01 (apache)
4985| [57788] Debian Security Advisory DSA 1247-1 (libapache-mod-auth-kerb)
4986| [57335] Debian Security Advisory DSA 1167-1 (apache)
4987| [57201] Debian Security Advisory DSA 1131-1 (apache)
4988| [57200] Debian Security Advisory DSA 1132-1 (apache2)
4989| [57168] Slackware Advisory SSA:2006-209-01 Apache httpd
4990| [57145] FreeBSD Ports: apache
4991| [56731] Slackware Advisory SSA:2006-129-01 Apache httpd
4992| [56729] Slackware Advisory SSA:2006-130-01 Apache httpd redux
4993| [56246] Gentoo Security Advisory GLSA 200602-03 (Apache)
4994| [56212] Debian Security Advisory DSA 952-1 (libapache-auth-ldap)
4995| [56115] Debian Security Advisory DSA 935-1 (libapache2-mod-auth-pgsql)
4996| [56067] FreeBSD Ports: apache
4997| [55803] Slackware Advisory SSA:2005-310-04 apache
4998| [55519] Debian Security Advisory DSA 839-1 (apachetop)
4999| [55392] Gentoo Security Advisory GLSA 200509-12 (Apache)
5000| [55355] FreeBSD Ports: apache
5001| [55284] Debian Security Advisory DSA 807-1 (libapache-mod-ssl)
5002| [55261] Debian Security Advisory DSA 805-1 (apache2)
5003| [55259] Debian Security Advisory DSA 803-1 (apache)
5004| [55129] Gentoo Security Advisory GLSA 200508-15 (apache)
5005| [54739] Gentoo Security Advisory GLSA 200411-18 (apache)
5006| [54724] Gentoo Security Advisory GLSA 200411-03 (apache)
5007| [54712] Gentoo Security Advisory GLSA 200410-21 (apache)
5008| [54689] Gentoo Security Advisory GLSA 200409-33 (net=www/apache)
5009| [54677] Gentoo Security Advisory GLSA 200409-21 (apache)
5010| [54610] Gentoo Security Advisory GLSA 200407-03 (Apache)
5011| [54601] Gentoo Security Advisory GLSA 200406-16 (Apache)
5012| [54590] Gentoo Security Advisory GLSA 200406-05 (Apache)
5013| [54582] Gentoo Security Advisory GLSA 200405-22 (Apache)
5014| [54529] Gentoo Security Advisory GLSA 200403-04 (Apache)
5015| [54499] Gentoo Security Advisory GLSA 200310-04 (Apache)
5016| [54498] Gentoo Security Advisory GLSA 200310-03 (Apache)
5017| [54439] FreeBSD Ports: apache
5018| [53931] Slackware Advisory SSA:2004-133-01 apache
5019| [53903] Slackware Advisory SSA:2004-299-01 apache, mod_ssl, php
5020| [53902] Slackware Advisory SSA:2004-305-01 apache+mod_ssl
5021| [53878] Slackware Advisory SSA:2003-308-01 apache security update
5022| [53851] Debian Security Advisory DSA 135-1 (libapache-mod-ssl)
5023| [53849] Debian Security Advisory DSA 132-1 (apache-ssl)
5024| [53848] Debian Security Advisory DSA 131-1 (apache)
5025| [53784] Debian Security Advisory DSA 021-1 (apache)
5026| [53738] Debian Security Advisory DSA 195-1 (apache-perl)
5027| [53737] Debian Security Advisory DSA 188-1 (apache-ssl)
5028| [53735] Debian Security Advisory DSA 187-1 (apache)
5029| [53703] Debian Security Advisory DSA 532-1 (libapache-mod-ssl)
5030| [53577] Debian Security Advisory DSA 120-1 (libapache-mod-ssl, apache-ssl)
5031| [53568] Debian Security Advisory DSA 067-1 (apache,apache-ssl)
5032| [53519] Debian Security Advisory DSA 689-1 (libapache-mod-python)
5033| [53433] Debian Security Advisory DSA 181-1 (libapache-mod-ssl)
5034| [53282] Debian Security Advisory DSA 594-1 (apache)
5035| [53248] Debian Security Advisory DSA 558-1 (libapache-mod-dav)
5036| [53224] Debian Security Advisory DSA 532-2 (libapache-mod-ssl)
5037| [53215] Debian Security Advisory DSA 525-1 (apache)
5038| [53151] Debian Security Advisory DSA 452-1 (libapache-mod-python)
5039| [52529] FreeBSD Ports: apache+ssl
5040| [52501] FreeBSD Ports: apache
5041| [52461] FreeBSD Ports: apache
5042| [52390] FreeBSD Ports: apache
5043| [52389] FreeBSD Ports: apache
5044| [52388] FreeBSD Ports: apache
5045| [52383] FreeBSD Ports: apache
5046| [52339] FreeBSD Ports: apache+mod_ssl
5047| [52331] FreeBSD Ports: apache
5048| [52329] FreeBSD Ports: ru-apache+mod_ssl
5049| [52314] FreeBSD Ports: apache
5050| [52310] FreeBSD Ports: apache
5051| [15588] Detect Apache HTTPS
5052| [15555] Apache mod_proxy content-length buffer overflow
5053| [15554] Apache mod_include priviledge escalation
5054| [14771] Apache <= 1.3.33 htpasswd local overflow
5055| [14177] Apache mod_access rule bypass
5056| [13644] Apache mod_rootme Backdoor
5057| [12293] Apache Input Header Folding and mod_ssl ssl_io_filter_cleanup DoS Vulnerabilities
5058| [12280] Apache Connection Blocking Denial of Service
5059| [12239] Apache Error Log Escape Sequence Injection
5060| [12123] Apache Tomcat source.jsp malformed request information disclosure
5061| [12085] Apache Tomcat servlet/JSP container default files
5062| [11438] Apache Tomcat Directory Listing and File disclosure
5063| [11204] Apache Tomcat Default Accounts
5064| [11092] Apache 2.0.39 Win32 directory traversal
5065| [11046] Apache Tomcat TroubleShooter Servlet Installed
5066| [11042] Apache Tomcat DOS Device Name XSS
5067| [11041] Apache Tomcat /servlet Cross Site Scripting
5068| [10938] Apache Remote Command Execution via .bat files
5069| [10839] PHP.EXE / Apache Win32 Arbitrary File Reading Vulnerability
5070| [10773] MacOS X Finder reveals contents of Apache Web files
5071| [10766] Apache UserDir Sensitive Information Disclosure
5072| [10756] MacOS X Finder reveals contents of Apache Web directories
5073| [10752] Apache Auth Module SQL Insertion Attack
5074| [10704] Apache Directory Listing
5075| [10678] Apache /server-info accessible
5076| [10677] Apache /server-status accessible
5077| [10440] Check for Apache Multiple / vulnerability
5078|
5079| SecurityTracker - https://www.securitytracker.com:
5080| [1028865] Apache Struts Bugs Permit Remote Code Execution and URL Redirection Attacks
5081| [1028864] Apache Struts Wildcard Matching and Expression Evaluation Bugs Let Remote Users Execute Arbitrary Code
5082| [1028824] Apache mod_dav_svn URI Processing Flaw Lets Remote Users Deny Service
5083| [1028823] Apache Unspecified Flaw in mod_session_dbd Has Unspecified Impact
5084| [1028724] (HP Issues Fix for HP-UX) Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
5085| [1028722] (Red Hat Issues Fix for JBoss) Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
5086| [1028693] (Red Hat Issues Fix) Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
5087| [1028622] Apache Struts 'includeParams' Bugs Permit Remote Command Execution and Cross-Site Scripting Attacks
5088| [1028621] Apache Subversion Bugs Let Remote Authenticated Users Execute Arbitrary Commands and Deny Service
5089| [1028540] Apache mod_rewrite Input Validation Flaw Lets Remote Users Execute Arbitrary Commands
5090| [1028534] Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
5091| [1028533] Apache Tomcat Lack of Chunked Transfer Encoding Extension Size Limit Lets Remote Users Deny Service
5092| [1028532] Apache Tomcat AsyncListeners Bug May Disclose Information from One Request to Another User
5093| [1028515] Apache VCL Input Validation Flaw Lets Remote Authenticated Users Gain Elevated Privileges
5094| [1028457] Apache ActiveMQ Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Deny Service, and Obtain Potentially Sensitive Information
5095| [1028287] Apache CXF WSS4JInInterceptor Grants Service Access to Remote Users
5096| [1028286] Apache CXF WS-Security UsernameToken Processing Flaw Lets Remote Users Bypass Authentication
5097| [1028252] Apache Commons FileUpload Unsafe Temporary File Lets Local Users Gain Elevated Privileges
5098| [1028207] Apache Input Validation Bugs Permit Cross-Site Scripting Attacks
5099| [1027836] Apache Tomcat Connection Processing Bug Lets Remote Users Deny Service
5100| [1027834] Apache Tomcat Bug Lets Remote Users Bypass Cross-Site Request Forgery Prevention Filter
5101| [1027833] Apache Tomcat Bug Lets Remote Users Bypass Security Constraints
5102| [1027729] Apache Tomcat Header Processing Bug Lets Remote Users Deny Service
5103| [1027728] Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
5104| [1027554] Apache CXF Lets Remote Authenticated Users Execute Unauthorized SOAP Actions
5105| [1027508] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
5106| [1027421] Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
5107| [1027096] Apache Commons Compress BZip2CompressorOutputStream() Sorting Algorithm Lets Remote or Local Users Deny Service
5108| [1026932] Apache LD_LIBRARY_PATH Processing Lets Local Users Gain Elevated Privileges
5109| [1026928] Apache OFBiz Unspecified Flaw Lets Remote Users Execute Arbitrary Code
5110| [1026927] Apache OFBiz Input Validation Flaws Permit Cross-Site Scripting Attacks
5111| [1026847] Apache Traffic Server Host Header Processing Flaw Lets Remote Users Deny Service
5112| [1026846] Apache Wicket Discloses Hidden Application Files to Remote Users
5113| [1026839] Apache Wicket Input Validation Flaw in 'wicket:pageMapName' Parameter Permits Cross-Site Scripting Attacks
5114| [1026616] Apache Bugs Let Remote Users Deny Service and Obtain Cookie Data
5115| [1026575] Apache Struts ParameterInterceptor() Flaw Lets Remote Users Execute Arbitrary Commands
5116| [1026484] Apache Struts Bug Lets Remote Users Overwrite Files and Execute Arbitrary Code
5117| [1026477] Apache Tomcat Hash Table Collision Bug Lets Remote Users Deny Service
5118| [1026402] Apache Struts Conversion Error Lets Remote Users Inject Arbitrary Commands
5119| [1026353] Apache mod_proxy/mod_rewrite Bug Lets Remote Users Access Internal Servers
5120| [1026295] Apache Tomcat Lets Untrusted Web Applications Gain Elevated Privileges
5121| [1026267] Apache .htaccess File Integer Overflow Lets Local Users Execute Arbitrary Code
5122| [1026144] Apache mod_proxy Pattern Matching Bug Lets Remote Users Access Internal Servers
5123| [1026095] Apache Tomcat HTTP DIGEST Authentication Weaknesses Let Remote Users Conduct Bypass Attacks
5124| [1026054] Apache mod_proxy_ajp HTTP Processing Error Lets Remote Users Deny Service
5125| [1025993] Apache Tomcat AJP Protocol Processing Bug Lets Remote Users Bypass Authentication or Obtain Information
5126| [1025976] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
5127| [1025960] Apache httpd Byterange Filter Processing Error Lets Remote Users Deny Service
5128| [1025925] Apache Tomcat Commons Daemon jsvc Lets Local Users Gain Elevated Privileges
5129| [1025924] Apache Tomcat XML Validation Flaw Lets Applications Obtain Potentially Sensitive Information
5130| [1025788] Apache Tomcat Lets Malicious Applications Obtain Information and Deny Service
5131| [1025755] Apache Santuario Buffer Overflow Lets Remote Users Deny Service
5132| [1025712] Apache Tomcat Discloses Passwords to Local Users in Certain Cases
5133| [1025577] Apache Archiva Input Validation Hole Permits Cross-Site Scripting Attacks
5134| [1025576] Apache Archiva Request Validation Flaw Permits Cross-Site Request Forgery Attacks
5135| [1025527] Apache APR Library apr_fnmatch() Flaw Lets Remote Users Execute Arbitrary Code
5136| [1025303] Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
5137| [1025215] Apache Tomcat May Ignore @ServletSecurity Annotation Protections
5138| [1025066] Apache Continuum Input Validation Flaw Permits Cross-Site Request Forgery Attacks
5139| [1025065] Apache Continuum Input Validation Hole Permits Cross-Site Scripting Attacks
5140| [1025027] Apache Tomcat maxHttpHeaderSize Parsing Error Lets Remote Users Deny Service
5141| [1025026] Apache Tomcat Manager Input Validation Hole Permits Cross-Site Scripting Attacks
5142| [1025025] Apache Tomcat Security Manager Lets Local Users Bypass File Permissions
5143| [1024764] Apache Tomcat Manager Input Validation Hole in 'sessionList.jsp' Permits Cross-Site Scripting Attacks
5144| [1024417] Apache Traffic Server Insufficient Randomization Lets Remote Users Poison the DNS Cache
5145| [1024332] Apache mod_cache and mod_dav Request Processing Flaw Lets Remote Users Deny Service
5146| [1024180] Apache Tomcat 'Transfer-Encoding' Header Processing Flaw Lets Remote Users Deny Service and Obtain Potentially Sensitive Information
5147| [1024096] Apache mod_proxy_http May Return Results for a Different Request
5148| [1023942] Apache mod_proxy_ajp Error Condition Lets Remote Users Deny Service
5149| [1023941] Apache ap_read_request() Memory Error May Let Remote Users Access Potentially Sensitive Information
5150| [1023778] Apache ActiveMQ Input Validation Flaw Permits Cross-Site Scripting Attacks
5151| [1023701] Apache mod_isapi Error Processing Flaw May Let Remote Users Deny Service
5152| [1023533] Apache mod_proxy Integer Overflow May Let Remote Users Execute Arbitrary Code
5153| [1022988] Apache Solaris Support Code Bug Lets Remote Users Deny Service
5154| [1022529] Apache mod_deflate Connection State Bug Lets Remote Users Deny Service
5155| [1022509] Apache mod_proxy stream_reqbody_cl() Infinite Loop Lets Remote Users Deny Service
5156| [1022296] Apache IncludesNoExec Options Restrictions Can Be Bypass By Local Users
5157| [1022264] Apache mod_proxy_ajp Bug May Disclose Another User's Response Data
5158| [1022001] Apache Tomcat mod_jk May Disclose Responses to the Wrong User
5159| [1021988] mod_perl Input Validation Flaw in Apache::Status and Apache2::Status Permits Cross-Site Scripting Attacks
5160| [1021350] NetWare Bug Lets Remote Users Access the ApacheAdmin Console
5161| [1020635] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
5162| [1020520] Oracle WebLogic Apache Connector Lets Remote Users Execute Arbitrary Code
5163| [1020267] Apache mod_proxy Interim Response Process Bug Lets Remote Users Deny Service
5164| [1019784] Apache-SSL Certificate Processing Bug May Let Remote Users View Portions of Kernel Memory
5165| [1019256] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks
5166| [1019194] Apache Input Validation Hole in Mod_AutoIndex When the Character Set is Undefined May Permit Cross-Site Scripting Attacks
5167| [1019185] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
5168| [1019154] Apache Input Validation Hole in mod_status Permits Cross-Site Scripting Attacks
5169| [1019093] Apache Input Validation Hole in mod_imap Permits Cross-Site Scripting Attacks
5170| [1019030] Apache Input Validation Hole in Default HTTP 413 Error Page Permits Cross-Site Scripting Attacks
5171| [1018633] Apache mod_proxy Bug Lets Remote Users Deny Service
5172| [1018304] Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
5173| [1018303] Apache HTTPD mod_cache May Let Remote Users Deny Service
5174| [1018302] Apache mod_status Input Validation Hole Permits Cross-Site Scripting Attacks
5175| [1018269] Apache Tomcat Input Validation Hole in Processing Accept-Language Header Permits Cross-Site Scripting Attacks
5176| [1017904] Apache suEXEC Bugs May Let Local Users Gain Elevated Privileges
5177| [1017719] Apache Tomcat JK Web Server Connector Buffer Overflow in map_uri_to_worker() Lets Remote Users Execute Arbitrary Code
5178| [1017062] Apache mod_tcl Format String Bug in set_var() Function May Let Remote Users Execute Arbitrary Code
5179| [1016601] Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code
5180| [1016576] Apache Tomcat Discloses Directory Listings to Remote Users
5181| [1015447] Apache mod_ssl Null Pointer Dereference May Let Remote Users Deny Service
5182| [1015344] Apache mod_imap Input Validation Flaw in Referer Field Lets Remote Users Conduct Cross-Site Scripting Attacks
5183| [1015093] Apache Memory Leak in MPM 'worker.c' Code May Let Remote Users Deny Service
5184| [1014996] ApacheTop Unsafe Temporary File May Let Local Users Gain Elevated Privileges
5185| [1014833] Apache ssl_hook_Access() Function May Fail to Verify Client Certificates
5186| [1014826] Apache Memory Leak in 'byterange filter' Lets Remote Users Deny Service
5187| [1014575] Apache mod_ssl Off-by-one Buffer Overflow in Processing CRLs May Let Remote Users Deny Service
5188| [1014323] Apache Chunked Transfer-Encoding and Content-Length Processing Lets Remote Users Smuggle HTTP Requests
5189| [1013156] Apache mod_python Publisher Handler Discloses Information to Remote Users
5190| [1012829] Apache mod_auth_radius radcpy() Integer Overflow Lets Remote Users Deny Service in Certain Cases
5191| [1012416] Apache on Apple OS X Lets Remote Users Bypass Apache File Handlers and Directly Access Files
5192| [1012415] Apache on Apple HFS+ Filesystems May Disclose '.DS_Store' Files to Remote Users
5193| [1012414] Apache mod_digest_apple Lets Remote Users Replay Authentication Credentials
5194| [1012083] Apache Web Server Error in Processing Requests With Many Space Characters Lets Remote Users Deny Service
5195| [1011783] Apache mod_include Buffer Overflow Lets Local Users Execute Arbitrary Code
5196| [1011557] Apache mod_ssl SSLCipherSuite Directive Can By Bypassed in Certain Cases
5197| [1011385] Apache Satsify Directive Error May Let Remote Users Access Restricted Resources
5198| [1011340] Apache SSL Connection Abort State Error Lets Remote Users Deny Service
5199| [1011303] Apache ap_resolve_env() Buffer Overflow in Reading Configuration Files May Let Local Users Gain Elevated Privileges
5200| [1011299] Apache IPv6 Address Parsing Flaw May Let Remote Users Deny Service
5201| [1011248] Apache mod_dav LOCK Method Error May Let Remote Users Deny Service
5202| [1011213] Apache mod_ssl Can Be Crashed By Remote Users When Reverse Proxying SSL Connections
5203| [1010674] Apache Can Be Crashed By PHP Code Invoking Nested Remote Sockets
5204| [1010599] Apache httpd Header Line Memory Allocation Lets Remote Users Crash the Server
5205| [1010462] Apache mod_proxy Buffer Overflow May Let Remote Users Execute Arbitrary Code
5206| [1010322] Apache mod_ssl Stack Overflow in ssl_util_uuencode_binary() May Let Remote Users Execute Arbitrary Code
5207| [1010270] cPanel Apache mod_phpsuexec Options Let Local Users Gain Elevated Privileges
5208| [1009934] Apache Web Server Has Buffer Overflow in ebcdic2ascii() on Older Processor Architectures
5209| [1009516] Apache mod_survey HTML Report Format Lets Remote Users Conduct Cross-Site Scripting Attacks
5210| [1009509] Apache mod_disk_cache Stores Authentication Credentials on Disk
5211| [1009495] Apache Web Server Socket Starvation Flaw May Let Remote Users Deny Service
5212| [1009417] GroupWise WebAccess With Apache on NetWare Has Configuration Flaw That May Grant Web Access to Remote Users
5213| [1009338] Apache mod_access Parsing Flaw May Fail to Enforce Allow/Deny Rules
5214| [1009337] Apache mod_ssl Memory Leak Lets Remote Users Crash the Daemon
5215| [1009182] Apache for Cygwin '..%5C' Input Validation Flaw Discloses Files to Remote Users
5216| [1008973] PHP May Apply Incorrect php_admin_* Settings To Requests for Apache Virtual Hosts
5217| [1008967] Apache-SSL 'SSLFakeBasicAuth' Lets Remote Users Forge Client Certificates to Be Authenticated
5218| [1008920] Apache mod_digest May Validate Replayed Client Responses
5219| [1008828] Apache mod_python String Processing Bug Still Lets Remote Users Crash the Web Server
5220| [1008822] Apache mod_perl File Descriptor Leak May Let Local Users Hijack the http and https Services
5221| [1008675] mod_auth_shadow Apache Module Authenticates Expired Passwords
5222| [1008559] Apache mod_php File Descriptor Leak May Let Local Users Hijack the https Service
5223| [1008335] Apache mod_python String Processing Bug Lets Remote Users Crash the Web Server
5224| [1008196] Apache 2.x on Windows May Return Unexpected Files For URLs Ending With Certain Characters
5225| [1008030] Apache mod_rewrite Contains a Buffer Overflow
5226| [1008029] Apache mod_alias Contains a Buffer Overflow
5227| [1008028] Apache mod_cgid May Disclose CGI Output to Another Client
5228| [1007995] Apache Cocoon Forms May Let Remote Users Execute Arbitrary Java Code on the System
5229| [1007993] Apache Cocoon 'view-source' Sample Script Discloses Files to Remote Users
5230| [1007823] Apache Web Server mod_cgi Error May Let Malicious CGI Scripts Crash the Web Service
5231| [1007664] Apache::Gallery Unsafe Temporary Files May Let Local Users Gain Apache Web Server Privileges
5232| [1007557] Apache Web Server Does Not Filter Terminal Escape Sequences From Log Files
5233| [1007230] Apache HTTP Server 'rotatelogs' Bug on Win32 and OS/2 May Cause the Logging to Stop
5234| [1007146] Apache HTTP Server FTP Proxy Bug May Cause Denial of Service Conditions
5235| [1007145] Apache 'accept()' Errors May Cause Denial of Service Conditions
5236| [1007144] Apache Web Server 'type-map' File Error Permits Local Denial of Service Attacks
5237| [1007143] Apache 2.0 Web Server May Use a Weaker Encryption Implementation Than Specified in Some Cases
5238| [1006864] Apache Web Server Can Be Crashed By Remote Users Via mod_dav Flaws and Also Via Basic Authentication
5239| [1006709] Apache mod_survey Input Validation Flaw Lets Remote Users Fill Up Disk Space
5240| [1006614] Apache mod_ntlm Buffer Overflow and Format String Flaw Let Remote Users Execute Arbitary Code
5241| [1006591] Apache mod_access_referer Module Null Pointer Dereference May Faciliate Denial of Service Attacks
5242| [1006444] Apache 2.0 Web Server Line Feed Buffer Allocation Flaw Lets Remote Users Deny Service
5243| [1006021] Apache Tomcat Server URL Parsing Error May Disclose Otherwise Inaccessible Web Directory Listings and Files to Remote Users
5244| [1005963] Apache Web Server 2.x Windows Device Access Flaw Lets Remote Users Crash the Server or Possibly Execute Arbitrary Code
5245| [1005962] Apache Web Server Path Parsing Flaw May Allow Remote Users to Execute Code in Certain Configurations
5246| [1005848] Apache 'printenv' Script Input Validation Bugs in Older Versions May Let Remote Users Conduct Cross-Site Scripting Attacks
5247| [1005765] Apache mod_jk Module Processing Bug When Used With Tomcat May Disclose Information to Remote Users or Crash
5248| [1005548] Apache mod_php Module May Allow Local Users to Gain Control of the Web Port
5249| [1005499] Apache Web Server (2.0.42) May Disclose CGI Source Code to Remote Users When Used With WebDAV
5250| [1005410] Apache Tomcat Java Servlet Engine Can Be Crashed Via Multiple Requests for DOS Device Names
5251| [1005351] Apache Web Server (1.3.x) Shared Memory Scoreboard Bug Lets Certain Local Users Issue Signals With Root Privileges
5252| [1005331] Apache Web Server (2.x) SSI Server Signature Filtering Hole Lets Remote Users Conduct Cross-Site Scripting Attacks
5253| [1005290] Apache Tomcat Java Server Default Servlet Returns JSP Source Code to Remote Users
5254| [1005285] Apache Web Server 'mod_dav' Has Null Pointer Bug That May Allow Remote Users to Cause Denial of Service Conditions
5255| [1005010] Apache Web Server (2.0) Has Unspecified Flaw That Allows Remote Users to Obtain Sensitive Data and Cause Denial of Service Conditions
5256| [1004770] Apache 2.x Web Server ap_log_rerror() Function May Disclose Full Installation Path to Remote Users
5257| [1004745] Apache Tomcat Java Server Allows Cross-Site Scripting Attacks
5258| [1004636] Apache mod_ssl 'Off-by-One' Bug May Let Local Users Crash the Web Server or Possibly Execute Arbitrary Code
5259| [1004602] Apache Tomcat Java Server for Windows Can Be Crashed By Remote Users Sending Malicious Requests to Hang All Available Working Threads
5260| [1004586] Apache Tomcat Java Server May Disclose the Installation Path to Remote Users
5261| [1004555] Apache Web Server Chunked Encoding Flaw May Let Remote Users Execute Arbitrary Code on the Server
5262| [1004209] Apache 'mod_python' Python Language Interpreter Bug in Publisher Handler May Allow Remote Users to Modify Files on the System
5263| [1003874] Apache Web Server for Windows Has Batch File Processing Hole That Lets Remote Users Execute Commands on the System
5264| [1003767] 'mod_frontpage' Module for Apache Web Server Has Buffer Overlow in 'fpexec.c' That Allows Remote Users to Execute Arbitrary Code on the System with Root Privileges
5265| [1003723] Apache-SSL for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
5266| [1003664] 'mod_ssl' Security Package for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
5267| [1003602] GNUJSP Java Server Pages Implementation Discloses Web Files and Source Code to Remote Users and Bypasses Apache Access Control Restrictions
5268| [1003465] PHP for Apache Web Server May Disclose Installation Path Information to Remote Users Making 'OPTIONS' Requests
5269| [1003451] Oracle Application Server PL/SQL Module for Apache Has Buffer Overflows That Allow Remote Users to Execute Arbitrary Code and Gain Access to the Server
5270| [1003131] Apache Web Server in Virtual Hosting Mode Can Be Crashed By a Local User Removing a Log Directory
5271| [1003104] PHP.EXE Windows CGI for Apache Web Server May Let Remote Users View Files on the Server Due to Configuration Error
5272| [1003008] Apache 'mod_bf' Module Lets Remote Users Execute Arbitrary Code
5273| [1002629] Apache suEXEC Wrapper Fails to Observe Minimum Group ID Security Settings in Certain Situations
5274| [1002542] Apache Web Server Virtual Hosting Split-Logfile Function Lets Remote Users Write Log Entries to Arbitrary Files on the System
5275| [1002400] Apache mod_gzip Module Has Buffer Overflow That Can Be Exploited By Local Users to Gain Elevated Privileges
5276| [1002303] Several 3rd Party Apache Authentication Modules Allow Remote Users to Execute Arbitrary Code to Gain Access to the System or Execute Stored Procedures to Obtain Arbitrary Database Information
5277| [1002188] Apache Web Server Discloses Internal IP Addresses to Remote Users in Certain Configurations
5278| [1001989] Apache Web Server May Disclose Directory Contents Even If an Index.html File is Present in the Directory
5279| [1001719] Apache Web Server on Mac OS X Client Fails to Enforce File and Directory Access Protections, Giving Remote Users Access to Restricted Pages
5280| [1001572] Apache Web Server on Microsoft Windows Platforms Allows Remote Users to Crash the Web Server
5281| [1001304] Apache Web Server for Windows Lets Remote Users Crash the Web Server Application
5282| [1001083] Apache Web Server May Display Directory Index Listings Even if Directory Listings Are Disabled
5283|
5284| OSVDB - http://www.osvdb.org:
5285| [96078] Apache CloudStack Infrastructure Menu Setup Network Multiple Field XSS
5286| [96077] Apache CloudStack Global Settings Multiple Field XSS
5287| [96076] Apache CloudStack Instances Menu Display Name Field XSS
5288| [96075] Apache CloudStack Instances Menu Add Instances Network Name Field XSS
5289| [96074] Apache CloudStack Instances Menu Add Instances Review Step Multiple Field XSS
5290| [96031] Apache HTTP Server suEXEC Symlink Arbitrary File Access
5291| [95888] Apache Archiva Single / Double Quote Character Handling XSS Weakness
5292| [95885] Apache Subversion mod_dav_svn Module Crafted HTTP Request Handling Remote DoS
5293| [95706] Apache OpenOffice.org (OOo) OOXML Document File XML Element Handling Memory Corruption
5294| [95704] Apache OpenOffice.org (OOo) DOC File PLCF Data Handling Memory Corruption
5295| [95603] Apache Continuum web/util/GenerateRecipentNotifier.java recipient Parameter XSS
5296| [95602] Apache Continuum web/action/notifier/JabberProjectNotifierEditAction-jabberProjectNotifierSave-validation.xml Multiple Parameter XSS
5297| [95601] Apache Continuum web/action/notifier/JabberGroupNotifierEditAction-jabberProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
5298| [95600] Apache Continuum web/action/ScheduleAction-saveSchedule-validation.xml Multiple Parameter XSS
5299| [95599] Apache Continuumweb/action/BuildDefinitionAction-saveBuildDefinition-validation.xml Multiple Parameter XSS
5300| [95598] Apache Continuum web/action/AddProjectAction-addProject-validation.xml Multiple Parameter XSS
5301| [95597] Apache Continuum web/action/ProjectEditAction-projectSave-validation.xml Multiple Parameter XSS
5302| [95596] Apache Continuum web/action/notifier/IrcGroupNotifierEditAction-ircProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
5303| [95595] Apache Continuum web/action/notifier/IrcProjectNotifierEditAction-ircProjectNotifierSave-validation.xml Multiple Parameter XSS
5304| [95594] Apache Continuum web/action/ProjectGroupAction.java Multiple Parameter XSS
5305| [95593] Apache Continuum web/action/AddProjectGroupAction.java Multiple Parameter XSS
5306| [95592] Apache Continuum web/action/AddProjectAction.java Multiple Parameter XSS
5307| [95523] Apache OFBiz Webtools Application View Log Screen Unspecified XSS
5308| [95522] Apache OFBiz Nested Expression Evaluation Arbitrary UEL Function Execution
5309| [95521] Apache HTTP Server mod_session_dbd Session Saving Unspecified Issue
5310| [95498] Apache HTTP Server mod_dav.c Crafted MERGE Request Remote DoS
5311| [95406] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Arbitrary Site Redirect
5312| [95405] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Remote Code Execution
5313| [95011] Apache CXF XML Parser SOAP Message Handling CPU Resource Exhaustion Remote DoS
5314| [94705] Apache Geronimo RMI Classloader Exposure Serialized Object Handling Remote Code Execution
5315| [94651] Apache Santuario (XML Security for C++) XML Signature CanonicalizationMethod Parameter Spoofing Weakness
5316| [94636] Apache Continuum workingCopy.action userDirectory Traversal Arbitrary File Access
5317| [94635] Apache Maven SCM SvnCommandlineUtils Process Listing Local Password Disclosure
5318| [94632] Apache Maven Wagon SSH (wagon-ssh) Host Verification Failure MitM Weakness
5319| [94625] Apache Santuario (XML Security for C++) XML Signature Reference Crafted XPointer Expression Handling Heap Buffer Overflow
5320| [94618] Apache Archiva /archiva/security/useredit.action username Parameter XSS
5321| [94617] Apache Archiva /archiva/security/roleedit.action name Parameter XSS
5322| [94616] Apache Archiva /archiva/security/userlist!show.action roleName Parameter XSS
5323| [94615] Apache Archiva /archiva/deleteArtifact!doDelete.action groupId Parameter XSS
5324| [94614] Apache Archiva /archiva/admin/addLegacyArtifactPath!commit.action legacyArtifactPath.path Parameter XSS
5325| [94613] Apache Archiva /archiva/admin/addRepository.action Multiple Parameter XSS
5326| [94612] Apache Archiva /archiva/admin/editAppearance.action Multiple Parameter XSS
5327| [94611] Apache Archiva /archiva/admin/addLegacyArtifactPath.action Multiple Parameter XSS
5328| [94610] Apache Archiva /archiva/admin/addNetworkProxy.action Multiple Parameter XSS
5329| [94403] Apache Santuario (XML Security for C++) InclusiveNamespace PrefixList Processing Heap Overflow
5330| [94402] Apache Santuario (XML Security for C++) HMAC-based XML Signature Processing DoS
5331| [94401] Apache Santuario (XML Security for C++) XPointer Evaluation Stack Overflow
5332| [94400] Apache Santuario (XML Security for C++) HMAC-Based XML Signature Reference Element Validation Spoofing Weakness
5333| [94279] Apache Qpid CA Certificate Validation Bypass
5334| [94275] Apache Solr JettySolrRunner.java Can Not Find Error Message XSS
5335| [94233] Apache OpenJPA Object Deserialization Arbitrary Executable Creation
5336| [94042] Apache Axis JAX-WS Java Unspecified Exposure
5337| [93969] Apache Struts OGNL Expression Handling Double Evaluation Error Remote Command Execution
5338| [93796] Apache Subversion Filename Handling FSFS Repository Corruption Remote DoS
5339| [93795] Apache Subversion svnserve Server Aborted Connection Message Handling Remote DoS
5340| [93794] Apache Subversion contrib/hook-scripts/check-mime-type.pl svnlook Hyphenated argv Argument Handling Remote DoS
5341| [93793] Apache Subversion contrib/hook-scripts/svn-keyword-check.pl Filename Handling Remote Command Execution
5342| [93646] Apache Struts Crafted Parameter Arbitrary OGNL Code Execution
5343| [93645] Apache Struts URL / Anchor Tag includeParams Attribute Remote Command Execution
5344| [93636] Apache Pig Multiple Physical Operator Memory Exhaustion Remote Remote DoS
5345| [93635] Apache Wink DTD (Document Type Definition) Expansion Data Parsing Information Disclosure
5346| [93605] RT Apache::Session::File Session Replay Reuse Information Disclosure
5347| [93599] Apache Derby SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY Boot Password Manipulation Re-encryption Failure Password Corruption
5348| [93555] Apache Commons Codec Invalid Base32 String Information Tunneling Weakness
5349| [93554] Apache HBase bulkLoadHFiles() Method ACL Bypass
5350| [93543] JBoss Enterprise Application Platform org.apache.catalina.connector.Response.encodeURL() Method MitM jsessionid Disclosure
5351| [93542] Apache ManifoldCF (Connectors Framework) org.apache.manifoldcf.crawler.ExportConfiguration Class Configuration Export Password Disclosure
5352| [93541] Apache Solr json.wrf Callback XSS
5353| [93524] Apache Hadoop GetSecurityDescriptorControl() Function Absolute Security Descriptor Handling NULL Descriptor Weakness
5354| [93521] Apache jUDDI Security API Token Session Persistence Weakness
5355| [93520] Apache CloudStack Default SSL Key Weakness
5356| [93519] Apache Shindig /ifr Cross-site Arbitrary Gadget Invocation
5357| [93518] Apache Solr /admin/analysis.jsp name Parameter XSS
5358| [93517] Apache CloudStack setup-cloud-management /etc/sudoers Modification Local Privilege Escalation
5359| [93516] Apache CXF UsernameTokenInterceptor Nonce Caching Replay Weakness
5360| [93515] Apache HBase table.jsp name Parameter XSS
5361| [93514] Apache CloudStack Management Server Unauthenticated Remote JMX Connection Default Setting Weakness
5362| [93463] Apache Struts EL / OGNL Interpretation Unspecified Remote Code Execution
5363| [93462] Apache CXF WS-SecurityPolicy AlgorithmSuite Arbitrary Ciphertext Decryption Weakness
5364| [93401] Apache Hadoop core-site.xml Permission Weakness Local Alfredo Secret Disclosure
5365| [93400] Apache Hadoop Map/Reduce Job Log Directory Symlink Arbitrary File Mode Manipulation
5366| [93397] Apache Wicket Referrer HTTP Header Session ID Disclosure
5367| [93366] Apache HTTP Server modules/mappers/mod_rewrite.c do_rewritelog() Function Log File Terminal Escape Sequence Filtering Remote Command Execution
5368| [93254] Apache Tomcat AsyncListener Method Cross-session Information Disclosure
5369| [93253] Apache Tomcat Chunked Transfer Encoding Data Saturation Remote DoS
5370| [93252] Apache Tomcat FORM Authenticator Session Fixation
5371| [93172] Apache Camel camel/endpoints/ Endpoint XSS
5372| [93171] Apache Sling HtmlResponse Error Message XSS
5373| [93170] Apache Directory DelegatingAuthenticator MitM Spoofing Weakness
5374| [93169] Apache Wave AuthenticationServlet.java Session Fixation Weakness
5375| [93168] Apache Click ErrorReport.java id Parameter XSS
5376| [93167] Apache ActiveMQ JMSXUserId Spoofing Weakness
5377| [93166] Apache CXF Crafted Message Element Count Handling System Resource Exhaustion Remote DoS
5378| [93165] Apache CXF Crafted Message Element Level Handling System Resource Exhaustion Remote DoS
5379| [93164] Apache Harmony DatagramSocket Class connect Method CheckAccept() IP Blacklist Bypass
5380| [93163] Apache Hadoop Map/Reduce Daemon Symlink Arbitrary File Overwrite
5381| [93162] Apache VelocityStruts struts/ErrorsTool.getMsgs Error Message XSS
5382| [93161] Apache CouchDB Rewriter VM Atom Table Memory Exhaustion Remote DoS
5383| [93158] Apache Wicket BookmarkablePageLink Feature XSS CSRF
5384| [93157] Apache Struts UrlHelper.java s:url includeParams Functionality XSS
5385| [93156] Apache Tapestry Calendar Component datefield.js datefield Parameter XSS
5386| [93155] Apache Struts fielderror.ftl fielderror Parameter Error Message XSS
5387| [93154] Apache JSPWiki Edit.jsp createPages WikiPermission Bypass
5388| [93153] Apache PDFBox PDFXrefStreamParser Missing Element Handling PDF Parsing DoS
5389| [93152] Apache Hadoop HttpServer.java Multiple Function XSS
5390| [93151] Apache Shiro Search Filter userName Parameter LDAP Code Injection Weakness
5391| [93150] Apache Harmony java.net.SocketPermission Class boolean equals Function checkConnect() Weakness Host Name Retrieval
5392| [93149] Apache Harmony java.security.Provider Class void load Function checkSecurityAccess() Weakness
5393| [93148] Apache Harmony java.security.ProtectionDomain Class java.lang.String.toString() Function checkPermission() Weakness
5394| [93147] Apache Harmony java.net.URLConnection openConnection Function checkConnect Weakness Proxy Connection Permission Bypass
5395| [93146] Apache Harmony java.net.ServerSocket Class void implAccept Function checkAccept() Weakness SerSocket Subclass Creation
5396| [93145] Apache Qpid JMS Client Detached Session Frame Handling NULL Pointer Dereference Remote DoS
5397| [93144] Apache Solr Admin Command Execution CSRF
5398| [93009] Apache VCL XMLRPC API Unspecified Function Remote Privilege Escalation
5399| [93008] Apache VCL Web GUI Unspecified Remote Privilege Escalation
5400| [92997] Apache Commons Codec org.apache.commons.codec.net.URLCodec Fields Missing 'final' Thread-safety Unspecified Issue
5401| [92976] Apache ActiveMQ scheduled.jsp crontab Command XSS
5402| [92947] Apache Commons Codec org.apache.commons.codec.language.Soundex.US_ENGLISH_MAPPING Missing MS_PKGPROTECT Field Manipulation Unspecified Issue
5403| [92749] Apache CloudStack Predictable Hash Virtual Machine Console Console Access URL Generation
5404| [92748] Apache CloudStack VM Console Access Restriction Bypass
5405| [92709] Apache ActiveMQ Web Console Unauthenticated Remote Access
5406| [92708] Apache ActiveMQ Sample Web Application Broker Resource Consumption Remote DoS
5407| [92707] Apache ActiveMQ webapp/websocket/chat.js Subscribe Message XSS
5408| [92706] Apache ActiveMQ Debug Log Rendering XSS
5409| [92705] Apache ActiveMQ PortfolioPublishServlet.java refresh Parameter XSS
5410| [92270] Apache Tomcat Unspecified CSRF
5411| [92094] Apache Subversion mod_dav_svn Module Nonexistent URL Lock Request Handling NULL Pointer Dereference Remote DoS
5412| [92093] Apache Subversion mod_dav_svn Module Activity URL PROPFIND Request Handling NULL Pointer Dereference Remote DoS
5413| [92092] Apache Subversion mod_dav_svn Module Log REPORT Request Handling NULL Pointer Dereference Remote DoS
5414| [92091] Apache Subversion mod_dav_svn Module Node Property Handling Resource Exhaustion Remote DoS
5415| [92090] Apache Subversion mod_dav_svn Module Activity URL Lock Request Handling NULL Pointer Dereference Remote DoS
5416| [91774] Apache Commons Codec Unspecified Non-private Field Manipulation Weakness
5417| [91628] mod_ruid2 for Apache HTTP Server fchdir() Inherited File Descriptor chroot Restriction Bypass
5418| [91328] Apache Wicket $up$ Traversal Arbitrary File Access
5419| [91295] Apple Mac OS X Apache Unicode Character URI Handling Authentication Bypass
5420| [91235] Apache Rave /app/api/rpc/users/get User Object Hashed Password Remote Disclosure
5421| [91185] Munin Default Apache Configuration Permission Weakness Remote Information Disclosure
5422| [91173] Apache Wicket WebApplicationPath Constructor Bypass /WEB-INF/ Directory File Access
5423| [91172] Apache Wicket PackageResourceGuard File Extension Filter Bypass
5424| [91025] Apache Qpid qpid::framing::Buffer Class Multiple Method Out-of-bounds Access Remote DoS
5425| [91024] Apache Qpid federation_tag Attribute Handling Federated Interbroker Link Access Restriction Bypass
5426| [91023] Apache Qpid AMQP Type Decoder Exposure Array Size Value Handling Memory Consumption Remote DoS
5427| [91022] Apache Qpid qpid/cpp/include/qpid/framing/Buffer.h qpid::framing::Buffer::checkAvailable() Function Integer Overflow
5428| [90986] Apache Jena ARQ INSERT DATA Request Handling Overflow
5429| [90907] Apache Subversion mod_dav_svn / libsvn_fs svn_fs_file_length() Function MKACTIVITY / PROPFIND Option Request Handling Remote DoS
5430| [90906] Apache Commons FileUpload /tmp Storage Symlink Arbitrary File Overwrite
5431| [90864] Apache Batik 1xx Redirect Script Origin Restriction Bypass
5432| [90858] Apache Ant Malformed TAR File Handling Infinite Loop DoS
5433| [90852] Apache HTTP Server for Debian apachectl /var/lock Permission Weakness Symlink Directory Permission Manipulation
5434| [90804] Apache Commons CLI Path Subversion Local Privilege Escalation
5435| [90802] Apache Avro Recursive Schema Handling Infinite Recursion DoS
5436| [90592] Apache Batik ApplicationSecurityEnforcer.java Multiple Method Security Restriction Bypass
5437| [90591] Apache Batik XML External Entity (XXE) Data Parsing Arbitrary File Disclosure
5438| [90565] Apache Tomcat Log Directory Permission Weakness Local Information Disclosure
5439| [90564] Apache Maven / Maven Wagon SSL Certificate Validation MitM Spoofing Weakness
5440| [90557] Apache HTTP Server mod_proxy_balancer balancer-manager Interface Multiple Parameter XSS
5441| [90556] Apache HTTP Server Multiple Module Multiple Parameter XSS
5442| [90276] Apache Axis2 axis2.xml Plaintext Password Local Disclosure
5443| [90249] Apache Axiom ClassLoader XMLInputFactory / XMLOutputFactory Construction Unspecified Issue
5444| [90235] Apache Commons HttpClient Certificate Wildcard Matching Weakness
5445| [90079] Apache CXF WSS4JInInterceptor URIMappingInterceptor WS-Security SOAP Service Access Restriction Bypass
5446| [90078] Apache CXF WS-SecurityPolicy Enabled Plaintext UsernameTokens Handling Authentication Bypass
5447| [89453] Apache Open For Business Project (OFBiz) Screenlet.title Widget Attribute XSS
5448| [89452] Apache Open For Business Project (OFBiz) Image.alt Widget Attribute XSS
5449| [89294] Apache CouchDB Futon UI Browser-based Test Suite Query Parameter XSS
5450| [89293] Apache CouchDB Unspecified Traversal Arbitrary File Access
5451| [89275] Apache HTTP Server mod_proxy_ajp Module Expensive Request Parsing Remote DoS
5452| [89267] Apache CouchDB JSONP Callback Handling Unspecified XSS
5453| [89146] Apache CloudStack Master Server log4j.conf SSH Private Key / Plaintext Password Disclosure
5454| [88603] Apache OpenOffice.org (OOo) Unspecified Information Disclosure
5455| [88602] Apache OpenOffice.org (OOo) Unspecified Manifest-processing Issue
5456| [88601] Apache OpenOffice.org (OOo) Unspecified PowerPoint File Handling Issue
5457| [88285] Apache Tomcat Partial HTTP Request Saturation Remote DoS
5458| [88095] Apache Tomcat NIO Connector Terminated Connection Infinte Loop DoS
5459| [88094] Apache Tomcat FORM Authentication Crafted j_security_check Request Security Constraint Bypass
5460| [88093] Apache Tomcat Null Session Requst CSRF Prevention Filter Bypass
5461| [88043] IBM Tivoli Netcool/Reporter Apache CGI Unspecified Remote Command Execution
5462| [87580] Apache Tomcat DIGEST Authentication Session State Caching Authentication Bypass Weakness
5463| [87579] Apache Tomcat DIGEST Authentication Stale Nonce Verification Authentication Bypass Weakness
5464| [87477] Apache Tomcat Project Woodstock Service Error Page UTF-7 XSS Weakness
5465| [87227] Apache Tomcat InternalNioInputBuffer.java parseHeaders() Function Request Header Size Parsing Remote DoS
5466| [87223] Apache Tomcat DIGEST Authentication replay-countermeasure Functionality cnonce / cn Verification Authentication Bypass Weakness
5467| [87160] Apache Commons HttpClient X.509 Certificate Domain Name Matching MiTM Weakness
5468| [87159] Apache CXF X.509 Certificate Domain Name Matching MiTM Weakness
5469| [87150] Apache Axis / Axis2 X.509 Certificate Domain Name Matching MiTM Weakness
5470| [86902] Apache HTTP Server 3xx Redirect Internal IP Address Remote Disclosure
5471| [86901] Apache Tomcat Error Message Path Disclosure
5472| [86684] Apache CloudStack Unauthorized Arbitrary API Call Invocation
5473| [86556] Apache Open For Business Project (OFBiz) Unspecified Issue
5474| [86503] Visual Tools VS home/apache/DiskManager/cron/init_diskmgr Local Command Execution
5475| [86401] Apache ActiveMQ ResourceHandler Traversal Arbitrary File Access
5476| [86225] Apache Axis2 XML Signature Wrapping (XSW) Authentication Bypass
5477| [86206] Apache Axis2 Crafted SAML Assertion Signature Exclusion Attack Authentication Bypass
5478| [85722] Apache CXF SOAP Request Parsing Access Restriction Bypass
5479| [85704] Apache Qpid Incoming Client Connection Saturation Remote DoS
5480| [85474] Eucalyptus Apache Santuario (XML Security for Java) Library XML Signature Transform Handling DoS
5481| [85430] Apache mod_pagespeed Module Unspecified XSS
5482| [85429] Apache mod_pagespeed Module Hostname Verification Cross-host Resource Disclosure
5483| [85249] Apache Wicket Unspecified XSS
5484| [85236] Apache Hadoop conf/hadoop-env.sh Temporary File Symlink Arbitrary File Manipulation
5485| [85090] Apache HTTP Server mod_proxy_ajp.c mod_proxy_ajp Module Proxy Functionality Cross-client Information Disclosure
5486| [85089] Apache HTTP Server mod_proxy_http.c mod_proxy_http Module Cross-client Information Disclosure
5487| [85062] Apache Solr Autocomplete Module for Drupal Autocomplete Results XSS
5488| [85010] Apache Struts Token Handling Mechanism Token Name Configuration Parameter CSRF Weakness
5489| [85009] Apache Struts Request Parameter OGNL Expression Parsing Remote DoS
5490| [84911] libapache2-mod-rpaf X-Forward-For HTTP Header Parsing Remote DoS
5491| [84823] Apache HTTP Server Multiple Module Back End Server Error Handling HTTP Request Parsing Remote Information Disclosure
5492| [84818] Apache HTTP Server mod_negotiation Module mod_negotiation.c make_variant_list Function XSS
5493| [84562] Apache Qpid Broker Authentication Mechanism AMQP Client Shadow Connection NullAuthenticator Request Parsing Authentication Bypass
5494| [84458] Apache Libcloud SSL Certificate Validation MitM Spoofing Weakness
5495| [84279] PHP on Apache php_default_post_reader POST Request Handling Overflow DoS
5496| [84278] PHP w/ Apache PDO::ATTR_DEFAULT_FETCH_MODE / PDO::FETCH_CLASS DoS
5497| [84231] Apache Hadoop DataNodes Client BlockTokens Arbitrary Block Access
5498| [83943] Oracle Solaris Cluster Apache Tomcat Agent Subcomponent Unspecified Local Privilege Escalation
5499| [83939] Oracle Solaris Apache HTTP Server Subcomponent Unspecified Remote Information Disclosure
5500| [83685] svnauthcheck Apache HTTP Configuration File Permission Revocation Weakness
5501| [83682] Apache Sling POST Servlet @CopyFrom Operation HTTP Request Parsing Infinite Loop Remote DoS
5502| [83339] Apache Roller Blogger Roll Unspecified XSS
5503| [83270] Apache Roller Unspecified Admin Action CSRF
5504| [82782] Apache CXF WS-SecurityPolicy 1.1 SupportingToken Policy Bypass
5505| [82781] Apache CXF WS-SecurityPolicy Supporting Token Children Specification Token Signing Verification Weakness
5506| [82611] cPanel Apache Piped Log Configuration Log Message Formatting Traversal Arbitrary File Creation
5507| [82436] MapServer for Windows Bundled Apache / PHP Configuration Local File Inclusion
5508| [82215] PHP sapi/cgi/cgi_main.c apache_request_headers Function HTTP Header Handling Remote Overflow
5509| [82161] Apache Commons Compress bzip2 File Compression BZip2CompressorOutputStream Class File Handling Remote DoS
5510| [81965] Apache Batik Squiggle SVG Browser JAR File Arbitrary Code Execution
5511| [81790] Apache POI src/org/apache/poi/hwpf/model/UnhandledDataStructure.java UnhandledDataStructure() constructor Length Attribute CDF / CFBF File Handling Remote DoS
5512| [81660] Apache Qpid Credential Checking Cluster Authentication Bypass
5513| [81511] Apache for Debian /usr/share/doc HTTP Request Parsing Local Script Execution
5514| [81359] Apache HTTP Server LD_LIBRARY_PATH Variable Local Privilege Escalation
5515| [81349] Apache Open For Business Project (OFBiz) Webslinger Component Unspecified XSS
5516| [81348] Apache Open For Business Project (OFBiz) Content IDs / Map-Keys Unspecified XSS
5517| [81347] Apache Open For Business Project (OFBiz) Parameter Arrays Unspecified XSS
5518| [81346] Apache Open For Business Project (OFBiz) checkoutProcess.js getServerError() Function Unspecified XSS
5519| [81196] Apache Open For Business Project (OFBiz) FlexibleStringExpander Nested Script String Parsing Remote Code Execution
5520| [80981] Apache Hadoop Kerberos/MapReduce Security Feature User Impersonation Weakness
5521| [80571] Apache Traffic Server Host HTTP Header Parsing Remote Overflow
5522| [80547] Apache Struts XSLTResult.java File Upload Arbitrary Command Execution
5523| [80360] AskApache Password Protector Plugin for WordPress Error Page $_SERVER Superglobal XSS
5524| [80349] Apache HTTP Server mod_fcgid Module fcgid_spawn_ctl.c FcgidMaxProcessesPerClass Virtual Host Directive HTTP Request Parsing Remote DoS
5525| [80301] Apache Wicket /resources/ Absolute Path Arbitrary File Access
5526| [80300] Apache Wicket wicket:pageMapName Parameter XSS
5527| [79478] Apache Solr Extension for TYPO3 Unspecified XSS
5528| [79002] Apache MyFaces javax.faces.resource In Parameter Traversal Arbitrary File Access
5529| [78994] Apache Struts struts-examples/upload/upload-submit.do name Parameter XSS
5530| [78993] Apache Struts struts-cookbook/processDyna.do message Parameter XSS
5531| [78992] Apache Struts struts-cookbook/processSimple.do message Parameter XSS
5532| [78991] Apache Struts struts2-rest-showcase/orders clientName Parameter XSS
5533| [78990] Apache Struts struts2-showcase/person/editPerson.action Multiple Parameter XSS
5534| [78932] Apache APR Hash Collision Form Parameter Parsing Remote DoS
5535| [78903] Apache CXF SOAP Request Parsing WS-Security UsernameToken Policy Bypass
5536| [78600] Apache Tomcat HTTP DIGEST Authentication DigestAuthenticator.java Catalina Weakness Security Bypass
5537| [78599] Apache Tomcat HTTP DIGEST Authentication Realm Value Parsing Security Bypass
5538| [78598] Apache Tomcat HTTP DIGEST Authentication qop Value Parsing Security Bypass
5539| [78573] Apache Tomcat Parameter Saturation CPU Consumption Remote DoS
5540| [78556] Apache HTTP Server Status Code 400 Default Error Response httpOnly Cookie Disclosure
5541| [78555] Apache HTTP Server Threaded MPM %{cookiename}C Log Format String Cookie Handling Remote DoS
5542| [78501] Apache Struts ParameterInterceptor Class OGNL Expression Parsing Remote Command Execution
5543| [78331] Apache Tomcat Request Object Recycling Information Disclosure
5544| [78293] Apache HTTP Server Scoreboard Invalid Free Operation Local Security Bypass
5545| [78277] Apache Struts ExceptionDelegator Component Parameter Parsing Remote Code Execution
5546| [78276] Apache Struts DebuggingInterceptor Component Developer Mode Unspecified Remote Command Execution
5547| [78113] Apache Tomcat Hash Collision Form Parameter Parsing Remote DoS
5548| [78112] Apache Geronimo Hash Collision Form Parameter Parsing Remote DoS
5549| [78109] Apache Struts ParameterInterceptor Traversal Arbitrary File Overwrite
5550| [78108] Apache Struts CookieInterceptor Cookie Name Handling Remote Command Execution
5551| [77593] Apache Struts Conversion Error OGNL Expression Injection
5552| [77496] Apache ActiveMQ Failover Mechanism Openwire Request Parsing Remote DoS
5553| [77444] Apache HTTP Server mod_proxy Mdule Web Request HTTP/0.9 Protocol URL Parsing Proxy Remote Security Bypass
5554| [77374] Apache MyFaces Java Bean includeViewParameters Parsing EL Expression Security Weakness
5555| [77310] Apache HTTP Server mod_proxy Reverse Proxy Mode Security Bypass Weakness (2011-4317)
5556| [77234] Apache HTTP Server on cygwin Encoded Traversal Arbitrary File Access
5557| [77012] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Memory Consumption DoS
5558| [76944] Apache Tomcat Manager Application Servlets Access Restriction Bypass
5559| [76744] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Overflow
5560| [76189] Apache Tomcat HTTP DIGEST Authentication Weakness
5561| [76079] Apache HTTP Server mod_proxy Mdule Web Request URL Parsing Proxy Remote Security Bypass (2011-3368)
5562| [76072] Apache JServ jserv.conf jserv-status Handler jserv/ URI Request Parsing Local Information Disclosure
5563| [75807] Apache HTTP Server Incomplete Header Connection Saturation Remote DoS
5564| [75647] Apache HTTP Server mod_proxy_ajp Module mod_proxy_balancer HTTP Request Remote DoS
5565| [75376] Apache Libcloud SSL Certificate Validation MitM Server Spoofing Weakness
5566| [74853] Domain Technologie Control /etc/apache2/apache2.conf File Permissions Weakness dtcdaemons User Password Disclosure
5567| [74818] Apache Tomcat AJP Message Injection Authentication Bypass
5568| [74725] Apache Wicket Multi Window Support Unspecified XSS
5569| [74721] Apache HTTP Server ByteRange Filter Memory Exhaustion Remote DoS
5570| [74541] Apache Commons Daemon Jsvc Permissions Weakness Arbitrary File Access
5571| [74535] Apache Tomcat XML Parser Cross-application Multiple File Manipulation
5572| [74447] Apache Struts XWork Nonexistent Method s:submit Element Internal Java Class Remote Path Disclosure
5573| [74262] Apache HTTP Server Multi-Processing Module itk.c Configuration Merger mpm-itk root UID / GID Remote Privilege Escalation
5574| [74120] Apache HTTP Server mod_authnz_external mysql/mysql-auth.pl user Field SQL Injection
5575| [73920] Oracle Secure Backup /apache/htdocts/php/common.php username Parameter Remote Code Execution
5576| [73798] Apache Tomcat sendfile Request Start / Endpoint Parsing Local DoS
5577| [73797] Apache Tomcat sendfile Request Attribute Validation Weakness Local Access Restriction Bypass
5578| [73776] Apache Tomcat HTTP BIO Connector HTTP Pipelining Cross-user Remote Response Access
5579| [73644] Apache XML Security Signature Key Parsing Overflow DoS
5580| [73600] Apache Struts javatemplates Plugin Component Handlers .action URI Multiple Parameter XSS
5581| [73462] Apache Rampart/C util/rampart_timestamp_token.c rampart_timestamp_token_validate Function Expired Token Remote Access Restriction Bypass
5582| [73429] Apache Tomcat JMX MemoryUserDatabase Local Password Disclosure
5583| [73384] Apache HTTP Server mod_rewrite PCRE Resource Exhaustion DoS
5584| [73383] Apache HTTP Server Portable Runtime (APR) Library apr_fnmatch() Infinite Loop Remote DoS
5585| [73378] IBM WebSphere Application Server (WAS) JavaServer Pages org.apache.jasper.runtime.JspWriterImpl.response JSP Page Application Restart Remote DoS
5586| [73247] Apache Subversion mod_dav_svn File Permission Weakness Information Disclosure
5587| [73246] Apache Subversion mod_dav_svn Path-based Access Control Rule Handling Remote DoS
5588| [73245] Apache Subversion mod_dav_svn Baselined Resource Request Handling Remote DoS
5589| [73154] Apache Archiva Multiple Unspecified CSRF
5590| [73153] Apache Archiva /archiva/admin/deleteNetworkProxy!confirm.action proxyid Parameter XSS
5591| [72407] Apache Tomcat @ServletSecurity Initial Load Annotation Security Constraint Bypass Information Disclosure
5592| [72238] Apache Struts Action / Method Names <
5593| [71647] Apache HttpComponents HttpClient Proxy-Authorization Credentials Remote Disclosure
5594| [71558] Apache Tomcat SecurityManager ServletContext Attribute Traversal Arbitrary File Manipulation
5595| [71557] Apache Tomcat HTML Manager Multiple XSS
5596| [71075] Apache Archiva User Management Page XSS
5597| [71027] Apache Tomcat @ServletSecurity Annotation Security Constraint Bypass Information Disclosure
5598| [70925] Apache Continuum Project Pages Unspecified XSS (2011-0533)
5599| [70924] Apache Continuum Multiple Admin Function CSRF
5600| [70809] Apache Tomcat NIO HTTP Connector Request Line Processing DoS
5601| [70734] Apache CouchDB Request / Cookie Handling Unspecified XSS
5602| [70585] Oracle Fusion Middleware Oracle HTTP Server Apache Plugin Unspecified Remote Issue
5603| [70333] Apache Subversion rev_hunt.c blame Command Multiple Memory Leak Remote DoS
5604| [70332] Apache Subversion Apache HTTP Server mod_dav_svn repos.c walk FunctionSVNParentPath Collection Remote DoS
5605| [69659] Apache Archiva Admin Authentication Weakness Privilege Escalation
5606| [69520] Apache Archiva Administrator Credential Manipulation CSRF
5607| [69512] Apache Tomcat Set-Cookie Header HTTPOnly Flag Session Hijacking Weakness
5608| [69456] Apache Tomcat Manager manager/html/sessions Multiple Parameter XSS
5609| [69275] Apache mod_fcgid Module fcgid_bucket.c fcgid_header_bucket_read() Function Remote Overflow
5610| [69067] Apache Shiro URI Path Security Traversal Information Disclosure
5611| [68815] Apache MyFaces shared/util/StateUtils.java View State MAC Weakness Cryptographic Padding Remote View State Modification
5612| [68670] Apache Qpid C++ Broker Component broker/SessionAdapter.cpp SessionAdapter::ExchangeHandlerImpl::checkAlternate Function Exchange Alternate Remote DoS
5613| [68669] Apache Qpid cluster/Cluster.cpp Cluster::deliveredEvent Function Invalid AMQP Data Remote DoS
5614| [68662] Apache Axis2 dswsbobje.war Module Admin Account Default Password
5615| [68531] Apache Qpid qpidd sys/ssl/SslSocket.cpp Incomplete SSL Handshake Remote DoS
5616| [68327] Apache APR-util buckets/apr_brigade.c apr_brigade_split_line() Function Memory Consumption DoS
5617| [68314] Apache XML-RPC SAX Parser External Entity Information Disclosure
5618| [67964] Apache Traffic Server Transaction ID / Source Port Randomization Weakness DNS Cache Poisoning
5619| [67846] SUSE Lifecycle Management Server on SUSE Linux Enterprise apache2-slms Parameter Quoting CSRF
5620| [67294] Apache CXF XML SOAP Message Crafted Document Type Declaration Remote DoS
5621| [67240] Apache CouchDB Installation Page Direct Request Arbitrary JavaScript Code Execution CSRF
5622| [67205] Apache Derby BUILTIN Authentication Password Hash Generation Algorithm SHA-1 Transformation Password Substitution
5623| [66745] Apache HTTP Server Multiple Modules Pathless Request Remote DoS
5624| [66319] Apache Tomcat Crafted Transfer-Encoding Header Handling Buffer Recycling Remote DoS
5625| [66280] Apache Struts XWork ParameterInterceptor Server-Side Object Remote Code Execution
5626| [66226] Apache Axis2 Admin Interface Cookie Session Fixation
5627| [65697] Apache Axis2 / Java SOAP Message DTD Rejection Weakness Arbitrary File Access
5628| [65654] Apache HTTP Server mod_proxy_http mod_proxy_http.c Timeout Detection Weakness HTTP Request Response Disclosure
5629| [65429] Apache MyFaces Unencrypted ViewState Serialized View Object Manipulation Arbitrary Expression Language (EL) Statement Execution
5630| [65054] Apache ActiveMQ Jetty Error Handler XSS
5631| [64844] Apache Axis2/Java axis2/axis2-admin/engagingglobally modules Parameter XSS
5632| [64522] Apache Open For Business Project (OFBiz) ecommerce/control/contactus Multiple Parameter XSS
5633| [64521] Apache Open For Business Project (OFBiz) Web Tools Section entityName Parameter XSS
5634| [64520] Apache Open For Business Project (OFBiz) ecommerce/control/ViewBlogArticle contentId Parameter XSS
5635| [64519] Apache Open For Business Project (OFBiz) Control Servlet URI XSS
5636| [64518] Apache Open For Business Project (OFBiz) Show Portal Page Section start Parameter XSS
5637| [64517] Apache Open For Business Project (OFBiz) View Profile Section partyId Parameter XSS
5638| [64516] Apache Open For Business Project (OFBiz) Export Product Listing Section productStoreId Parameter XSS
5639| [64307] Apache Tomcat Web Application Manager/Host Manager CSRF
5640| [64056] mod_auth_shadow for Apache HTTP Server wait() Function Authentication Bypass
5641| [64023] Apache Tomcat WWW-Authenticate Header Local Host Information Disclosure
5642| [64020] Apache ActiveMQ Jetty ResourceHandler Crafted Request JSP File Source Disclosure
5643| [63895] Apache HTTP Server mod_headers Unspecified Issue
5644| [63368] Apache ActiveMQ createDestination.action JMSDestination Parameter CSRF
5645| [63367] Apache ActiveMQ createDestination.action JMSDestination Parameter XSS
5646| [63350] Apache CouchDB Hash Verification Algorithm Predictable Execution Time Weakness
5647| [63140] Apache Thrift Service Malformed Data Remote DoS
5648| [62676] Apache HTTP Server mod_proxy_ajp Module Crafted Request Remote DoS
5649| [62675] Apache HTTP Server Multi-Processing Module (MPM) Subrequest Header Handling Cross-thread Information Disclosure
5650| [62674] Apache HTTP Server mod_isapi Module Unloading Crafted Request Remote DoS
5651| [62231] Apache HTTP Server Logging Format Weakness Crafted DNS Response IP Address Spoofing
5652| [62230] Apache HTTP Server Crafted DNS Response Inverse Lookup Log Corruption XSS
5653| [62054] Apache Tomcat WAR Filename Traversal Work-directory File Deletion
5654| [62053] Apache Tomcat Autodeployment Process appBase File HTTP Request Authentication Bypass
5655| [62052] Apache Tomcat WAR File Traversal Arbitrary File Overwrite
5656| [62009] Apache HTTP Server src/modules/proxy/proxy_util.c mod_proxy ap_proxy_send_fb() Function Overflow
5657| [61379] Apache River Outrigger Entry Storage Saturation Memory Exhaustion DoS
5658| [61378] Apache Hadoop Map/Reduce JobTracker Memory Consumption DoS
5659| [61377] Apache Commons Modeler Multiple Mutable Static Fields Weakness
5660| [61376] Apache Rampart wsse:security Tag Signature Value Checking Weakness
5661| [60687] Apache C++ Standard Library (STDCXX) strxfrm() Function Overflow
5662| [60680] Apache Hadoop JobHistory Job Name Manipulation Weakness
5663| [60679] Apache ODE DeploymentWebService OMElement zipPart CRLF Injection
5664| [60678] Apache Roller Comment Email Notification Manipulation DoS
5665| [60677] Apache CouchDB Unspecified Document Handling Remote DoS
5666| [60428] Sun Java Plug-in org.apache.crimson.tree.XmlDocument Class reateXmlDocument Method Floppy Drive Access Bypass
5667| [60413] mod_throttle for Apache Shared Memory File Manipulation Local Privilege Escalation
5668| [60412] Sun Java Plug-in org.apache.xalan.processor.XSLProcessorVersion Class Unsigned Applet Variable Sharing Privilege Escalation
5669| [60396] Apache HTTP Server on OpenBSD Multipart MIME Boundary Remote Information Disclosure
5670| [60395] Apache HTTP Server on OpenBSD ETag HTTP Header Remote Information Disclosure
5671| [60232] PHP on Apache php.exe Direct Request Remote DoS
5672| [60176] Apache Tomcat Windows Installer Admin Default Password
5673| [60016] Apache HTTP Server on HP Secure OS for Linux HTTP Request Handling Unspecified Issue
5674| [59979] Apache HTTP Server on Apple Mac OS X HTTP TRACE Method Unspecified Client XSS
5675| [59969] Apache HTTP Server mod_ssl SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection
5676| [59944] Apache Hadoop jobhistory.jsp XSS
5677| [59374] Apache Solr Search Extension for TYPO3 Unspecified XSS
5678| [59022] Apache Shindig ConcatProxyServlet HTTP Header Response Splitting
5679| [59021] Apache Cocoon X-Cocoon-Version Header Remote Information Disclosure
5680| [59020] Apache Tapestry HTTPS Session Cookie Secure Flag Weakness
5681| [59019] Apache mod_python Cookie Salting Weakness
5682| [59018] Apache Harmony Error Message Handling Overflow
5683| [59013] Apache Derby SYSCS_EXPORT_TABLE Arbitrary File Overwrite
5684| [59012] Apache Derby Driver Auto-loading Non-deterministic Startup Weakness
5685| [59011] Apache JSPWiki Page Attachment Change Note Function XSS
5686| [59010] Apache Solr get-file.jsp XSS
5687| [59009] Apache Solr action.jsp XSS
5688| [59008] Apache Solr analysis.jsp XSS
5689| [59007] Apache Solr schema.jsp Multiple Parameter XSS
5690| [59006] Apache Beehive select / checkbox Tag XSS
5691| [59005] Apache Beehive jpfScopeID Global Parameter XSS
5692| [59004] Apache Beehive Error Message XSS
5693| [59003] Apache HttpClient POST Request Handling Memory Consumption DoS
5694| [59002] Apache Jetspeed default-page.psml URI XSS
5695| [59001] Apache Axis2 xsd Parameter Traversal Arbitrary File Disclosure
5696| [59000] Apache CXF Unsigned Message Policy Bypass
5697| [58999] Apache WSS4J CallbackHandler Plaintext Password Validation Weakness
5698| [58998] Apache OpenJPA persistence.xml Cleartext Password Local Disclosure
5699| [58997] Apache OpenEJB openejb.xml Cleartext Password Local Disclosure
5700| [58996] Apache Hadoop Map/Reduce LinuxTaskController File Group Ownership Weakness
5701| [58995] Apache Hadoop Map/Reduce Task Ownership Weakness
5702| [58994] Apache Hadoop Map/Reduce DistributedCache Localized File Permission Weakness
5703| [58993] Apache Hadoop browseBlock.jsp XSS
5704| [58991] Apache Hadoop browseDirectory.jsp XSS
5705| [58990] Apache Hadoop Map/Reduce HTTP TaskTrackers User Data Remote Disclosure
5706| [58989] Apache Hadoop Sqoop Process Listing Local Cleartext Password Disclosure
5707| [58988] Apache Hadoop Chukwa HICC Portal Unspecified XSS
5708| [58987] Apache Hadoop Map/Reduce TaskTracker User File Permission Weakness
5709| [58986] Apache Qpid Encrypted Message Handling Remote Overflow DoS
5710| [58985] Apache Qpid Process Listing Local Cleartext Password Disclosure
5711| [58984] Apache Jackrabbit Content Repository (JCR) Default Account Privilege Access Weakness
5712| [58983] Apache Jackrabbit Content Repository (JCR) NamespaceRegistry API Registration Method Race Condition
5713| [58982] Apache Synapse Proxy Service Security Policy Mismatch Weakness
5714| [58981] Apache Geronimo TomcatGeronimoRealm Security Context Persistence Weakness
5715| [58980] Apache Geronimo LDAP Realm Configuration Restart Reversion Weakness
5716| [58979] Apache MyFaces Tomahawk ExtensionsPhaseListener HTML Injection Information Disclosure
5717| [58978] Apache MyFaces Trinidad LocaleInfoScriptlet XSS
5718| [58977] Apache Open For Business Project (OFBiz) Multiple Default Accounts
5719| [58976] Apache Open For Business Project (OFBiz) URI passThru Parameter XSS
5720| [58975] Apache Open For Business Project (OFBiz) PARTYMGR_CREATE/UPDATE Permission Arbitrary User Password Modification
5721| [58974] Apache Sling /apps Script User Session Management Access Weakness
5722| [58973] Apache Tuscany Crafted SOAP Request Access Restriction Bypass
5723| [58931] Apache Geronimo Cookie Parameters Validation Weakness
5724| [58930] Apache Xalan-C++ XPath Handling Remote DoS
5725| [58879] Apache Portable Runtime (APR-util) poll/unix/port.c Event Port Backend Pollset Feature Remote DoS
5726| [58837] Apache Commons Net FTPSClient CipherSuites / Protocols Mutable Object Unspecified Data Security Issue
5727| [58813] Apache MyFaces Trinidad tr:table / HTML Comment Handling DoS
5728| [58812] Apache Open For Business Project (OFBiz) JSESSIONID Session Hijacking Weakness
5729| [58811] Apache Open For Business Project (OFBiz) /catalog/control/EditProductConfigItem configItemId Parameter XSS
5730| [58810] Apache Open For Business Project (OFBiz) /catalog/control/EditProdCatalo prodCatalogId Parameter XSS
5731| [58809] Apache Open For Business Project (OFBiz) /partymgr/control/viewprofile partyId Parameter XSS
5732| [58808] Apache Open For Business Project (OFBiz) /catalog/control/createProduct internalName Parameter XSS
5733| [58807] Apache Open For Business Project (OFBiz) Multiple Unspecified CSRF
5734| [58806] Apache FtpServer MINA Logging Filter Cleartext Credential Local Disclosure
5735| [58805] Apache Derby Unauthenticated Database / Admin Access
5736| [58804] Apache Wicket Header Contribution Unspecified Issue
5737| [58803] Apache Wicket Session Fixation
5738| [58802] Apache Directory Server (ApacheDS) userPassword Attribute Search Password Disclosure
5739| [58801] Apache ActiveMQ Stomp Client Credential Validation Bypass
5740| [58800] Apache Tapestry (context)/servicestatus Internal Service Information Disclosure
5741| [58799] Apache Tapestry Logging Cleartext Password Disclosure
5742| [58798] Apache Jetspeed pipeline Parameter pipeline-map Policy Bypass
5743| [58797] Apache Jetspeed Password Policy Multiple Weaknesses
5744| [58796] Apache Jetspeed Unsalted Password Storage Weakness
5745| [58795] Apache Rampart Crafted SOAP Header Authentication Bypass
5746| [58794] Apache Roller Admin Protocol (RAP) Malformed Header Authentication Bypass
5747| [58793] Apache Hadoop Map/Reduce mapred.system.dir Permission Weakness Job Manipulation
5748| [58792] Apache Shindig gadgets.rpc iframe RPC Call Validation Weakness
5749| [58791] Apache Synapse synapse.properties Cleartext Credential Local Disclosure
5750| [58790] Apache WSS4J SOAP Message UsernameToken Remote Password Disclosure
5751| [58789] Apache WSS4J SOAP Header Malformed UsernameToken Authentication Bypass
5752| [58776] Apache JSPWiki PreviewContent.jsp Edited Text XSS
5753| [58775] Apache JSPWiki preview.jsp action Parameter XSS
5754| [58774] Apache JSPWiki Edit.jsp Multiple Parameter XSS
5755| [58773] Apache JSPWiki Accept-Language Header Multiple Script language Parameter XSS
5756| [58772] Apache JSPWiki EditorManager.java editor Parameter XSS
5757| [58771] Apache JSPWiki GroupContent.jsp Multiple Parameter XSS
5758| [58770] Apache JSPWiki Group.jsp group Parameter XSS
5759| [58769] Apache JSPWiki Database Connection Termination DoS Weakness
5760| [58768] Apache JSPWiki Attachment Servlet nextpage Parameter Arbitrary Site Redirect
5761| [58766] Apache JSPWiki /admin/SecurityConfig.jsp Direct Request Information Disclosure
5762| [58765] Apache JSPWiki Spam Filter UniqueID RNG Weakness
5763| [58764] Apache JSPWiki Edit.jsp Multiple Parameter XSS
5764| [58763] Apache JSPWiki Include Tag Multiple Script XSS
5765| [58762] Apache JSPWiki Multiple .java Tags pageContext Parameter XSS
5766| [58761] Apache JSPWiki Wiki.jsp skin Parameter XSS
5767| [58760] Apache Commons VFS Exception Error Message Cleartext Credential Disclosure
5768| [58759] Apache Jackrabbit Content Repository (JCR) UUID System.currentTimeMillis() RNG Weakness
5769| [58758] Apache River GrantPermission Policy Manipulation Privilege Escalation
5770| [58757] Apache WS-Commons Java2 StaXUtils Multiple Unspecified Minor Issues
5771| [58756] Apache WSS4J WSHandler Client Certificate Signature Validation Weakness
5772| [58755] Apache Harmony DRLVM Non-public Class Member Access
5773| [58754] Apache Harmony File.createTempFile() Temporary File Creation Prediction Weakness
5774| [58751] Apache Geronimo GeronimoIdentityResolver Subject Handling Multiple Issues
5775| [58750] Apache MyFaces Trinidad Generated HTML Information Disclosure
5776| [58749] Apache MyFaces Trinidad Database Access Error Message Information Disclosure
5777| [58748] Apache MyFaces Trinidad Image Resource Loader Traversal Arbitrary Image Access
5778| [58747] Apache MyFaces Trinidad Error Message User Entered Data Disclosure Weakness
5779| [58746] Apache Axis2 JAX-WS Java2 WSDL4J Unspecified Issue
5780| [58744] Apache Wicket Crafted File Upload Disk Space Exhaustion DoS
5781| [58743] Apache Wicket wicket.util.crypt.SunJceCrypt Encryption Reversion Weakness
5782| [58742] Apache Rampart PolicyBasedValiadtor HttpsToken Endpoint Connection Weakness
5783| [58741] Apache Rampart WSSecSignature / WSSecEncryptedKey KeyIdentifierType Validation Weakness
5784| [58740] Apache Rampart TransportBinding Message Payload Cleartext Disclosure
5785| [58739] Apache Open For Business Project (OFBiz) Unsalted Password Storage Weakness
5786| [58738] Apache Open For Business Project (OFBiz) orderId Parameter Arbitrary Order Access
5787| [58737] Apache mod_python w/ mod_python.publisher index.py Underscore Prefixed Variable Disclosure
5788| [58735] Apache Open For Business Project (OFBiz) /ecommerce/control/keywordsearch SEARCH_STRING Parameter XSS
5789| [58734] Apache Torque Log File Cleartext Credential Local Disclosure
5790| [58733] Apache Axis2 doGet Implementation Authentication Bypass Service State Manipulation
5791| [58732] Apache MyFaces UIInput.validate() Null Value Validation Bypass Weakness
5792| [58731] Apache MyFaces /faces/* Prefix Mapping Authentication Bypass
5793| [58725] Apache Tapestry Basic String ACL Bypass Weakness
5794| [58724] Apache Roller Logout Functionality Failure Session Persistence
5795| [58723] Apache Roller User Profile / Admin Page Cleartext Password Disclosure
5796| [58722] Apache Derby Connection URL Encryption Method Reversion Weakness
5797| [58721] Apache Geronimo on Tomcat Security-constraint Resource ACL Bypass
5798| [58720] Apache Geronimo Explicit Servlet Mapping Access Bypass Weakness
5799| [58719] Apache Geronimo Keystore Unprivileged Service Disable DoS
5800| [58718] Apache Geronimo Deployment Plans Remote Password Disclosure
5801| [58717] Apache Jetspeed Portlet Application Edit Access Restriction Bypass
5802| [58716] Apache Jetspeed PSML Management Cached Constraint Authentication Weakness
5803| [58707] Apache WSS4J Crafted PasswordDigest Request Authentication Bypass
5804| [58706] Apache HttpClient Pre-emptive Authorization Remote Credential Disclosure
5805| [58705] Apache Directory Server (ApacheDS) User Passwords Cleartext Disclosure
5806| [58704] Apache Directory Server (ApacheDS) Non-existent User LDAP Bind Remote DoS
5807| [58703] Apache Geronimo Debug Console Unauthenticated Remote Information Disclosure
5808| [58702] Apache Directory Server (ApacheDS) Persistent LDAP Anonymous Bind Weakness
5809| [58701] Apache Jetspeed User Admin Portlet Unpassworded Account Creation Weakness
5810| [58700] Apache MyFaces /faces/* Path Handling Remote Overflow DoS
5811| [58699] Apache MyFaces Disable Property Client Side Manipulation Privilege Escalation
5812| [58698] Apache Roller Remember Me Functionality Cleartext Password Disclosure
5813| [58697] Apache XalanJ2 org.apache.xalan.xsltc.runtime.CallFunction Class Unspecified Issue
5814| [58696] Apache Tapestry Encoded Traversal Arbitrary File Access
5815| [58695] Apache Jetspeed Unauthenticated PSML Tags / Admin Folder Access
5816| [58694] Apache Geronimo Deploy Tool Process List Local Credential Disclosure
5817| [58693] Apache Derby service.properties File Encryption Key Information Disclosure
5818| [58692] Apache Geronimo Default Security Realm Login Brute Force Weakness
5819| [58689] Apache Roller Retrieve Last 5 Post Feature Unauthorized Blog Post Manipulation
5820| [58688] Apache Xalan-Java (XalanJ2) Static Variables Multiple Unspecified Issues
5821| [58687] Apache Axis Invalid wsdl Request XSS
5822| [58686] Apache Cocoon Temporary File Creation Unspecified Race Condition
5823| [58685] Apache Velocity Template Designer Privileged Code Execution
5824| [58684] Apache Jetspeed controls.Customize Action Security Check Bypass
5825| [58675] Apache Open For Business Project (OFBiz) eCommerce/ordermgr Multiple Field XSS
5826| [58674] Apache Open For Business Project (OFBiz) ecommerce/control/login Multiple Field XSS
5827| [58673] Apache Open For Business Project (OFBiz) ecommerce/control/viewprofile Multiple Field XSS
5828| [58672] Apache Open For Business Project (OFBiz) POS Input Panel Cleartext Password Disclosure
5829| [58671] Apache Axis2 JMS Signed Message Crafted WS-Security Header Security Bypass
5830| [58670] Apache Jetspeed JetspeedTool.getPortletFromRegistry Portlet Security Validation Failure
5831| [58669] Apache Jetspeed LDAP Cleartext Passwords Disclosure
5832| [58668] Apache Axis External Entity (XXE) Data Parsing Privilege Escalation
5833| [58667] Apache Roller Database Cleartext Passwords Disclosure
5834| [58666] Apache Xerces-C++ UTF-8 Transcoder Overlong Code Handling Unspecified Issue
5835| [58665] Apache Jetspeed Turbine: Cross-user Privileged Action Execution
5836| [58664] Apache Jetspeed EditAccount.vm Password Modification Weakness
5837| [58663] Apache Jetspeed Role Parameter Arbitrary Portlet Disclosure
5838| [58662] Apache Axis JWS Page Generated .class File Direct Request Information Disclosure
5839| [58661] Apache Jetspeed user-form.vm Password Reset Cleartext Disclosure
5840| [58660] Apache WSS4J checkReceiverResults Function Crafted SOAP Request Authentication Bypass
5841| [58658] Apache Rampart Crafted SOAP Request Security Verification Bypass
5842| [57882] Apache HTTP Server mod_proxy_ftp Authorization HTTP Header Arbitrary FTP Command Injection
5843| [57851] Apache HTTP Server mod_proxy_ftp EPSV Command NULL Dereference Remote DoS
5844| [56984] Apache Xerces2 Java Malformed XML Input DoS
5845| [56903] Apache ODE (Orchestration Director Engine) Process Deployment Web Service Traversal Arbitrary File Manipulation
5846| [56859] Apache Xerces-C++ Multiple Sub-project XML Nested DTD Structures Parsing Recursion Error DoS
5847| [56766] Apache Portable Runtime (APR-util) memory/unix/apr_pools.c Relocatable Memory Block Aligning Overflow
5848| [56765] Apache Portable Runtime (APR-util) misc/apr_rmm.c Multiple Function Overflows
5849| [56517] Apache HTTP Server File Descriptor Leak Arbitrary Local File Append
5850| [56443] PTK Unspecified Apache Sub-process Arbitrary Command Execution
5851| [56414] Apache Tiles Duplicate Expression Language (EL) Expression Evaluation XSS
5852| [55814] mod_NTLM for Apache HTTP Server ap_log_rerror() Function Remote Format String
5853| [55813] mod_NTLM for Apache HTTP Server log() Function Remote Overflow
5854| [55782] Apache HTTP Server mod_deflate Module Aborted Connection DoS
5855| [55553] Apache HTTP Server mod_proxy Module mod_proxy_http.c stream_reqbody_cl Function CPU Consumption DoS
5856| [55059] Apache APR-util strmatch/apr_strmatch.c apr_strmatch_precompile Function Crafted Input Remote DoS
5857| [55058] Apache APR-util apr_brigade_vprintf Function Crafted Input Off-by-one Remote DoS
5858| [55057] Apache APR-util xml/apr_xml.c apr_xml_* Interface Expat XML Parser Crafted XML Document Remote DoS
5859| [55056] Apache Tomcat Cross-application TLD File Manipulation
5860| [55055] Apache Tomcat Illegal URL Encoded Password Request Username Enumeration
5861| [55054] Apache Tomcat Java AJP Connector mod_jk Load Balancing Worker Malformed Header Remote DoS
5862| [55053] Apache Tomcat Crafted Request Security Restraint Bypass Arbitrary Content Access
5863| [54733] Apache HTTP Server AllowOverride Directive .htaccess Options Bypass
5864| [54713] razorCMS Security Manager apache User Account Unspecified File Permission Weakness Issue
5865| [54589] Apache Jserv Nonexistent JSP Request XSS
5866| [54122] Apache Struts s:a / s:url Tag href Element XSS
5867| [54093] Apache ActiveMQ Web Console JMS Message XSS
5868| [53932] Apache Geronimo Multiple Admin Function CSRF
5869| [53931] Apache Geronimo /console/portal/Server/Monitoring Multiple Parameter XSS
5870| [53930] Apache Geronimo /console/portal/ URI XSS
5871| [53929] Apache Geronimo on Windows Security/Keystores Portlet Traversal Arbitrary File Upload
5872| [53928] Apache Geronimo on Windows Embedded DB/DB Manager Portlet Traversal Arbitrary File Upload
5873| [53927] Apache Geronimo on Windows Services/Repository Portlet Traversal Arbitrary File Upload
5874| [53921] Apache HTTP Server mod_proxy_ajp Cross Thread/Session Information Disclosure
5875| [53766] Oracle BEA WebLogic Server Plug-ins for Apache Certificate Handling Remote Overflow
5876| [53574] PHP on Apache .htaccess mbstring.func_overload Setting Cross Hosted Site Behavior Modification
5877| [53381] Apache Tomcat JK Connector Content-Length Header Cross-user Information Disclosure
5878| [53380] Apache Struts Unspecified XSS
5879| [53289] Apache mod_perl Apache::Status /perl-status Unspecified XSS
5880| [53186] Apache HTTP Server htpasswd Predictable Salt Weakness
5881| [52899] Apache Tomcat Examples Web Application Calendar Application jsp/cal/cal2.jsp time Parameter XSS
5882| [52407] Apache Tomcat doRead Method POST Content Information Disclosure
5883| [51923] Apache HTTP Server mod-auth-mysql Module mod_auth_mysql.c Multibyte Character Encoding SQL Injection
5884| [51613] Apache HTTP Server Third-party Module Child Process File Descriptor Leak
5885| [51612] Apache HTTP Server Internal Redirect Handling Infinite Loop DoS
5886| [51468] Apache Jackrabbit Content Repository (JCR) swr.jsp q Parameter XSS
5887| [51467] Apache Jackrabbit Content Repository (JCR) search.jsp q Parameter XSS
5888| [51151] Apache Roller Search Function q Parameter XSS
5889| [50482] PHP with Apache php_value Order Unspecified Issue
5890| [50475] Novell NetWare ApacheAdmin Console Unauthenticated Access
5891| [49734] Apache Struts DefaultStaticContentLoader Class Traversal Arbitrary File Access
5892| [49733] Apache Struts FilterDispatcher Class Traversal Arbitrary File Access
5893| [49283] Oracle BEA WebLogic Server Plugins for Apache Remote Transfer-Encoding Overflow
5894| [49062] Apache Tomcat Cross-thread Concurrent Request Variable Overwrite Information Disclosure
5895| [48847] ModSecurity (mod_security) Transformation Caching Unspecified Apache DoS
5896| [48788] Apache Xerces-C++ XML Schema maxOccurs Value XML File Handling DoS
5897| [47474] Apache HTTP Server mod_proxy_ftp Directory Component Wildcard Character XSS
5898| [47464] Apache Tomcat allowLinking / UTF-8 Traversal Arbitrary File Access
5899| [47463] Apache Tomcat RequestDispatcher Traversal Arbitrary File Access
5900| [47462] Apache Tomcat HttpServletResponse.sendError Method Message Argument XSS
5901| [47096] Oracle Weblogic Apache Connector POST Request Overflow
5902| [46382] Frontend Filemanager (air_filemanager) Extension for TYPO3 on Apache Unspecified Arbitrary Code Execution
5903| [46285] TYPO3 on Apache Crafted Filename Upload Arbitrary Command Execution
5904| [46085] Apache HTTP Server mod_proxy ap_proxy_http_process_response() Function Interim Response Forwarding Remote DoS
5905| [45905] Apache Tomcat Host Manager host-manager/html/add name Parameter XSS
5906| [45879] Ragnarok Online Control Panel on Apache Crafted Traversal Authentication Bypass
5907| [45742] Apache HTTP Server on Novell Unspecified Request Directive Internal IP Disclosure
5908| [45740] Apache Derby DropSchemaNode Bind Phase Arbitrary Scheme Statement Dropping
5909| [45599] Apache Derby Lock Table Statement Privilege Requirement Bypass Arbitrary Table Lock
5910| [45585] Apache Derby ACCSEC Command RDBNAM Parameter Cleartext Credential Disclosure
5911| [45584] Apache Derby DatabaseMetaData.getURL Function Cleartext Credential Disclosure
5912| [45420] Apache HTTP Server 403 Error Page UTF-7 Encoded XSS
5913| [44728] PHP Toolkit on Gentoo Linux Interpretation Conflict Apache HTTP Server Local DoS
5914| [44618] Oracle JSP Apache/Jserv Path Translation Traversal Arbitrary JSP File Execution
5915| [44159] Apache HTTP Server Remote Virtual Host Name Disclosure
5916| [43997] Apache-SSL ExpandCert() Function Certificate Handling Arbitrary Environment Variables Manipulation
5917| [43994] suPHP for Apache (mod_suphp) Directory Symlink Local Privilege Escalation
5918| [43993] suPHP for Apache (mod_suphp) Owner Mode Race Condition Symlink Local Privilege Escalation
5919| [43663] Apache HTTP Server Mixed Platform AddType Directive Crafted Request PHP Source Disclosure
5920| [43658] AuthCAS Module (AuthCAS.pm) for Apache HTTP Server SESSION_COOKIE_NAME SQL Injection
5921| [43452] Apache Tomcat HTTP Request Smuggling
5922| [43309] Apache Geronimo LoginModule Login Method Bypass
5923| [43290] Apache JSPWiki Entry Page Attachment Unrestricted File Upload
5924| [43259] Apache HTTP Server on Windows mod_proxy_balancer URL Handling Remote Memory Corruption
5925| [43224] Apache Geronimo on SuSE Linux init Script Symlink Unspecified File/Directory Access
5926| [43189] Apache mod_jk2 Host Header Multiple Fields Remote Overflow
5927| [42937] Apache HTTP Server mod_proxy_balancer balancer-manager Unspecified CSRF
5928| [42341] MOD_PLSQL for Apache Unspecified URL SQL Injection
5929| [42340] MOD_PLSQL for Apache CGI Environment Handling Unspecified Overflow
5930| [42214] Apache HTTP Server mod_proxy_ftp UTF-7 Encoded XSS
5931| [42091] Apache Maven Site Plugin Installation Permission Weakness
5932| [42089] Apache Maven .m2/settings.xml Cleartext Password Disclosure
5933| [42088] Apache Maven Defined Repo Process Listing Password Disclosure
5934| [42087] Apache Maven Site Plugin SSH Deployment Permission Setting Weakness
5935| [42036] Apache HTTP Server MS-DOS Device Request Host OS Disclosure
5936| [41891] BEA WebLogic Apache Beehive NetUI Page Flow Unspecified XSS
5937| [41436] Apache Tomcat Native APR Connector Duplicate Request Issue
5938| [41435] Apache Tomcat %5C Cookie Handling Session ID Disclosure
5939| [41434] Apache Tomcat Exception Handling Subsequent Request Information Disclosure
5940| [41400] LimeSurvey save.php Apache Log File PHP Code Injection
5941| [41029] Apache Tomcat Calendar Examples Application cal2.jsp Multiple Parameter CSRF
5942| [41019] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload XSS
5943| [41018] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload CRLF
5944| [40853] Apache Tomcat SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) JSESSIONIDSSO Cookie Security Weakness
5945| [40264] Apache HTTP Server mod_proxy_balancer balancer_handler Function bb Variable Remote DoS
5946| [40263] Apache HTTP Server mod_proxy_balancer balancer-manager Multiple Parameter XSS
5947| [40262] Apache HTTP Server mod_status refresh XSS
5948| [39833] Apache Tomcat JULI Logging Component catalina.policy Security Bypass
5949| [39251] Coppermine Photo Gallery on Apache Multiple File Extension Upload Arbitrary Code Execution
5950| [39166] Apache Tomcat on Windows caseSensitive Attribute Mixed Case Request JSP Source Disclosure
5951| [39134] Apache mod_imagemap Module Imagemap Unspecified XSS
5952| [39133] Apache mod_imap Module Imagemap File Unspecified XSS
5953| [39035] Apache Tomcat examples/servlet/CookieExample Multiple Parameter XSS
5954| [39003] Apache HTTP Server HTTP Method Header Request Entity Too Large XSS
5955| [39000] Apache Tomcat SendMailServlet sendmail.jsp mailfrom Parameter XSS
5956| [38939] Apache HTTP Server Prefork MPM Module Array Modification Local DoS
5957| [38673] Apache Jakarta Slide WebDAV SYSTEM Request Traversal Arbitrary File Access
5958| [38662] Apache Geronimo SQLLoginModule Nonexistent User Authentication Bypass
5959| [38661] Apache Geronimo MEJB Unspecified Authentication Bypass
5960| [38641] Apache HTTP Server mod_mem_cache recall_headers Function Information Disclosure
5961| [38640] Apache HTTP Server suexec Document Root Unauthorized Operations
5962| [38639] Apache HTTP Server suexec Multiple Symlink Privilege Escalation
5963| [38636] Apache HTTP Server mod_autoindex.c P Variable UTF-7 Charset XSS
5964| [38513] BEA WebLogic Server Proxy Plug-in for Apache Protocol Error Handling Remote DoS
5965| [38187] Apache Geronimo / Tomcat WebDAV XML SYSTEM Tag Arbitrary File Access
5966| [37079] Apache HTTP Server mod_cache cache_util.c Malformed Cache-Control Header DoS
5967| [37071] Apache Tomcat Cookie Handling Session ID Disclosure
5968| [37070] Apache Tomcat Cookie Handling Quote Delimiter Session ID Disclosure
5969| [37052] Apache HTTP Server mod_status mod_status.c Unspecified XSS
5970| [37051] Apache HTTP Server mod_proxy modules/proxy/proxy_util.c Crafted Header Remote DoS
5971| [37050] Apache HTTP Server Prefork MPM Module Crafted Code Sequence Local DoS
5972| [36417] Apache Tomcat Host Manager Servlet html/add Action aliases Parameter XSS
5973| [36377] Apache MyFaces Tomahawk JSF Application autoscroll Multiple Script XSS
5974| [36080] Apache Tomcat JSP Examples Crafted URI XSS
5975| [36079] Apache Tomcat Manager Uploaded Filename XSS
5976| [34888] Apache Tomcat Example Calendar Application cal2.jsp time Parameter XSS
5977| [34887] Apache Tomcat implicit-objects.jsp Crafted Header XSS
5978| [34885] Apache Tomcat on IIS Servlet Engine MS-DOS Device Request DoS
5979| [34884] Apache Tomcat on Windows Nonexistent Resource Request Path Disclosure
5980| [34883] Apache Tomcat Crafted JSP File Request Path Disclosure
5981| [34882] Apache Tomcat Default SSL Ciphersuite Configuration Weakness
5982| [34881] Apache Tomcat Malformed Accept-Language Header XSS
5983| [34880] Apache Tomcat HTTP/1.1 Connector NULL Byte Request JSP Source Disclosure
5984| [34879] Apache Tomcat examples/jsp2/jspx/textRotate.jspx XSS
5985| [34878] Apache Tomcat examples/jsp2/el/implicit-objects.jsp XSS
5986| [34877] Apache Tomcat JK Web Server Connector (mod_jk) Double Encoded Traversal Arbitrary File Access
5987| [34876] Apache HTTP Server ScriptAlias CGI Source Disclosure
5988| [34875] Apache Tomcat appdev/sample/web/hello.jsp Multiple Parameter XSS
5989| [34874] Apache Tomcat AJP Connector mod_jk ajp_process_callback Remote Memory Disclosure
5990| [34873] Apache Stats Variable Extraction _REQUEST Ssuperglobal Array Overwrite
5991| [34872] Apache HTTP Server suexec User/Group Combination Weakness Local Privilege Escalation
5992| [34769] Apache Tomcat w/ Proxy Module Double Encoded Traversal Arbitrary File Access
5993| [34541] mod_perl for Apache HTTP Server RegistryCooker.pm PATH_INFO Crafted URI Remote DoS
5994| [34540] mod_perl for Apache HTTP Server PerlRun.pm PATH_INFO Crafted URI Remote DoS
5995| [34398] Apache Tomcat mod_jk Invalid Chunked Encoded Body Information Disclosure
5996| [34154] Apache Axis Nonexistent Java Web Service Path Disclosure
5997| [33855] Apache Tomcat JK Web Server Connector mod_jk.so Long URI Worker Map Remote Overflow
5998| [33816] Apache HTTP Server on Debian Linux TTY Local Privilege Escalation
5999| [33456] Apache HTTP Server Crafted TCP Connection Range Header DoS
6000| [33346] Avaya Multiple Products Apache Tomcat Port Weakness
6001| [32979] Apache Java Mail Enterprise Server (JAMES) Phoenix/MX4J Interface Arbitrary User Creation
6002| [32978] Apache Java Mail Enterprise Server (JAMES) POP3Server Log File Plaintext Password Disclosure
6003| [32724] Apache mod_python _filter_read Freed Memory Disclosure
6004| [32723] Apache Tomcat semicolon Crafted Filename Request Forced Directory Listing
6005| [32396] Apache Open For Business Project (OFBiz) Ecommerce Component Forum Implementation Message Body XSS
6006| [32395] Apache Open For Business Project (OFBiz) Ecommerce Component Form Field Manipulation Privilege Escalation
6007| [30354] Linux Subversion libapache2-svn Search Path Subversion Local Privilege Escalation
6008| [29603] PHP ini_restore() Apache httpd.conf Options Bypass
6009| [29536] Apache Tcl mod_tcl set_var Function Remote Format String
6010| [28919] Apache Roller Weblogger Blog Comment Multiple Field XSS
6011| [28130] PHP with Apache Mixed Case Method Limit Directive Bypass
6012| [27913] Apache HTTP Server on Windows mod_alias URL Validation Canonicalization CGI Source Disclosure
6013| [27588] Apache HTTP Server mod_rewrite LDAP Protocol URL Handling Overflow
6014| [27487] Apache HTTP Server Crafted Expect Header Cross Domain HTML Injection
6015| [26935] FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
6016| [26572] Apache Java Mail Enterprise Server (JAMES) MAIL Command Overflow DoS
6017| [25909] Drupal on Apache files Directory File Upload Arbitrary Code Execution
6018| [24825] Oracle ModPL/SQL for Apache Unspecified Remote HTTP Issue
6019| [24365] Apache Struts Multiple Function Error Message XSS
6020| [24364] Apache Struts getMultipartRequestHandler() Function Crafted Request DoS
6021| [24363] Apache Struts org.apache.struts.taglib.html.Constants.CANCEL Validation Bypass
6022| [24103] Pubcookie Apache mod_pubcookie Unspecified XSS
6023| [23906] Apache mod_python for Apache HTTP Server FileSession Privileged Local Command Execution
6024| [23905] Apache Log4net LocalSyslogAppender Format String Memory Corruption DoS
6025| [23198] Apache WSS4J Library SOAP Signature Verification Bypass
6026| [23124] Generic Apache Request Library (libapreq) apreq_parse_* Functions Remote DoS
6027| [22652] mod_php for Apache HTTP Server Crafted import_request_variables Function DoS
6028| [22475] PHP w/ Apache PDO::FETCH_CLASS __set() Function DoS
6029| [22473] PHP w/ Apache2 Crafted PDOStatement DoS
6030| [22459] Apache Geronimo Error Page XSS
6031| [22458] Apache Tomcat / Geronimo Sample Script cal2.jsp time Parameter XSS
6032| [22301] auth_ldap for Apache HTTP Server auth_ldap_log_reason() Function Remote Format String
6033| [22261] Apache HTTP Server mod_ssl ssl_hook_Access Error Handling DoS
6034| [22259] mod_auth_pgsql for Apache HTTP Server Log Function Format String
6035| [21736] Apache Java Mail Enterprise Server (JAMES) Spooler retrieve Function DoS
6036| [21705] Apache HTTP Server mod_imap Image Map Referer XSS
6037| [21021] Apache Struts Error Message XSS
6038| [20897] PHP w/ Apache 2 SAPI virtual() Function Unspecified INI Setting Disclosure
6039| [20491] PHP mod_php apache2handler SAPI Crafted .htaccess DoS
6040| [20462] Apache HTTP Server worker.c MPM Memory Exhaustion DoS
6041| [20439] Apache Tomcat Directory Listing Saturation DoS
6042| [20373] Apache Tomcat on HP Secure OS for Linux Unspecified Servlet Access Issue
6043| [20285] Apache HTTP Server Log File Control Character Injection
6044| [20242] Apache HTTP Server mod_usertrack Predictable Session ID Generation
6045| [20209] Brainf*ck Module (mod_bf) for Apache HTTP Server Local Overflow
6046| [20033] Apache Tomcat MS-DOS Device Request Error Message Path Disclosure
6047| [19883] apachetop atop.debug Symlink Arbitrary File Overwrite
6048| [19863] mod_auth_shadow for Apache HTTP Server require group Authentication Bypass
6049| [19855] Apache HTTP Server ErrorDocument Directive .htaccess Bypass
6050| [19821] Apache Tomcat Malformed Post Request Information Disclosure
6051| [19769] Apache HTTP Server Double-reverse DNS Lookup Spoofing
6052| [19188] Apache HTTP Server mod_ssl SSLVerifyClient Per-location Context Restriction Bypass
6053| [19137] Apache HTTP Server on Red Hat Linux Double Slash GET Request Forced Directory Listing
6054| [19136] Apache on Mandrake Linux Arbitrary Directory Forced Listing
6055| [18977] Apache HTTP Server Crafted HTTP Range Header DoS
6056| [18389] Ragnarok Online Control Panel Apache Authentication Bypass
6057| [18286] Apache HTTP Server mod_ssl ssl_callback_SSLVerify_CRL( ) Function Overflow
6058| [18233] Apache HTTP Server htdigest user Variable Overfow
6059| [17738] Apache HTTP Server HTTP Request Smuggling
6060| [16586] Apache HTTP Server Win32 GET Overflow DoS
6061| [15889] Apache HTTP Server mod_cgid Threaded MPM CGI Output Misdirection
6062| [14896] mod_dav for Apache HTTP Server Remote Null Dereference Child Process Termination
6063| [14879] Apache HTTP Server ap_log_rerror Function Error Message Path Disclosure
6064| [14770] Apache Tomcat AJP12 Protocol Malformed Packet Remote DoS
6065| [14597] Apache Tomcat IntegerOverflow.jsp Test JSP Script Path Disclosure
6066| [14596] Apache Tomcat pageSession.jsp Test JSP Script Path Disclosure
6067| [14595] Apache Tomcat pageLanguage.jsp Test JSP Script Path Disclosure
6068| [14594] Apache Tomcat pageIsThreadSafe.jsp Test JSP Script Path Disclosure
6069| [14593] Apache Tomcat pageIsErrorPage.jsp Test JSP Script Path Disclosure
6070| [14592] Apache Tomcat pageInvalid.jsp Test JSP Script Path Disclosure
6071| [14591] Apache Tomcat pageExtends.jsp Test JSP Script Path Disclosure
6072| [14590] Apache Tomcat pageDouble.jsp Test JSP Script Path Disclosure
6073| [14589] Apache Tomcat pageAutoFlush.jsp Test JSP Script Path Disclosure
6074| [14588] Apache Tomcat extends2.jsp Test JSP Script Path Disclosure
6075| [14587] Apache Tomcat extends1.jsp Test JSP Script Path Disclosure
6076| [14586] Apache Tomcat comments.jsp Test JSP Script Path Disclosure
6077| [14585] Apache Tomcat buffer4.jsp Test JSP Script Path Disclosure
6078| [14584] Apache Tomcat buffer3.jsp Test JSP Script Path Disclosure
6079| [14583] Apache Tomcat buffer2.jsp Test JSP Script Path Disclosure
6080| [14582] Apache Tomcat buffer1.jsp Test JSP Script Path Disclosure
6081| [14581] Apache Tomcat pageImport2.jsp Test JSP Script Path Disclosure
6082| [14580] Apache Tomcat pageInfo.jsp Test JSP Script Path Disclosure
6083| [14410] mod_frontpage for Apache HTTP Server fpexec Remote Overflow
6084| [14044] Apache Batik Squiggle Browser with Rhino Scripting Engine Unspecified File System Access
6085| [13737] mod_access_referer for Apache HTTP Server Malformed Referer DoS
6086| [13711] Apache mod_python publisher.py Traversal Arbitrary Object Information Disclosure
6087| [13640] mod_auth_any for Apache HTTP Server on Red Hat Linux Metacharacter Command Execution
6088| [13304] Apache Tomcat realPath.jsp Path Disclosure
6089| [13303] Apache Tomcat source.jsp Arbitrary Directory Listing
6090| [13087] Apache HTTP Server mod_log_forensic check_forensic Symlink Arbitrary File Creation / Overwrite
6091| [12849] mod_auth_radius for Apache HTTP Server radcpy() Function Overflow DoS
6092| [12848] Apache HTTP Server htdigest realm Variable Overflow
6093| [12721] Apache Tomcat examples/jsp2/el/functions.jsp XSS
6094| [12720] mod_dosevasive for Apache HTTP Server Symlink Arbitrary File Create/Overwrite
6095| [12558] Apache HTTP Server IPv6 FTP Proxy Socket Failure DoS
6096| [12557] Apache HTTP Server prefork MPM accept Error DoS
6097| [12233] Apache Tomcat MS-DOS Device Name Request DoS
6098| [12232] Apache Tomcat with JDK Arbitrary Directory/Source Disclosure
6099| [12231] Apache Tomcat web.xml Arbitrary File Access
6100| [12193] Apache HTTP Server on Mac OS X File Handler Bypass
6101| [12192] Apache HTTP Server on Mac OS X Unauthorized .ht and .DS_Store File Access
6102| [12178] Apache Jakarta Lucene results.jsp XSS
6103| [12176] mod_digest_apple for Apache HTTP Server on Mac OS X Authentication Replay
6104| [11391] Apache HTTP Server Header Parsing Space Saturation DoS
6105| [11003] Apache HTTP Server mod_include get_tag() Function Local Overflow
6106| [10976] mod_mylo for Apache HTTP Server mylo_log Logging Function HTTP GET Overflow
6107| [10637] Apache HTTP Server mod_ssl SSLCipherSuite Access Restriction Bypass
6108| [10546] Macromedia JRun4 mod_jrun Apache Module Remote Overflow
6109| [10471] Apache Xerces-C++ XML Parser DoS
6110| [10218] Apache HTTP Server Satisfy Directive Access Control Bypass
6111| [10068] Apache HTTP Server htpasswd Local Overflow
6112| [10049] mod_cplusplus For Apache HTTP Server Unspecified Overflow
6113| [9994] Apache HTTP Server apr-util IPV6 Parsing DoS
6114| [9991] Apache HTTP Server ap_resolve_env Environment Variable Local Overflow
6115| [9948] mod_dav for Apache HTTP Server LOCK Request DoS
6116| [9742] Apache HTTP Server mod_ssl char_buffer_read Function Reverse Proxy DoS
6117| [9718] Apache HTTP Server Win32 Single Dot Append Arbitrary File Access
6118| [9717] Apache HTTP Server mod_cookies Cookie Overflow
6119| [9716] Apache::Gallery Gallery.pm Inline::C Predictable Filename Code Execution
6120| [9715] Apache HTTP Server rotatelogs Control Characters Over Pipe DoS
6121| [9714] Apache Authentication Module Threaded MPM DoS
6122| [9713] Apache HTTP Server on OS2 filestat.c Device Name Request DoS
6123| [9712] Apache HTTP Server Multiple Linefeed Request Memory Consumption DoS
6124| [9711] Apache HTTP Server Access Log Terminal Escape Sequence Injection
6125| [9710] Apache HTTP Server on Windows Illegal Character Default Script Mapping Bypass
6126| [9709] Apache HTTP Server on Windows MS-DOS Device Name HTTP Post Code Execution
6127| [9708] Apache HTTP Server on Windows MS-DOS Device Name DoS
6128| [9707] Apache HTTP Server Duplicate MIME Header Saturation DoS
6129| [9706] Apache Web Server Multiple MIME Header Saturation Remote DoS
6130| [9705] Apache Tomcat Invoker/Default Servlet Source Disclosure
6131| [9702] Apache HTTP Server CGI/WebDAV HTTP POST Request Source Disclosure
6132| [9701] Apache HTTP Server for Windows Multiple Slash Forced Directory Listing
6133| [9700] Apache HTTP Server mod_autoindex Multiple Slash Request Forced Directory Listing
6134| [9699] Apache HTTP Server mod_dir Multiple Slash Request Forced Directory Listing
6135| [9698] Apache HTTP Server mod_negotiation Multiple Slash Request Forced Directory Listing
6136| [9697] Apache HTTP Server htdigest Local Symlink Arbitrary File Overwrite
6137| [9696] Apache HTTP Server htpasswd Local Symlink Arbitrary File Overwrite
6138| [9695] Apache Tomcat SnoopServlet Servlet Information Disclosure
6139| [9694] PHP3 on Apache HTTP Server Encoded Traversal Arbitrary File Access
6140| [9693] mod_auth_pgsql_sys for Apache HTTP Server User Name SQL Injection
6141| [9692] Apache HTTP Server mod_vhost_alias Mass Virtual Hosting Arbitrary File Access
6142| [9691] Apache HTTP Server mod_rewrite Mass Virtual Hosting Arbitrary File Access
6143| [9690] Apache HTTP Server mod_vhost_alias CGI Program Source Disclosure
6144| [9689] Trustix httpsd for Apache-SSL Permission Weakness Privilege Escalation
6145| [9688] Apache HTTP Server mod_proxy Malformed FTP Command DoS
6146| [9687] Apache::AuthenSmb smbval SMB Authentication Library Multiple Overflows
6147| [9686] Apache::AuthenSmb smbvalid SMB Authentication Library Multiple Overflows
6148| [9523] Apache HTTP Server mod_ssl Aborted Connection DoS
6149| [9459] Oracle PL/SQL (mod_plsql) Apache Module Help Page Request Remote Overflow
6150| [9208] Apache Tomcat .jsp Encoded Newline XSS
6151| [9204] Apache Tomcat ROOT Application XSS
6152| [9203] Apache Tomcat examples Application XSS
6153| [9068] Apache HTTP Server mod_userdir User Account Information Disclosure
6154| [8773] Apache Tomcat Catalina org.apache.catalina.servlets.DefaultServlet Source Code Disclosure
6155| [8772] Apache Tomcat Catalina org.apache.catalina.connector.http DoS
6156| [7943] Apache HTTP Server mod_ssl sslkeys File Disclosure
6157| [7942] Apache HTTP Server mod_ssl Default Pass Phrase
6158| [7941] Apache HTTP Server mod_ssl Encrypted Private Key File Descriptor Leak
6159| [7935] Apache HTTP Server mod_ssl ssl_gcache Race Conditions
6160| [7934] Apache HTTP Server mod_ssl SSLSessionCache File Content Disclosure
6161| [7933] Apache HTTP Server mod_ssl SSLMutex File Content Disclosure
6162| [7932] Apache HTTP Server mod_ssl mkcert.sh File Creation Permission Weakness
6163| [7931] Apache HTTP Server mod_ssl X.509 Client Certificate Authentication Bypass
6164| [7930] Apache HTTP Server mod_ssl ssl_expr_eval_func_file() Overflow
6165| [7929] Apache HTTP Server mod_ssl ssl_engine_log.c mod_proxy Hook Function Remote Format String
6166| [7611] Apache HTTP Server mod_alias Local Overflow
6167| [7394] Apache Tomcat mod_jk Invalid Transfer-Encoding Chunked Field DoS
6168| [7203] Apache Tomcat source.jsp Traversal Arbitrary File Access
6169| [7039] Apache HTTP Server on Mac OS X HFS+ File System Access Bypass
6170| [6882] Apache mod_python Malformed Query String Variant DoS
6171| [6839] Apache HTTP Server mod_proxy Content-Length Overflow
6172| [6630] Apache Tomcat Java Server Pages (JSP) Engine WPrinterJob() DoS
6173| [6472] Apache HTTP Server mod_ssl ssl_util_uuencode_binary Remote Overflow
6174| [5821] Apache HTTP Server Multiple / GET Remote Overflow DoS
6175| [5580] Apache Tomcat Servlet Malformed URL JSP Source Disclosure
6176| [5552] Apache HTTP Server split-logfile Arbitrary .log File Overwrite
6177| [5526] Apache Tomcat Long .JSP URI Path Disclosure
6178| [5278] Apache Tomcat web.xml Restriction Bypass
6179| [5051] Apache Tomcat Null Character DoS
6180| [4973] Apache Tomcat servlet Mapping XSS
6181| [4650] mod_gzip for Apache HTTP Server Debug Mode Printf Stack Overflow
6182| [4649] mod_gzip for Apache HTTP Server Debug Mode Format String Overflow
6183| [4648] mod_gzip for Apache HTTP Server Debug Mode Race Condition
6184| [4568] mod_survey For Apache ENV Tags SQL Injection
6185| [4553] Apache HTTP Server ApacheBench Overflow DoS
6186| [4552] Apache HTTP Server Shared Memory Scoreboard DoS
6187| [4446] Apache HTTP Server mod_disk_cache Stores Credentials
6188| [4383] Apache HTTP Server Socket Race Condition DoS
6189| [4382] Apache HTTP Server Log Entry Terminal Escape Sequence Injection
6190| [4340] Apache Portable Runtime (APR) apr_psprintf DoS
6191| [4232] Apache Cocoon DatabaseAuthenticatorAction SQL Injection
6192| [4231] Apache Cocoon Error Page Server Path Disclosure
6193| [4182] Apache HTTP Server mod_ssl Plain HTTP Request DoS
6194| [4181] Apache HTTP Server mod_access IP Address Netmask Rule Bypass
6195| [4075] Apache HTTP Sever on Windows .var File Request Path Disclosure
6196| [4037] Apache HTTP Server on Cygwin Encoded GET Request Arbitrary File Access
6197| [3877] Apache-SSL SSLVerifyClient SSLFakeBasicAuth Client Certificate Forgery
6198| [3819] Apache HTTP Server mod_digest Cross Realm Credential Replay
6199| [3322] mod_php for Apache HTTP Server Process Hijack
6200| [3215] mod_php for Apache HTTP Server File Descriptor Leakage
6201| [2885] Apache mod_python Malformed Query String DoS
6202| [2749] Apache Cocoon view-source Sample File Traversal Arbitrary File Access
6203| [2733] Apache HTTP Server mod_rewrite Local Overflow
6204| [2672] Apache HTTP Server mod_ssl SSLCipherSuite Ciphersuite Downgrade Weakness
6205| [2613] Apache HTTP Server mod_cgi stderr Output Handling Local DoS
6206| [2149] Apache::Gallery Privilege Escalation
6207| [2107] Apache HTTP Server mod_ssl Host: Header XSS
6208| [1926] Apache HTTP Server mod_rewrite Crafted URI Rule Bypass
6209| [1833] Apache HTTP Server Multiple Slash GET Request DoS
6210| [1577] Apache HTTP Server mod_rewrite RewriteRule Expansion Arbitrary File Access
6211| [872] Apache Tomcat Multiple Default Accounts
6212| [862] Apache HTTP Server SSI Error Page XSS
6213| [859] Apache HTTP Server Win32 Crafted Traversal Arbitrary File Access
6214| [849] Apache Tomcat TroubleShooter Servlet Information Disclosure
6215| [845] Apache Tomcat MSDOS Device XSS
6216| [844] Apache Tomcat Java Servlet Error Page XSS
6217| [842] Apache HTTP Server mod_ssl ssl_compat_directive Function Overflow
6218| [838] Apache HTTP Server Chunked Encoding Remote Overflow
6219| [827] PHP4 for Apache on Windows php.exe Malformed Request Path Disclosure
6220| [775] Apache mod_python Module Importing Privilege Function Execution
6221| [769] Apache HTTP Server Win32 DOS Batch File Arbitrary Command Execution
6222| [756] Apache HTTP Server mod_ssl i2d_SSL_SESSION Function SSL Client Certificate Overflow
6223| [701] Apache HTTP Server Win32 ScriptAlias php.exe Arbitrary File Access
6224| [674] Apache Tomcat Nonexistent File Error Message Path Disclosure
6225| [637] Apache HTTP Server UserDir Directive Username Enumeration
6226| [623] mod_auth_pgsql for Apache HTTP Server User Name SQL Injection
6227| [582] Apache HTTP Server Multiviews Feature Arbitrary Directory Listing
6228| [562] Apache HTTP Server mod_info /server-info Information Disclosure
6229| [561] Apache Web Servers mod_status /server-status Information Disclosure
6230| [417] Apache HTTP Server on SuSE Linux /doc/packages Remote Information Disclosure
6231| [410] mod_perl for Apache HTTP Server /perl/ Directory Listing
6232| [404] Apache HTTP Server on SuSE Linux WebDAV PROPFIND Arbitrary Directory Listing
6233| [402] Apache HTTP Server on SuSE Linux cgi-bin-sdb Request Script Source Disclosure
6234| [379] Apache ASP module Apache::ASP source.asp Example File Arbitrary File Creation
6235| [377] Apache Tomcat Snoop Servlet Remote Information Disclosure
6236| [376] Apache Tomcat contextAdmin Arbitrary File Access
6237| [342] Apache HTTP Server for Windows Multiple Forward Slash Directory Listing
6238| [222] Apache HTTP Server test-cgi Arbitrary File Access
6239| [143] Apache HTTP Server printenv.pl Multiple Method CGI XSS
6240| [48] Apache HTTP Server on Debian /usr/doc Directory Information Disclosure
6241|_
6242Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
6243Device type: general purpose
6244Running (JUST GUESSING): OpenBSD 4.X (86%)
6245OS CPE: cpe:/o:openbsd:openbsd:4.8
6246Aggressive OS guesses: OpenBSD 4.8 (86%)
6247No exact OS matches for host (test conditions non-ideal).
6248Network Distance: 18 hops
6249
6250TRACEROUTE (using port 80/tcp)
6251HOP RTT ADDRESS
62521 191.38 ms 10.244.200.1
62532 192.48 ms 213.184.122.97
62543 191.50 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
62554 191.79 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
62565 254.61 ms bzq-114-65-1.cust.bezeqint.net (192.114.65.1)
62576 244.79 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
62587 244.60 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
62598 247.21 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
62609 334.05 ms 202.232.1.113
626110 384.92 ms sjc002bb13.IIJ.Net (206.132.168.102)
626211 377.30 ms sjc002bb13.IIJ.Net (58.138.80.134)
626312 481.59 ms tky001bb10.IIJ.Net (58.138.88.89)
626413 ... 17
626518 480.08 ms 150.60.195.62
6266####################################################################################################################################
6267http://150.60.195.62 [302 Found] Apache, Country[JAPAN][JP], HTTPServer[Apache], IP[150.60.195.62], RedirectLocation[https://150.60.195.62/], Title[302 Found]
6268https://150.60.195.62/ [200 OK] Apache, Country[JAPAN][JP], Frame, HTML5, HTTPServer[Apache], IP[150.60.195.62], JQuery[2.1.3], MetaGenerator[WordPress 5.2.2], PHP[7.1.23], Script[text/javascript], Title[株式会社ライフサポート・エガワ], UncommonHeaders[link], WordPress[5.2.2], X-Powered-By[PHP/7.1.23]
6269#######################################################################################################################################
6270HTTP/1.1 302 Found
6271Date: Sun, 04 Aug 2019 03:32:34 GMT
6272Server: Apache
6273Location: https://150.60.195.62/
6274Vary: Accept-Encoding
6275Connection: close
6276Content-Type: text/html; charset=iso-8859-1
6277
6278HTTP/1.1 302 Found
6279Date: Sun, 04 Aug 2019 03:32:35 GMT
6280Server: Apache
6281Location: https://150.60.195.62/
6282Vary: Accept-Encoding
6283Connection: close
6284Content-Type: text/html; charset=iso-8859-1
6285#######################################################################################################################################
6286Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:32 EDT
6287Nmap scan report for 150.60.195.62
6288Host is up.
6289
6290PORT STATE SERVICE VERSION
6291123/udp open|filtered ntp
6292Too many fingerprints match this host to give specific OS details
6293
6294TRACEROUTE (using proto 1/icmp)
6295HOP RTT ADDRESS
62961 184.30 ms 10.244.200.1
62972 186.11 ms 213.184.122.97
62983 184.51 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
62994 184.92 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
63005 238.42 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
63016 238.06 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
63027 322.46 ms et-0-0-61.cr3-was1.ip4.gtt.net (89.149.142.254)
63038 324.48 ms 202.232.1.113
63049 383.94 ms sjc002bb12.IIJ.Net (58.138.81.226)
630510 484.34 ms tky001bb11.IIJ.Net (58.138.88.85)
630611 507.35 ms tky001ip57.IIJ.Net (58.138.100.22)
630712 485.74 ms 202.232.9.94
630813 ... 30
6309#######################################################################################################################################
6310Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:35 EDT
6311Nmap scan report for 150.60.195.62
6312Host is up (0.44s latency).
6313
6314PORT STATE SERVICE VERSION
6315443/tcp open ssl/http Apache httpd (PHP 7.1.23)
6316|_http-server-header: Apache
6317| vulscan: VulDB - https://vuldb.com:
6318| [135270] Apache JSPWiki up to 2.11.0.M3 Plugin Link cross site scripting
6319| [135269] Apache JSPWiki up to 2.11.0.M3 InterWiki Link cross site scripting
6320| [135268] Apache JSPWiki up to 2.11.0.M3 Attachment cross site scripting
6321| [134527] Apache Karaf up to 4.2.4 Config Service directory traversal
6322| [134416] Apache Sanselan 0.97-incubator Loop denial of service
6323| [134415] Apache Sanselan 0.97-incubator Hang denial of service
6324| [134291] Apache Axis up to 1.7.8 Server-Side Request Forgery
6325| [134290] Apache UIMA DUCC up to 2.2.2 cross site scripting
6326| [134248] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
6327| [134247] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
6328| [134246] Apache Camel up to 2.19/2.21.3/2.22.2/2.23.0 directory traversal
6329| [134138] Apache Pluto 3.0.0/3.0.1 Chat Room Demo Portlet cross site scripting
6330| [133992] Apache Qpid Proton up to 0.27.0 Certificate Validation Man-in-the-Middle weak authentication
6331| [133977] Apache Zeppelin up to 0.7.x Stored cross site scripting
6332| [133976] Apache Zeppelin up to 0.7.x Cron Scheduler privilege escalation
6333| [133975] Apache Zeppelin up to 0.7.2 Session Fixation weak authentication
6334| [133444] Apache PDFbox 2.0.14 XML Parser XML External Entity
6335| [133750] Oracle Agile Recipe Management for Pharmaceuticals 9.3.3/9.3.4 Apache Commons FileUpload unknown vulnerability
6336| [133728] Oracle Retail Xstore Point of Service 7.0/7.1 Apache HTTP Server denial of service
6337| [133644] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
6338| [133643] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache HTTP Server denial of service
6339| [133640] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Commons FileUpload unknown vulnerability
6340| [133638] Oracle Healthcare Master Person Index 3.0/4.0 Apache Commons FileUpload unknown vulnerability
6341| [133614] Oracle Data Integrator 12.2.1.3.0 Apache Batik unknown vulnerability
6342| [133594] Oracle WebCenter Portal 12.2.1.3.0 Apache Commons FileUpload unknown vulnerability
6343| [133591] Oracle JDeveloper 11.1.1.9.0/12.1.3.0.0/12.2.1.3.0 Apache Log4j unknown vulnerability
6344| [133590] Oracle Identity Analytics 11.1.1.5.8 Apache Commons FileUpload unknown vulnerability
6345| [133588] Oracle Endeca Information Discovery Integrator 3.2.0 Apache Commons FileUpload unknown vulnerability
6346| [133587] Oracle Data Integrator 11.1.1.9.0 Apache Groovy unknown vulnerability
6347| [133585] Oracle API Gateway 11.1.2.4.0 Apache Commons FileUpload unknown vulnerability
6348| [133573] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache ActiveMQ unknown vulnerability
6349| [133571] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache Commons FileUpload unknown vulnerability
6350| [133522] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache Tomcat unknown vulnerability
6351| [133520] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache HTTP Server denial of service
6352| [133518] Oracle Primavera Unifier up to 18.8 Apache Commons FileUpload unknown vulnerability
6353| [133508] Oracle Communications Instant Messaging Server 10.0.1 Apache Tomcat unknown vulnerability
6354| [133501] Oracle Communications Policy Management 12.1/12.2/12.3/12.4 Apache Struts 1 unknown vulnerability
6355| [133500] Oracle Communications Application Session Controller 3.7.1/3.8.0 Apache Tomcat unknown vulnerability
6356| [133493] Oracle Communications Pricing Design Center 11.1/12.0 Apache Log4j unknown vulnerability
6357| [133407] Apache Tomcat up to 7.0.93/8.5.39/9.0.17 on Windows JRE Command Line Argument Code Execution
6358| [133315] Apache Airflow up to 1.10.2 HTTP Endpoint cross site request forgery
6359| [133314] Apache Airflow up to 1.10.2 Metadata Database cross site scripting
6360| [133290] Apache Tomcat up to 8.5.37/9.0.14 HTTP2 Stream Execution denial of service
6361| [133112] Apache HTTP Server up to 2.4.38 mod_auth_digest race condition privilege escalation
6362| [133111] Apache HTTP Server 2.4.37/2.4.38 mod_ssl Bypass privilege escalation
6363| [133092] Airsonic 10.2.1 org.apache.commons.lang.RandomStringUtils RecoverController.java java.util.Random weak authentication
6364| [132568] Apache JSPWiki up to 2.11.0.M2 URL User information disclosure
6365| [132567] Apache JSPWiki up to 2.11.0.M2 URL cross site scripting
6366| [132566] Apache ActiveMQ up to 5.15.8 MQTT Frame Memory denial of service
6367| [132565] Apache HBase up to 2.1.3 REST Server Request privilege escalation
6368| [132183] Apache Mesos up to pre-1.4.x Docker Image Code Execution
6369| [131988] Apache Karaf up to 4.2.2 kar Deployer directory traversal
6370| [131859] Apache Hadoop up to 2.9.1 privilege escalation
6371| [131479] Apache Solr up to 7.6 HTTP GET Request Server-Side Request Forgery
6372| [131446] Apache Solr up to 5.0.5/6.6.5 Config API HTTP POST Request Code Execution
6373| [131385] Apache Qpid Broker-J up to 6.x/7.0.6/7.1.0 AMQP Command Crash denial of service
6374| [131315] Apache Mesos up to pre-1.4.x Mesos Masters Rendering JSON Payload Recursion denial of service
6375| [131236] Apache Airflow up to 1.10.1 Metadata Database cross site scripting
6376| [130755] Apache JSPWiki up to 2.10.5 URL cross site scripting
6377| [130629] Apache Guacamole Cookie Flag weak encryption
6378| [130628] Apache Hadoop up to 3.0.0 HDFS information disclosure
6379| [130529] Apache Subversion 1.10.0/1.10.1/1.10.2/1.10.3/1.11.0 mod_dav_svn Directory Crash denial of service
6380| [130353] Apache Open Office up to 4.1.5 Document Loader String memory corruption
6381| [130341] Apache HTTP Server 2.4.37 mod_ssl Loop denial of service
6382| [130330] Apache HTTP Server up to 2.4.37 mod_session Expired privilege escalation
6383| [130329] Apache HTTP Server 2.4.37 mod_http2 Slowloris denial of service
6384| [130212] Apache Airflow up to 1.10.0 LDAP Auth Backend Certificate weak authentication
6385| [130123] Apache Airflow up to 1.8.2 information disclosure
6386| [130122] Apache Airflow up to 1.8.2 command injection cross site request forgery
6387| [130121] Apache Airflow up to 1.8.2 Webserver Object Code Execution
6388| [129717] Oracle Secure Global Desktop 5.4 Apache HTTP Server denial of service
6389| [129688] Oracle Tape Library ACSLS 8.4 Apache Log4j unknown vulnerability
6390| [129673] Oracle Retail Returns Management 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
6391| [129672] Oracle Retail Central Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
6392| [129671] Oracle Retail Back Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
6393| [129574] Oracle Outside In Technology 8.5.3/8.5.4 Apache Tomcat denial of service
6394| [129573] Oracle WebLogic Server 10.3.6.0 Apache HTTP Server denial of service
6395| [129563] Oracle Enterprise Repository 12.1.3.0.0 Apache Log4j unknown vulnerability
6396| [129555] Oracle Outside In Technology 8.5.3 Apache Batik denial of service
6397| [129551] Oracle Outside In Technology 8.5.3/8.5.4 Apache Commons FileUpload denial of service
6398| [129542] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
6399| [129538] Oracle SOA Suite 12.1.3.0.0/12.2.1.3.0 Apache Batik unknown vulnerability
6400| [129519] Oracle Enterprise Manager Ops Center 12.2.2/12.3.3 Apache ActiveMQ unknown vulnerability
6401| [129508] Oracle Applications Manager up to 12.2.8 Apache Derby unknown vulnerability
6402| [129507] Oracle Mobile Field Service up to 12.2.8 Apache Log4j unknown vulnerability
6403| [129505] Oracle Email Center up to 12.2.8 Apache Log4j unknown vulnerability
6404| [129504] Oracle CRM Technical Foundation up to 12.2.8 Apache Commons FileUpload unknown vulnerability
6405| [129499] Oracle Partner Management up to 12.2.8 Apache Log4j unknown vulnerability
6406| [129498] Oracle Marketing up to 12.2.8 Apache Commons FileUpload unknown vulnerability
6407| [129480] Oracle Communications WebRTC Session Controller up to 7.1 Apache Batik unknown vulnerability
6408| [129479] Oracle Communications Diameter Signaling Router up to 8.2 Apache Batik unknown vulnerability
6409| [129474] Oracle Communications Diameter Signaling Router up to 8.2 Apache HTTP Server information disclosure
6410| [129472] Oracle Communications WebRTC Session Controller up to 7.1 Apache Struts 1 unknown vulnerability
6411| [129470] Oracle Communications Converged Application Server up to 7.0.0.0 Apache Struts 1 unknown vulnerability
6412| [129463] Oracle Communications WebRTC Session Controller up to 7.1 Apache Log4j unknown vulnerability
6413| [129461] Oracle Communications Services Gatekeeper up to 6.1.0.3.x Apache Commons Collections Fileupload unknown vulnerability
6414| [129460] Oracle Communications Service Broker 6.0 Apache Log4j unknown vulnerability
6415| [129459] Oracle Communications Policy Management up to 12.4 Apache Struts 2 unknown vulnerability
6416| [129458] Oracle Communications Online Mediation Controller 6.1 Apache Log4j unknown vulnerability
6417| [129457] Oracle Communications Diameter Signaling Router up to 8.2 Apache Commons Fileupload unknown vulnerability
6418| [129456] Oracle Communications Converged Application Server 6.1 Apache Log4j unknown vulnerability
6419| [128714] Apache Thrift Java Client Library up to 0.11.0 SASL Negotiation org.apache.thrift.transport.TSaslTransport unknown vulnerability
6420| [128713] Apache Thrift Node.js Static Web Server up to 0.11.0 directory traversal
6421| [128709] Apache Karaf up to 4.1.6/4.2.1 Features Deployer XMLInputFactory XML External Entity
6422| [128575] Apache NetBeans 9.0 Proxy Auto-Config Code Execution
6423| [128369] Apache Tika 1.8-1.19.1 SQLite3Parser Loop sql injection
6424| [128111] Apache NiFi 1.8.0 Template Upload Man-in-the-Middle cross site request forgery
6425| [128110] Apache NiFi 1.8.0 Cluster Request privilege escalation
6426| [128109] Apache NiFi 1.8.0 Error Page message-page.jsp Request Header cross site scripting
6427| [128108] Apache NiFi up to 1.7.x X-Frame-Options Header privilege escalation
6428| [128102] Apache Oozie up to 5.0.0 Workflow XML Impersonation spoofing
6429| [127994] WordPress up to 5.0.0 on Apache httpd MIME Restriction cross site scripting
6430| [127981] Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04 HTTP Engine httpService GET Request privilege escalation
6431| [127161] Apache Hadoop 2.7.4/2.7.5/2.7.6 Incomplete Fix CVE-2016-6811 privilege escalation
6432| [127040] Loadbalancer.org Enterprise VA MAX up to 8.3.2 Apache HTTP Server Log cross site scripting
6433| [127007] Apache Spark Request Code Execution
6434| [126791] Apache Hadoop up to 0.23.11/2.7.6/2.8.4/2.9.1/3.0.2 ZIP File unknown vulnerability
6435| [126767] Apache Qpid Proton-J Transport 0.3 Certificate Verification Man-in-the-Middle weak authentication
6436| [126896] Apache Commons FileUpload 1.3.3 on LDAP Manager DiskFileItem File privilege escalation
6437| [126574] Apache Hive up to 2.3.3/3.1.0 Query privilege escalation
6438| [126573] Apache Hive up to 2.3.3/3.1.0 HiveServer2 privilege escalation
6439| [126564] Apache Superset up to 0.22 Pickle Library load Code Execution
6440| [126488] Apache Syncope up to 2.0.10/2.1.1 BPMN Definition xxe privilege escalation
6441| [126487] Apache Syncope up to 2.0.10/2.1.1 cross site scripting
6442| [126346] Apache Tomcat Path privilege escalation
6443| [125922] Apache Impala up to 3.0.0 ALTER privilege escalation
6444| [125921] Apache Impala up to 3.0.0 Queue Injection privilege escalation
6445| [125647] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Install (Apache Tomcat) information disclosure
6446| [125617] Oracle Retail Returns Management 14.1 Apache Batik unknown vulnerability
6447| [125616] Oracle Retail Point-of-Service 13.4/14.0/14.1 Apache Batik unknown vulnerability
6448| [125614] Oracle Retail Central Office 14.1 Apache Batik unknown vulnerability
6449| [125613] Oracle Retail Back Office 13.3/13.4/14/14.1 Apache Batik unknown vulnerability
6450| [125599] Oracle Retail Open Commerce Platform 5.3.0/6.0.0/6.0.1 Apache Log4j unknown vulnerability
6451| [125569] Oracle PeopleSoft Enterprise PeopleTools 8.55/8.56 Apache HTTP Server information disclosure
6452| [125494] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat information disclosure
6453| [125447] Oracle Business Intelligence Enterprise Edition 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Batik unknown vulnerability
6454| [125428] Oracle Identity Management Suite 11.1.2.3.0/12.2.1.3.0 Apache Log4j unknown vulnerability
6455| [125427] Oracle Identity Analytics 11.1.1.5.8 Apache Log4j unknown vulnerability
6456| [125424] Oracle API Gateway 11.1.2.4.0 Apache Log4j unknown vulnerability
6457| [125423] Oracle BI Publisher 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Log4j unknown vulnerability
6458| [125383] Oracle up to 10.2.0 Apache Trinidad unknown vulnerability
6459| [125379] Oracle up to 10.1.x Apache Struts 1 cross site scripting
6460| [125377] Oracle up to 10.2.0 Apache Commons Collections unknown vulnerability
6461| [125376] Oracle Communications Application Session Controller up to 3.7.0 Apache Commons Collections unknown vulnerability
6462| [125375] Oracle Communications User Data Repository up to 12.1.x Apache Xerces memory corruption
6463| [125248] Apache ActiveMQ up to 5.15.5 Web-based Administration Console queue.jsp Parameter cross site scripting
6464| [125133] Apache Tika up to 1.19 XML Parser reset() denial of service
6465| [124877] Apache PDFbox up to 2.0.11 PDF File denial of service
6466| [124876] Apache Ranger up to 1.1.x UnixAuthenticationService Stack-based memory corruption
6467| [124791] Apache Tomcat up to 7.0.90/8.5.33/9.0.11 URL Open Redirect
6468| [124787] Apache Pony Mail 0.7/0.8/0.9 Statistics Generator Timestamp Data information disclosure
6469| [124447] Apache HTTP Server up to 2.4.34 SETTINGS Frame denial of service
6470| [124346] Apache Mesos pre-1.4.2/1.5.0/1.5.1/1.6.0 on Executor HTTP API String Comparison validation JSON Web Token information disclosure
6471| [124286] Apache Tika up to 1.18 IptcAnpaParser Loop denial of service
6472| [124242] Apache Tika up to 0.18 C:/evil.bat" Directory unknown vulnerability
6473| [124241] Apache Tika up to 0.18 XML Parser Entity Expansion denial of service
6474| [124191] Apache Karaf up to 3.0.8/4.0.8/4.1.0 WebConsole .../gogo/ weak authentication
6475| [124190] Apache Karaf up to 4.1.x sshd privilege escalation
6476| [124152] Apache Camel Mail up to 2.22.0 Path directory traversal
6477| [124143] Apache SpamAssassin up to 3.4.1 PDFInfo Plugin Code Execution
6478| [124134] Apache SpamAssassin up to 3.4.1 Scan Engine HTML::Parser Email denial of service
6479| [124095] PHP up to 5.6.37/7.0.31/7.1.21/7.2.9 Apache2 sapi_apache2.c php_handler cross site scripting
6480| [124024] Apache Mesos 1.4.x/1.5.0 libprocess JSON Payload denial of service
6481| [123814] Apache ActiveMQ Client up to 5.15.5 TLS Hostname Verification Man-in-the-Middle weak authentication
6482| [123393] Apache Traffic Server up to 6.2.2/7.1.3 ESI Plugin Config privilege escalation
6483| [123392] Apache Traffic Server 6.2.2 TLS Handshake Segmentation Fault denial of service
6484| [123391] Apache Traffic Server up to 6.2.2/7.1.3 Range Request Performance denial of service
6485| [123390] Apache Traffic Server up to 6.2.2/7.1.3 Request HTTP Smuggling privilege escalation
6486| [123369] Apache Traffic Server up to 6.2.2/7.1.3 ACL remap.config Request denial of service
6487| [123197] Apache Sentry up to 2.0.0 privilege escalation
6488| [123145] Apache Struts up to 2.3.34/2.5.16 Namespace Code Execution
6489| [123144] Apache Cayenne up to 4.1.M1 CayenneModeler XML File File Transfer privilege escalation
6490| [122981] Apache Commons Compress 1.7 ZipArchiveInputStream ZIP Archive denial of service
6491| [122889] Apache HTTP Server up to 2.2.31/2.4.23 mod_userdir HTTP Response Splitting privilege escalation
6492| [122800] Apache Spark 1.3.0 REST API weak authentication
6493| [122642] Apache Airflow up to 1.8.x 404 Page Reflected cross site scripting
6494| [122568] Apache Tomcat up to 8.5.31/9.0.9 Connection Reuse weak authentication
6495| [122567] Apache Axis 1.0./1.1/1.2/1.3/1.4 cross site scripting
6496| [122556] Apache Tomcat up to 7.0.86/8.0.51/8.5.30/9.0.7 UTF-8 Decoder Loop denial of service
6497| [122531] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.9 WebSocket Client unknown vulnerability
6498| [122456] Apache Camel up to 2.20.3/2.21.0 XSD Validator XML External Entity
6499| [122455] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Revoked Certificate weak authentication
6500| [122454] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Responder Revoked Certificate weak authentication
6501| [122214] Apache Kafka up to 0.9.0.1/0.10.2.1/0.11.0.2/1.0.0 Broker Request Data Loss denial of service
6502| [122202] Apache Kafka up to 0.10.2.1/0.11.0.1 SASL Impersonation spoofing
6503| [122101] Docker Skeleton Runtime for Apache OpenWhisk Docker Action dockerskeleton:1.3.0 privilege escalation
6504| [122100] PHP Runtime for Apache OpenWhisk Docker Action action-php-v7.2:1.0.0 privilege escalation
6505| [122012] Apache Ignite up to 2.5 Serialization privilege escalation
6506| [121911] Apache Ambari up to 2.5.x/2.6.2 Log Message Credentials information disclosure
6507| [121910] Apache HTTP Server 2.4.33 mod_md HTTP Requests denial of service
6508| [121854] Oracle Tape Library ACSLS up to ACSLS 8.4.0-2 Apache Commons Collections unknown vulnerability
6509| [121752] Oracle Insurance Policy Administration 10.0/10.1/10.2/11.0 Apache Log4j unknown vulnerability
6510| [121370] Apache Spark up to 2.1.2/2.2.1/2.3.0 URL cross site scripting
6511| [121354] Apache CouchDB HTTP API Code Execution
6512| [121144] Apache LDAP API up to 1.0.1 SSL Filter information disclosure
6513| [121143] Apache storm up to 0.10.2/1.0.6/1.1.2/1.2.1 Cluster privilege escalation
6514| [120436] Apache CXF Fediz up to 1.4.3 Application Plugin unknown vulnerability
6515| [120310] Apache PDFbox up to 1.8.14/2.0.10 AFMParser Loop denial of service
6516| [120168] Apache CXF weak authentication
6517| [120080] Apache Cassandra up to 3.11.1 JMX/RMI Interface RMI Request privilege escalation
6518| [120043] Apache HBase up to 1.2.6.0/1.3.2.0/1.4.4/2.0.0 Thrift 1 API Server weak authentication
6519| [119723] Apache Qpid Broker-J 7.0.0/7.0.1/7.0.2/7.0.3/7.0.4 AMQP Messages Crash denial of service
6520| [122569] Apache HTTP Server up to 2.4.33 HTTP2 Request denial of service
6521| [119486] Apache Geode up to 1.4.0 Security Manager Code Execution
6522| [119306] Apache MXNet Network Interface privilege escalation
6523| [118999] Apache Storm up to 1.0.6/1.1.2/1.2.1 Archive directory traversal
6524| [118996] Apache Storm up to 1.0.6/1.1.2/1.2.1 Daemon spoofing
6525| [118644] Apple macOS up to 10.13.5 apache_mod_php unknown vulnerability
6526| [118200] Apache Batik up to 1.9 Deserialization unknown vulnerability
6527| [118143] Apache NiFi activemq-client Library Deserialization denial of service
6528| [118142] Apache NiFi 1.6.0 SplitXML xxe privilege escalation
6529| [118051] Apache Zookeeper up to 3.4.9/3.5.3-beta weak authentication
6530| [117997] Apache ORC up to 1.4.3 ORC File Recursion denial of service
6531| [117825] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.8 CORS Filter privilege escalation
6532| [117405] Apache Derby up to 10.14.1.0 Network Server Network Packet privilege escalation
6533| [117347] Apache Ambari up to 2.6.1 HTTP Request directory traversal
6534| [117265] LibreOffice/Apache Office Writer SMB Connection XML Document information disclosure
6535| [117143] Apache uimaj/uima-as/uimaFIT/uimaDUCC XML XXE information disclosure
6536| [117117] Apache Tika up to 1.17 ChmParser Loop denial of service
6537| [117116] Apache Tika up to 1.17 BPGParser Loop denial of service
6538| [117115] Apache Tika up to 1.17 tika-server command injection
6539| [116929] Apache Fineract getReportType Parameter privilege escalation
6540| [116928] Apache Fineract REST Endpoint Parameter privilege escalation
6541| [116927] Apache Fineract MakercheckersApiResource Parameter sql injection
6542| [116926] Apache Fineract REST Hand Parameter privilege escalation
6543| [116574] Apache wicket-jquery-ui up to 6.29.0/7.10.1/8.0.0-M9.1 WYSIWYG Editor privilege escalation
6544| [116622] Oracle Enterprise Manager for MySQL Database 12.1.0.4 EM Plugin: General (Apache Tomcat) unknown vulnerability
6545| [115931] Apache Solr up to 6.6.2/7.2.1 XML Data Parameter XML External Entity
6546| [115883] Apache Hive up to 2.3.2 privilege escalation
6547| [115882] Apache Hive up to 2.3.2 xpath_short information disclosure
6548| [115881] Apache DriverHive JDBC Driver up to 2.3.2 Escape Argument Bypass privilege escalation
6549| [115518] Apache Ignite 2.3 Deserialization privilege escalation
6550| [115260] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache cross site scripting
6551| [115259] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache Cookie Stack-based memory corruption
6552| [115500] CA Workload Control Center up to r11.4 SP5 Apache MyFaces Component Code Execution
6553| [115121] Apache Struts REST Plugin up to 2.5.15 Xstream XML Data denial of service
6554| [115061] Apache HTTP Server up to 2.4.29 HTTP Digest Authentication Challenge HTTP Requests Replay privilege escalation
6555| [115060] Apache HTTP Server up to 2.4.29 mod_cache_socache Request Header Crash denial of service
6556| [115059] Apache HTTP Server up to 2.4.29 HTTP2 NULL Pointer Dereference denial of service
6557| [115058] Apache HTTP Server up to 2.4.29 HTTP Header Crash denial of service
6558| [115057] Apache HTTP Server up to 2.4.29 mod_session Variable Name Cache privilege escalation
6559| [115039] Apache HTTP Server up to 2.4.29 FilesMatch File Upload privilege escalation
6560| [115038] Apache HTTP Server up to 2.0.65/2.2.34/2.4.29 mod_authnz_ldap Crash denial of service
6561| [114817] Apache Syncope up to 1.2.10/2.0.7 Search Parameter information disclosure
6562| [114816] Apache Syncope up to 1.2.10/2.0.7 XSLT Code Execution
6563| [114717] Apache Commons 1.11/1.12/1.13/1.14/1.15 ZIP Archive ZipFile/ZipArchiveInputStream denial of service
6564| [114661] Apache Allura up to 1.8.0 HTTP Response Splitting privilege escalation
6565| [114400] Apache Tomcat JK ISAPI Connector up to 1.2.42 IIS/ISAPI privilege escalation
6566| [114258] Apache HTTP Server up to 2.4.22 mod_cluster Segmentation Fault denial of service
6567| [114086] Apache ODE 1.3.3 ODE Process Deployment Web Service directory traversal
6568| [113955] Apache Xerces-C up to 3.2.0 XML Parser NULL Pointer Dereference denial of service
6569| [113945] Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4 URL Pattern Empty String privilege escalation
6570| [113944] Apache OpenMeetings up to 3.x/4.0.1 CRUD Operation denial of service
6571| [113905] Apache Traffic Server up to 5.2.x/5.3.2/6.2.0/7.0.0 TLS Handshake Core Dump denial of service
6572| [113904] Apache Traffic Server up to 6.2.0 Host Header privilege escalation
6573| [113895] Apache Geode up to 1.3.x Code Execution
6574| [113894] Apache Geode up to 1.3.x TcpServer Code Execution
6575| [113888] Apache James Hupa WebMail 0.0.2 cross site scripting
6576| [113813] Apache Geode Cluster up to 1.3.x Secure Mode privilege escalation
6577| [113747] Apache Tomcat Servlets privilege escalation
6578| [113647] Apache Qpid up to 0.30 qpidd Broker AMQP Message Crash denial of service
6579| [113645] Apache VCL up to 2.1/2.2.1/2.3.1 Web GUI/XMLRPC API privilege escalation
6580| [113560] Apache jUDDI Console 3.0.0 Log Entries spoofing
6581| [113571] Apache Oozie up to 4.3.0/5.0.0-beta1 XML Data XML File privilege escalation
6582| [113569] Apache Karaf up to 4.0.7 LDAPLoginModule LDAP injection denial of service
6583| [113273] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
6584| [113198] Apache Qpid Dispatch Router 0.7.0/0.8.0 AMQP denial of service
6585| [113186] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
6586| [113145] Apache Thrift up to 0.9.3 Go Client Library privilege escalation
6587| [113106] Apache jUDDI up to 3.3.3 XML Data WADL2Java/WSDL2Java XML Document privilege escalation
6588| [113105] Apache Qpid Broker-J 7.0.0 AMQP Crash denial of service
6589| [112885] Apache Allura up to 1.8.0 File information disclosure
6590| [112856] Apache CloudStack up to 4.8.1.0/4.9.0.0 API weak authentication
6591| [112855] Apache CloudStack 4.1.0/4.1.1 API information disclosure
6592| [112678] Apache Tomcat up to 7.0.82/8.0.47/8.5.23/9.0.1 Bug Fix 61201 privilege escalation
6593| [112677] Apache Tomcat Native Connector up to 1.1.34/1.2.14 OCSP Checker Client weak authentication
6594| [112625] Apache POI up to 3.16 Loop denial of service
6595| [112448] Apache NiFi up to 1.3.x Deserialization privilege escalation
6596| [112396] Apache Hadoop 2.7.3/2.7.4 YARN NodeManager Credentials information disclosure
6597| [112339] Apache NiFi 1.5.0 Header privilege escalation
6598| [112330] Apache NiFi 1.5.0 Header HTTP Request privilege escalation
6599| [112314] NetGain Enterprise Manager 7.2.730 Build 1034 org.apache.jsp.u.jsp.tools.exec_jsp Servlet Parameter privilege escalation
6600| [112253] Apache Hadoop up to 0.23.x/2.7.4/2.8.2 MapReduce Job History Server Configuration File privilege escalation
6601| [112171] Oracle Secure Global Desktop 5.3 Apache Log4j privilege escalation
6602| [112164] Oracle Agile PLM 9.3.5/9.3.6 Apache Tomcat unknown vulnerability
6603| [112161] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Tomcat privilege escalation
6604| [112158] Oracle Autovue for Agile Product Lifecycle Management 21.0.0/21.0.1 Apache Log4j privilege escalation
6605| [112156] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Log4j privilege escalation
6606| [112155] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Apache Log4j privilege escalation
6607| [112137] Oracle MICROS Relate CRM Software 10.8.x/11.4.x/15.0.x, Apache Tomcat unknown vulnerability
6608| [112136] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat privilege escalation
6609| [112133] Oracle Retail Workforce Management 1.60.7/1.64.0 Apache Log4j privilege escalation
6610| [112129] Oracle Retail Assortment Planning 14.1.3/15.0.3/16.0.1 Apache Log4j privilege escalation
6611| [112114] Oracle 9.1 Apache Log4j privilege escalation
6612| [112113] Oracle 9.1 Apache Log4j privilege escalation
6613| [112045] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat privilege escalation
6614| [112038] Oracle Health Sciences Empirica Inspections 1.0.1.1 Apache Tomcat information disclosure
6615| [112019] Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 Apache Tomcat privilege escalation
6616| [112017] Oracle WebCenter Portal 11.1.1.9.0/12.2.1.2.0/12.2.1.3.0 Apache Struts 1 cross site scripting
6617| [112011] Oracle Identity Manager 11.1.2.3.0 Apache Commons Collections privilege escalation
6618| [111950] Oracle Database 12.2.0.1 Apache Tomcat information disclosure
6619| [111703] Apache Sling XSS Protection API 1.0.4 URL Encoding cross site scripting
6620| [111556] Apache Geode up to 1.2.x Secure Mode Parameter OQL privilege escalation
6621| [111555] Apache Geode up to 1.2.x Secure Mode OQL privilege escalation
6622| [111540] Apache Geode up to 1.2.x Secure Mode information disclosure
6623| [111519] Apache Sling JCR ContentLoader 2.1.4 xmlreader directory traversal
6624| [111338] Apache DeltaSpike-JSF 1.8.0 cross site scripting
6625| [111330] Apache OFBiz 16.11.01/16.11.02/16.11.03 BIRT Plugin cross site scripting
6626| [110789] Apache Sling up to 1.4.0 Authentication Service Credentials information disclosure
6627| [110785] Apache Drill up to 1.11.0 Query Page unknown vulnerability
6628| [110701] Apache Fineract Query Parameter sql injection
6629| [110484] Apache Synapse up to 3.0.0 Apache Commons Collections Serialized Object Code Injection privilege escalation
6630| [110426] Adobe Experience Manager 6.0/6.1/6.2/6.3 Apache Sling Servlets Post cross site scripting
6631| [110393] Apple macOS up to 10.13.2 apache information disclosure
6632| [110141] Apache Struts up to 2.5.14 REST Plugin denial of service
6633| [110140] Apache Qpid Broker-J up to 0.32 privilege escalation
6634| [110139] Apache Qpid Broker-J up to 6.1.4 AMQP Frame denial of service
6635| [110106] Apache CXF Fediz Spring cross site request forgery
6636| [109766] Apache OpenOffice up to 4.1.3 DOC File Parser WW8Fonts memory corruption
6637| [109750] Apache OpenOffice up to 4.1.3 DOC File Parser ImportOldFormatStyles memory corruption
6638| [109749] Apache OpenOffice up to 4.1.3 PPT File Parser PPTStyleSheet memory corruption
6639| [109606] October CMS Build 412 Apache Configuration File Upload privilege escalation
6640| [109419] Apache Camel up to 2.19.3/2.20.0 camel-castor Java Object Deserialization privilege escalation
6641| [109418] Apache Camel up to 2.19.3/2.20.0 camel-hessian Java Object Deserialization privilege escalation
6642| [109400] Apache CouchDB up to 1.6.x/2.1.0 Database Server Shell privilege escalation
6643| [109399] Apache CouchDB up to 1.6.x/2.1.0 JSON Parser Shell privilege escalation
6644| [109398] Apache CXF 3.1.14/3.2.1 JAX-WS/JAX-RS Attachment denial of service
6645| [108872] Apache Hive up to 2.1.1/2.2.0/2.3.0 Policy Enforcement privilege escalation
6646| [108939] Apple macOS up to 10.13.1 apache unknown vulnerability
6647| [108938] Apple macOS up to 10.13.1 apache denial of service
6648| [108937] Apple macOS up to 10.13.1 apache unknown vulnerability
6649| [108936] Apple macOS up to 10.13.1 apache unknown vulnerability
6650| [108935] Apple macOS up to 10.13.1 apache denial of service
6651| [108934] Apple macOS up to 10.13.1 apache unknown vulnerability
6652| [108933] Apple macOS up to 10.13.1 apache unknown vulnerability
6653| [108932] Apple macOS up to 10.13.1 apache unknown vulnerability
6654| [108931] Apple macOS up to 10.13.1 apache denial of service
6655| [108930] Apple macOS up to 10.13.1 apache unknown vulnerability
6656| [108929] Apple macOS up to 10.13.1 apache denial of service
6657| [108928] Apple macOS up to 10.13.1 apache unknown vulnerability
6658| [108797] Apache Struts up to 2.3.19 TextParseUtiltranslateVariables OGNL Expression privilege escalation
6659| [108795] Apache Traffic Server up to 5.3.0 HTTP2 set_dynamic_table_size memory corruption
6660| [108794] Apache WSS4J up to 1.6.16/2.0.1 Incomplete Fix Leak information disclosure
6661| [108793] Apache Qpid up to 0.30 qpidd Crash denial of service
6662| [108792] Apache Traffic Server up to 5.1.0 Access Restriction privilege escalation
6663| [108791] Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2 Session information disclosure
6664| [108790] Apache storm 0.9.0.1 Log Viewer directory traversal
6665| [108789] Apache Cordova In-App-Browser Standalone Plugin up to 0.3.1 on iOS CDVInAppBrowser privilege escalation
6666| [108788] Apache Cordova File-Transfer Standalone Plugin up to 0.4.1 on iOS ios/CDVFileTransfer.m spoofing
6667| [108787] Apache HttpClient up to 4.3.0 HttpClientBuilder.java unknown vulnerability
6668| [108786] Apache Wicket up to 1.4.21/1.5.9/6.3.x script Tag cross site scripting
6669| [108783] Apache Hadoop up to 0.23.3/1.0.3/2.0.1 Kerberos Security Feature Key weak encryption
6670| [108782] Apache Xerces2 XML Service denial of service
6671| [108781] Apache jUDDI up to 1.x happyjuddi.jsp Parameter cross site scripting
6672| [108780] Apache jUDDI up to 1.x Log File uddiget.jsp spoofing
6673| [108709] Apache Cordova Android up to 3.7.1/4.0.1 intent URL privilege escalation
6674| [108708] Apache ActiveMQ up to 5.10.0 XML Data XML External Entity
6675| [108707] Apache ActiveMQ up to 1.7.0 XML Data XML External Entity
6676| [108629] Apache OFBiz up to 10.04.01 privilege escalation
6677| [108543] Apache Derby 10.1.2.1/10.2.2.0/10.3.1.4/10.4.1.3 Export File privilege escalation
6678| [108312] Apache HTTP Server on RHEL IP Address Filter privilege escalation
6679| [108297] Apache NiFi up to 0.7.1/1.1.1 Proxy Chain Username Deserialization privilege escalation
6680| [108296] Apache NiFi up to 0.7.1/1.1.1 Cluster Request privilege escalation
6681| [108250] Oracle Secure Global Desktop 5.3 Apache HTTP Server memory corruption
6682| [108245] Oracle Transportation Management up to 6.3.7 Apache Tomcat unknown vulnerability
6683| [108244] Oracle Transportation Management 6.4.1/6.4.2 Apache Commons FileUpload denial of service
6684| [108243] Oracle Agile Engineering Data Management 6.1.3/6.2.0 Apache Commons Collections memory corruption
6685| [108222] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Batik denial of service
6686| [108219] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat unknown vulnerability
6687| [108217] Oracle Retail Store Inventory Management 13.2.9/14.0.4/14.1.3/15.0.1/16.0.1 Apache Groovy unknown vulnerability
6688| [108216] Oracle Retail Convenience and Fuel POS Software 2.1.132 Apache Groovy unknown vulnerability
6689| [108169] Oracle MySQL Enterprise Monitor up to 3.2.8.2223/3.3.4.3247/3.4.2.4181 Apache Tomcat unknown vulnerability
6690| [108113] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Batik denial of service
6691| [108107] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
6692| [108102] Oracle Healthcare Master Person Index 4.x Apache Groovy unknown vulnerability
6693| [108085] Oracle Identity Manager 11.1.2.3.0 Apache Struts 1 memory corruption
6694| [108083] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
6695| [108080] Oracle GlassFish Server 3.1.2 Apache Commons FileUpload denial of service
6696| [108069] Oracle Endeca Information Discovery Integrator 2.4/3.0/3.1/3.2 Apache Commons Collections memory corruption
6697| [108067] Oracle Business Process Management Suite 11.1.1.9.0/12.2.1.1.0 Apache Commons Collections memory corruption
6698| [108066] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Tomcat memory corruption
6699| [108065] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Commons Collections memory corruption
6700| [108062] Oracle BI Publisher 11.1.1.7.0/12.2.1.1.0/12.2.1.2.0 Apache ActiveMQ memory corruption
6701| [108060] Oracle Enterprise Manager Ops Center 12.2.2/12.3.2 Apache Groovy unknown vulnerability
6702| [108033] Oracle Primavera Unifier 9.13/9.14/10.x/15.x/16.x, Apache Groovy unknown vulnerability
6703| [108024] Oracle Communications Order and Service Management 7.2.4.x.x/7.3.0.x.x/7.3.1.x.x/7.3.5.x.x Apache Commons Collections memory corruption
6704| [108015] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Commons Collections memory corruption
6705| [108013] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Groovy unknown vulnerability
6706| [108011] Oracle Communications Services Gatekeeper 5.1/6.0 Apache Trinidad unknown vulnerability
6707| [107904] Apache Struts up to 2.3.28 Double OGNL Evaluation privilege escalation
6708| [107860] Apache Solr up to 7.0 Apache Lucene RunExecutableListener XML External Entity
6709| [107834] Apache Ranger up to 0.6.1 Change Password privilege escalation
6710| [107639] Apache NiFi 1.4.0 XML External Entity
6711| [107606] Apache ZooKeper up to 3.4.9/3.5.2 Command CPU Exhaustion denial of service
6712| [107597] Apache Roller up to 5.0.2 XML-RPC Protocol Support XML External Entity
6713| [107429] Apache Impala up to 2.9.x Kudu Table privilege escalation
6714| [107411] Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0 JSP File File Upload privilege escalation
6715| [107385] Apache Geode up to 1.2.0 Secure Mode privilege escalation
6716| [107339] Apache OpenNLP up to 1.5.3/1.6.0/1.7.2/1.8.1 XML Data XML External Entity
6717| [107333] Apache Wicket up to 8.0.0-M1 CSRF Prevention HTTP Header privilege escalation
6718| [107323] Apache Wicket 1.5.10/6.13.0 Class Request information disclosure
6719| [107310] Apache Geode up to 1.2.0 Command Line Utility Query privilege escalation
6720| [107276] ArcSight ESM/ArcSight ESM Express up to 6.9.1c Patch 3/6.11.0 Apache Tomcat Version information disclosure
6721| [107266] Apache Tika up to 1.12 XML Parser XML External Entity
6722| [107262] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
6723| [107258] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
6724| [107197] Apache Xerces Jelly Parser XML File XML External Entity
6725| [107193] ZTE NR8950 Apache Commons Collections RMI Request Deserialization privilege escalation
6726| [107084] Apache Struts up to 2.3.19 cross site scripting
6727| [106877] Apache Struts up to 2.0.33/2.5.10 Freemarker Tag privilege escalation
6728| [106875] Apache Struts up to 2.5.5 URL Validator denial of service
6729| [106874] Apache Struts up to 2.3.30 Convention Plugin directory traversal
6730| [106847] Apache Tomcat up to 7.0.80 VirtualDirContext Source information disclosure
6731| [106846] Apache Tomcat up to 7.0.79 on Windows HTTP PUT Method Parameter File Upload privilege escalation
6732| [106777] Apache HTTP Server up to 2.2.34/2.4.27 Limit Directive ap_limit_section HTTP Request information disclosure
6733| [106739] puppetlabs-apache up to 1.11.0/2.0.x weak authentication
6734| [106720] Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4 CryptoMapper privilege escalation
6735| [106586] Apache Brooklyn up to 0.9.x REST Server cross site scripting
6736| [106562] Apache Spark up to 2.1.1 Launcher API Deserialization privilege escalation
6737| [106559] Apache Brooklyn up to 0.9.x SnakeYAML YAML Data Java privilege escalation
6738| [106558] Apache Brooklyn up to 0.9.x REST Server cross site request forgery
6739| [106556] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
6740| [106555] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
6741| [106171] Apache Directory LDAP API up to 1.0.0-M30 Timing unknown vulnerability
6742| [106167] Apache Struts up to 2.5.12 REST Plugin XML Data privilege escalation
6743| [106166] Apache Struts up to 2.3.33/2.5.12 REST Plugin denial of service
6744| [106165] Apache Struts up to 2.3.33/2.5.12 URLValidator Regex CPU Exhaustion denial of service
6745| [106115] Apache Hadoop up to 2.6.4/2.7.2 YARN NodeManager Password information disclosure
6746| [106012] Apache Solr up to 5.5.3/6.4.0 Replication directory traversal
6747| [105980] Apache Engine 16.11.01 Parameter Reflected unknown vulnerability
6748| [105962] Apache Atlas 0.6.0/0.7.0 Frame cross site scripting
6749| [105961] Apache Atlas 0.6.0/0.7.0 Stack Trace information disclosure
6750| [105960] Apache Atlas 0.6.0/0.7.0 Search Reflected cross site scripting
6751| [105959] Apache Atlas 0.6.0/0.7.0 edit Tag DOM cross site scripting
6752| [105958] Apache Atlas 0.6.0/0.7.0 edit Tag Stored cross site scripting
6753| [105957] Apache Atlas 0.6.0/0.7.0 Cookie privilege escalation
6754| [105905] Apache Atlas 0.6.0/0.7.0/0.7.1 /js privilege escalation
6755| [105878] Apache Struts up to 2.3.24.0 privilege escalation
6756| [105682] Apache2Triad 1.5.4 phpsftpd/users.php Parameter cross site scripting
6757| [105681] Apache2Triad 1.5.4 phpsftpd/users.php Request cross site request forgery
6758| [105680] Apache2Triad 1.5.4 Parameter Session Fixation weak authentication
6759| [105643] Apache Pony Mail up to 0.8b weak authentication
6760| [105288] Apache Sling up to 2.3.21 Sling.evalString() String cross site scripting
6761| [105219] Apache Tomcat up to 8.5.15/9.0.0.M21 HTTP2 Bypass directory traversal
6762| [105218] Apache Tomcat up to 7.0.78/8.0.44/8.5.15/9.0.0.M21 CORS Filter Cache Poisoning privilege escalation
6763| [105215] Apache CXF up to 3.0.12/3.1.9 OAuth2 Hawk/JOSE MAC Validation Timing unknown vulnerability
6764| [105206] Apache CXF up to 3.0.11/3.1.8 JAX-RS Module XML External Entity
6765| [105205] Apache CXF up to 3.0.11/3.1.8 HTTP Transport Module Parameter cross site scripting
6766| [105202] Apache Storm 1.0.0/1.0.1/1.0.2/1.0.3/1.1.0 Worker privilege escalation
6767| [104987] Apache Xerces-C++ XML Service CPU Exhaustion denial of service
6768| [104986] Apache CXF 2.4.5/2.5.1 WS-SP UsernameToken Policy SOAP Request weak authentication
6769| [104985] Apache MyFaces Core up to 2.1.4 EL Expression Parameter Injection information disclosure
6770| [104983] Apache Wink up to 1.1.1 XML Document xxe privilege escalation
6771| [104981] Apache Commons Email 1.0/1.1/1.2/1.3/1.4 Subject Linebreak SMTP privilege escalation
6772| [104591] MEDHOST Document Management System Apache Solr Default Credentials weak authentication
6773| [104062] Oracle MySQL Enterprise Monitor up to 3.3.3.1199 Apache Tomcat unknown vulnerability
6774| [104061] Oracle MySQL Enterprise Monitor up to 3.2.7.1204/3.3.3.1199 Apache Tomcat unknown vulnerability
6775| [104060] Oracle MySQL Enterprise Monitor up to 3.1.5.7958/3.2.5.1141/3.3.2.1162 Apache Struts 2 unknown vulnerability
6776| [103995] Oracle 8.3/8.4/15.1/15.2 Apache Trinidad unknown vulnerability
6777| [103993] Oracle Policy Automation up to 12.2.3 Apache Commons FileUplaod denial of service
6778| [103916] Oracle Banking Platform 2.3/2.4/2.4.1/2.5 Apache Commons FileUpload denial of service
6779| [103906] Oracle Communications BRM 11.2.0.0.0 Apache Commons Collections privilege escalation
6780| [103904] Oracle Communications BRM 11.2.0.0.0/11.3.0.0.0 Apache Groovy memory corruption
6781| [103866] Oracle Transportation Management 6.1/6.2 Apache Webserver unknown vulnerability
6782| [103816] Oracle BI Publisher 11.1.1.9.0/12.2.1.1.0/12.2.1.2.0 Apache Commons Fileupload denial of service
6783| [103797] Oracle Tuxedo System and Applications Monitor Apache Commons Collections privilege escalation
6784| [103792] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Commons Fileupload privilege escalation
6785| [103791] Oracle Endeca Server 7.6.0.0/7.6.1.0 Apache Commons Collections privilege escalation
6786| [103788] Oracle Enterprise Repository 11.1.1.7.0/12.1.3.0.0 Apache ActiveMQ memory corruption
6787| [103787] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Groovy memory corruption
6788| [103763] Apache Sling up to 1.0.11 XSS Protection API XSS.getValidXML() Application XML External Entity
6789| [103762] Apache Sling up to 1.0.12 XSS Protection API XSSAPI.encodeForJSString() Script Tag cross site scripting
6790| [103693] Apache OpenMeetings 1.0.0 HTTP Method privilege escalation
6791| [103692] Apache OpenMeetings 1.0.0 Tomcat Error information disclosure
6792| [103691] Apache OpenMeetings 3.2.0 Parameter privilege escalation
6793| [103690] Apache OpenMeetings 1.0.0 sql injection
6794| [103689] Apache OpenMeetings 1.0.0 crossdomain.xml privilege escalation
6795| [103688] Apache OpenMeetings 1.0.0 weak encryption
6796| [103687] Apache OpenMeetings 1.0.0 cross site request forgery
6797| [103556] Apache Roller 5.1.0/5.1.1 Weblog Page Template VTL privilege escalation
6798| [103554] Apache OpenMeetings 1.0.0 Password Update unknown vulnerability
6799| [103553] Apache OpenMeetings 1.0.0 File Upload privilege escalation
6800| [103552] Apache OpenMeetings 3.2.0 Chat cross site scripting
6801| [103551] Apache OpenMeetings 3.1.0 XML unknown vulnerability
6802| [103521] Apache HTTP Server 2.4.26 HTTP2 Free memory corruption
6803| [103520] Apache HTTP Server up to 2.2.33/2.4.26 mod_auth_digest Authorization Header memory corruption
6804| [103519] Apache Struts up to 2.5.11/2.3.32 Spring AOP denial of service
6805| [103518] Apache Struts up to 2.5.11 URLValidator directory traversal
6806| [103492] Apache Spark up to 2.1.x Web UI Reflected cross site scripting
6807| [103401] Apache Struts 2.3.x Struts 1 Plugin ActionMessage privilege escalation
6808| [103399] Apache Traffic Control Traffic Router TCP Connection Slowloris denial of service
6809| [103387] Apache Impala up to 2.8.0 StatestoreSubscriber weak encryption
6810| [103386] Apache Impala up to 2.7.x/2.8.0 Kerberos weak authentication
6811| [103352] Apache Solr Node weak authentication
6812| [102897] Apache Ignite up to 2.0 Update Notifier information disclosure
6813| [102878] Code42 CrashPlan 5.4.x RMI Server org.apache.commons.ssl.rmi.DateRMI privilege escalation
6814| [102698] Apache HTTP Server up to 2.2.32/2.4.25 mod_mime Content-Type memory corruption
6815| [102697] Apache HTTP Server 2.2.32/2.2.24 HTTP Strict Parsing ap_find_token Request Header memory corruption
6816| [102690] Apache HTTP Server up to 2.2.32/2.4.25 mod_ssl ap_hook_process_connection() denial of service
6817| [102689] Apache HTTP Server up to 2.2.32/2.4.25 ap_get_basic_auth_pw weak authentication
6818| [102622] Apache Thrift up to 0.9.2 Client Libraries skip denial of service
6819| [102538] Apache Ranger up to 0.7.0 Authorizer unknown vulnerability
6820| [102537] Apache Ranger up to 0.7.0 Wildcard Character unknown vulnerability
6821| [102536] Apache Ranger up to 0.6 Stored cross site scripting
6822| [102535] Apache Ranger up to 0.6.2 Policy Engine unknown vulnerability
6823| [102255] Apache NiFi up to 0.7.3/1.2.x Response Header privilege escalation
6824| [102254] Apache NiFi up to 0.7.3/1.2.x UI cross site scripting
6825| [102070] Apache CXF Fediz up to 1.1.2/1.2.0 Application Plugin denial of service
6826| [102020] Apache Tomcat up to 9.0.0.M1 Java Servlet HTTP Method unknown vulnerability
6827| [101858] Apache Hive up to 1.2.1/2.0.0 Client weak authentication
6828| [101802] Apache KNOX up to 0.11.0 WebHDFS privilege escalation
6829| [101928] HPE Aruba ClearPass Apache Tomcat information disclosure
6830| [101524] Apache Archiva up to 1.x/2.2.1 REST Endpoint cross site request forgery
6831| [101513] Apache jUDDI 3.1.2/3.1.3/3.1.4/3.1. Logout Open Redirect
6832| [101430] Apache CXF Fediz up to 1.3.1 OIDC Service cross site request forgery
6833| [101429] Apache CXF Fediz up to 1.2.3/1.3.1 Plugins cross site request forgery
6834| [100619] Apache Hadoop up to 2.6.x HDFS Servlet unknown vulnerability
6835| [100618] Apache Hadoop up to 2.7.0 HDFS Web UI cross site scripting
6836| [100621] Adobe ColdFusion 10/11/2016 Apache BlazeDS Library Deserialization privilege escalation
6837| [100205] Oracle MySQL Enterprise Monitor up to 3.1.6.8003/3.2.1182/3.3.2.1162 Apache Commons FileUpload denial of service
6838| [100191] Oracle Secure Global Desktop 4.71/5.2/5.3 Web Server (Apache HTTP Server) information disclosure
6839| [100162] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Commons Collections privilege escalation
6840| [100160] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Trinidad unknown vulnerability
6841| [99969] Oracle WebCenter Sites 11.1.1.8.0 Apache Tomcat memory corruption
6842| [99937] Apache Batik up to 1.8 privilege escalation
6843| [99936] Apache FOP up to 2.1 privilege escalation
6844| [99935] Apache CXF up to 3.0.12/3.1.10 STSClient Cache information disclosure
6845| [99934] Apache CXF up to 3.0.12/3.1.10 JAX-RS XML Security Streaming Client spoofing
6846| [99930] Apache Traffic Server up to 6.2.0 denial of service
6847| [99929] Apache Log4j up to 2.8.1 Socket Server Deserialization privilege escalation
6848| [99925] Apache Traffic Server 6.0.0/6.1.0/6.2.0 HPACK Bomb denial of service
6849| [99738] Ping Identity OpenID Connect Authentication Module up to 2.13 on Apache Mod_auth_openidc.c spoofing
6850| [117569] Apache Hadoop up to 2.7.3 privilege escalation
6851| [99591] Apache TomEE up to 1.7.3/7.0.0-M2 EjbObjectInputStream Serialized Object privilege escalation
6852| [99370] Apache Ignite up to 1.8 update-notifier Document XML External Entity
6853| [99299] Apache Geode up to 1.1.0 Pulse OQL Query privilege escalation
6854| [99572] Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 Application Listener privilege escalation
6855| [99570] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP Connector Cache information disclosure
6856| [99569] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP/2 GOAWAY Frame Resource Exhaustion denial of service
6857| [99568] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 Pipelined Request information disclosure
6858| [99048] Apache Ambari up to 2.3.x REST API Shell Metacharacter privilege escalation
6859| [99014] Apache Camel Jackson/JacksonXML privilege escalation
6860| [98610] Apple macOS up to 10.12.3 apache_mod_php memory corruption
6861| [98609] Apple macOS up to 10.12.3 apache_mod_php denial of service
6862| [98608] Apple macOS up to 10.12.3 apache_mod_php memory corruption
6863| [98607] Apple macOS up to 10.12.3 apache_mod_php denial of service
6864| [98606] Apple macOS up to 10.12.3 apache_mod_php denial of service
6865| [98605] Apple macOS up to 10.12.3 Apache denial of service
6866| [98604] Apple macOS up to 10.12.3 Apache denial of service
6867| [98603] Apple macOS up to 10.12.3 Apache denial of service
6868| [98602] Apple macOS up to 10.12.3 Apache denial of service
6869| [98601] Apple macOS up to 10.12.3 Apache denial of service
6870| [98517] Apache POI up to 3.14 OOXML File XXE denial of service
6871| [98405] Apache Hadoop up to 0.23.10 privilege escalation
6872| [98199] Apache Camel Validation XML External Entity
6873| [97892] Apache Tomcat up to 9.0.0.M15 Reverse-Proxy Http11InputBuffer.java information disclosure
6874| [97617] Apache Camel camel-snakeyaml Deserialization privilege escalation
6875| [97602] Apache Camel camel-jackson/camel-jacksonxml CamelJacksonUnmarshalType privilege escalation
6876| [97732] Apache Struts up to 2.3.31/2.5.10 Jakarta Multipart Parser Content-Type privilege escalation
6877| [97466] mod_auth_openidc up to 2.1.5 on Apache weak authentication
6878| [97455] mod_auth_openidc up to 2.1.4 on Apache weak authentication
6879| [97081] Apache Tomcat HTTPS Request denial of service
6880| [97162] EMC OpenText Documentum D2 BeanShell/Apache Commons privilege escalation
6881| [96949] Hanwha Techwin Smart Security Manager up to 1.5 Redis/Apache Felix Gogo privilege escalation
6882| [96314] Apache Cordova up to 6.1.1 on Android weak authentication
6883| [95945] Apple macOS up to 10.12.2 apache_mod_php denial of service
6884| [95944] Apple macOS up to 10.12.2 apache_mod_php denial of service
6885| [95943] Apple macOS up to 10.12.2 apache_mod_php memory corruption
6886| [95666] Oracle FLEXCUBE Direct Banking 12.0.0/12.0.1/12.0.2/12.0.3 Apache Commons Collections privilege escalation
6887| [95455] Apache NiFi up to 1.0.0/1.1.0 Connection Details Dialogue cross site scripting
6888| [95311] Apache storm UI Daemon privilege escalation
6889| [95291] ZoneMinder 1.30.0 Apache httpd privilege escalation
6890| [94800] Apache Wicket up to 1.5.16/6.24.x Deserialize DiskFileItem denial of service
6891| [94705] Apache Qpid Broker for Java up to 6.1.0 SCRAM-SHA-1/SCRAM-SHA-256 User information disclosure
6892| [94627] Apache HTTP Server up to 2.4.24 mod_auth_digest Crash denial of service
6893| [94626] Apache HTTP Server up to 2.4.24 mod_session_crypto Padding weak encryption
6894| [94625] Apache HTTP Server up to 2.4.24 Response Split privilege escalation
6895| [94540] Apache Tika 1.9 tika-server File information disclosure
6896| [94600] Apache ActiveMQ up to 5.14.1 Administration Console cross site scripting
6897| [94348] Apple macOS up to 10.12.1 apache_mod_php denial of service
6898| [94347] Apple macOS up to 10.12.1 apache_mod_php denial of service
6899| [94346] Apple macOS up to 10.12.1 apache_mod_php denial of service
6900| [94345] Apple macOS up to 10.12.1 apache_mod_php denial of service
6901| [94344] Apple macOS up to 10.12.1 apache_mod_php denial of service
6902| [94343] Apple macOS up to 10.12.1 apache_mod_php memory corruption
6903| [94342] Apple macOS up to 10.12.1 apache_mod_php memory corruption
6904| [94128] Apache Tomcat up to 9.0.0.M13 Error information disclosure
6905| [93958] Apache HTTP Server up to 2.4.23 mod_http2 h2_stream.c denial of service
6906| [93874] Apache Subversion up to 1.8.16/1.9.4 mod_dontdothat XXE denial of service
6907| [93855] Apache Hadoop up to 2.6.4/2.7.2 HDFS Service privilege escalation
6908| [93609] Apache OpenMeetings 3.1.0 RMI Registry privilege escalation
6909| [93555] Apache Tika 1.6-1.13 jmatio MATLAB File privilege escalation
6910| [93799] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
6911| [93798] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
6912| [93797] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 HTTP Split privilege escalation
6913| [93796] Apache Tomcat up to 8.5.6/9.0.0.M11 HTTP/2 Header Parser denial of service
6914| [93532] Apache Commons Collections Library Java privilege escalation
6915| [93210] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 ResourceLinkFactory privilege escalation
6916| [93209] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Realm Authentication User information disclosure
6917| [93208] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 System Property Replacement information disclosure
6918| [93207] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Utility Method privilege escalation
6919| [93206] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Configuration privilege escalation
6920| [93098] Apache Commons FileUpload privilege escalation
6921| [92987] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Commons Collection memory corruption
6922| [92986] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Tomcat memory corruption
6923| [92982] Oracle Insurance IStream 4.3.2 Apache Commons Collections memory corruption
6924| [92981] Oracle Financial Services Lending and Leasing 14.1.0/14.2.0 Apache Commons Collections memory corruption
6925| [92979] Oracle up to 8.0.3 Apache Commons Collections memory corruption
6926| [92977] Oracle FLEXCUBE Universal Banking up to 12.2.0 Apache Commons Collections memory corruption
6927| [92976] Oracle FLEXCUBE Universal Banking 12.87.1/12.87.2 Apache Commons Collections memory corruption
6928| [92975] Oracle FLEXCUBE Private Banking up to 12.1.0 Apache Commons Collections memory corruption
6929| [92974] Oracle FLEXCUBE Investor Servicing 12.0.1 Apache Commons Collections memory corruption
6930| [92973] Oracle 12.0.0/12.1.0 Apache Commons Collections memory corruption
6931| [92972] Oracle FLEXCUBE Core Banking 11.5.0.0.0/11.6.0.0.0 Apache Commons Collections memory corruption
6932| [92962] Oracle Agile PLM 9.3.4/9.3.5 Apache Commons Collections memory corruption
6933| [92909] Oracle Agile PLM 9.3.4/9.3.5 Apache Tomcat unknown vulnerability
6934| [92786] Oracle Banking Digital Experience 15.1 Apache Commons Collections information disclosure
6935| [92549] Apache Tomcat on Red Hat privilege escalation
6936| [92509] Apache Tomcat JK ISAPI Connector up to 1.2.41 jk_uri_worker_map.c memory corruption
6937| [92314] Apache MyFaces Trinidad up to 1.0.13/1.2.15/2.0.1/2.1.1 CoreResponseStateManager memory corruption
6938| [92313] Apache Struts2 up to 2.3.28/2.5.0 Action Name Cleanup cross site request forgery
6939| [92299] Apache Derby up to 10.12.1.0 SqlXmlUtil XML External Entity
6940| [92217] Apache ActiveMQ Artemis up to 1.3.x Broker/REST GetObject privilege escalation
6941| [92174] Apache Ranger up to 0.6.0 Policy cross site scripting
6942| [91831] Apache Jackrabbit up to 2.13.2 HTTP Header cross site request forgery
6943| [91825] Apache Zookeeper up to 3.4.8/3.5.2 C CLI Shell memory corruption
6944| [91818] Apache CXF Fediz up to 1.2.2/1.3.0 Application Plugin privilege escalation
6945| [92056] Apple macOS up to 10.11 apache_mod_php memory corruption
6946| [92055] Apple macOS up to 10.11 apache_mod_php memory corruption
6947| [92054] Apple macOS up to 10.11 apache_mod_php denial of service
6948| [92053] Apple macOS up to 10.11 apache_mod_php denial of service
6949| [92052] Apple macOS up to 10.11 apache_mod_php denial of service
6950| [92051] Apple macOS up to 10.11 apache_mod_php memory corruption
6951| [92050] Apple macOS up to 10.11 apache_mod_php denial of service
6952| [92049] Apple macOS up to 10.11 apache_mod_php memory corruption
6953| [92048] Apple macOS up to 10.11 apache_mod_php denial of service
6954| [92047] Apple macOS up to 10.11 apache_mod_php memory corruption
6955| [92046] Apple macOS up to 10.11 apache_mod_php memory corruption
6956| [92045] Apple macOS up to 10.11 apache_mod_php memory corruption
6957| [92044] Apple macOS up to 10.11 apache_mod_php memory corruption
6958| [92043] Apple macOS up to 10.11 apache_mod_php denial of service
6959| [92042] Apple macOS up to 10.11 apache_mod_php memory corruption
6960| [92041] Apple macOS up to 10.11 apache_mod_php memory corruption
6961| [92040] Apple macOS up to 10.11 Apache Proxy privilege escalation
6962| [91785] Apache Shiro up to 1.3.1 Servlet Filter privilege escalation
6963| [90879] Apache OpenMeetings up to 3.1.1 SWF Panel cross site scripting
6964| [90878] Apache Sentry up to 1.6.x Blacklist Filter reflect/reflect2/java_method privilege escalation
6965| [90610] Apache POI up to 3.13 XLSX2CSV Example OpenXML Document XML External Entity
6966| [90584] Apache ActiveMQ up to 5.11.3/5.12.2/5.13/1 Administration Web Console privilege escalation
6967| [90385] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site scripting
6968| [90384] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site request forgery
6969| [90383] Apache OpenOffice up to 4.1.2 Impress File memory corruption
6970| [89670] Apache Tomcat up to 8.5.4 CGI Servlet Environment Variable Open Redirect
6971| [89669] Apache HTTP Server up to 2.4.23 RFC 3875 Namespace Conflict Environment Variable Open Redirect
6972| [89726] Apple Mac OS X up to 10.11.5 apache_mod_php memory corruption
6973| [89484] Apache Qpid up to 0.13.0 on Windows Proton Library Certificate weak authentication
6974| [89473] HPE iMC PLAT/EAD/APM/iMC NTA/iMC BIMS/iMC UAM_TAM up to 7.2 Apache Commons Collections Library Command privilege escalation
6975| [90263] Apache Archiva Header denial of service
6976| [90262] Apache Archiva Deserialize privilege escalation
6977| [90261] Apache Archiva XML DTD Connection privilege escalation
6978| [88827] Apache Xerces-C++ up to 3.1.3 DTD Stack-Based memory corruption
6979| [88747] Apache HTTP Server 2.4.17/2.4.18 mod_http2 denial of service
6980| [88608] Apache Struts up to 2.3.28.1/2.5.0 URLValidator Null Value denial of service
6981| [88607] Apache Struts up to 2.3.28.1 REST Plugin Expression privilege escalation
6982| [88606] Apache Struts up to 2.3.28.1 Restriction privilege escalation
6983| [88605] Apache Struts up to 2.3.28.1 Restriction privilege escalation
6984| [88604] Apache Struts up to 2.3.28.1 Token Validator cross site request forgery
6985| [88603] Apache Commons FileUpload up to 1.3.1 MultipartStream denial of service
6986| [88602] Apache Struts up to 1.3.10 ActionServlet.java cross site scripting
6987| [88601] Apache Struts up to 1.3.10 Multithreading ActionServlet.java memory corruption
6988| [88600] Apache Struts up to 1.3.10 MultiPageValidator privilege escalation
6989| [89005] Apache Qpid AMQP JMS Client getObject privilege escalation
6990| [87888] Apache Ranger up to 0.5.2 Policy Admin Tool eventTime sql injection
6991| [87835] Apache CloudStack up to 4.5.2.0/4.6.2.0/4.7.1.0/4.8.0.0 SAML-based Authentication privilege escalation
6992| [87806] HPE Discovery and Dependency Mapping Inventory up to 9.32 update 3 Apache Commons Collections Library privilege escalation
6993| [87805] HPE Universal CMDB up to 10.21 Apache Commons Collections Library privilege escalation
6994| [87768] Apache Shiro up to 1.2.4 Cipher Key privilege escalation
6995| [87765] Apache James Server 2.3.2 Command privilege escalation
6996| [88667] Apache HTTP Server up to 2.4.20 mod_http2 Certificate weak authentication
6997| [87718] Apache Struts up to 2.3.24.1 OGNL Caching denial of service
6998| [87717] Apache Struts up to 2.3.28 REST Plugin privilege escalation
6999| [87706] Apache Qpid Java up to 6.0.2 AMQP privilege escalation
7000| [87703] Apache Qbid Java up to 6.0.2 PlainSaslServer.java denial of service
7001| [87702] Apache ActiveMQ up to 5.13.x Fileserver Web Application Upload privilege escalation
7002| [87700] Apache PDFbox up to 1.8.11/2.0.0 XML Parser PDF Document XML External Entity
7003| [87679] HP Release Control 9.13/9.20/9.21 Apache Commons Collections Library Java Object privilege escalation
7004| [87540] Apache Ambari up to 2.2.0 File Browser View information disclosure
7005| [87433] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
7006| [87432] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
7007| [87431] Apple Mac OS X up to 10.11.4 apache_mod_php Format String
7008| [87430] Apple Mac OS X up to 10.11.4 apache_mod_php denial of service
7009| [87429] Apple Mac OS X up to 10.11.4 apache_mod_php information disclosure
7010| [87428] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
7011| [87427] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
7012| [87389] Apache Xerces C++ up to 3.1.3 XML Document DTDScanner.cpp memory corruption
7013| [87172] Adobe ColdFusion up to 10 Update 18/11 Update 7/2016 Apache Commons Collections Library privilege escalation
7014| [87121] Apache Cordova iOS up to 3.x Plugin privilege escalation
7015| [87120] Apache Cordova iOS up to 3.x URL Whitelist privilege escalation
7016| [83806] HPE Network Node Manager i up to 10.01 Apache Commons Collections Library privilege escalation
7017| [83077] Apache Subversion up to 1.8.15/1.9.3 mod_authz_svn mod_authz_svn.c denial of service
7018| [83076] Apache Subversion up to 1.8.15/1.9.3 svnserve svnserve/cyrus_auth.c privilege escalation
7019| [82790] Apache Struts 2.0.0/2.3.24/2.3.28 Dynamic Method privilege escalation
7020| [82789] Apache Struts 2.0.0/2.3.24/2.3.28 XSLTResult privilege escalation
7021| [82725] HPE P9000 Command View up to 7.x/8.4.0 Apache Commons Collections Library privilege escalation
7022| [82444] Apache Camel up to 2.14.x/2.15.4/2.16.0 HTTP Request privilege escalation
7023| [82389] Apache Subversion up to 1.7.x/1.8.14/1.9.2 mod_dav_svn util.c memory corruption
7024| [82280] Apache Struts up to 1.7 JRE URLDecoder cross site scripting
7025| [82260] Apache OFBiz up to 12.04.05/13.07.02 Java Object privilege escalation
7026| [82259] Apache Qpid Proton up to 0.12.0 proton.reactor.Connector weak encryption
7027| [82250] Apache Ranger up to 0.5.0 Admin UI weak authentication
7028| [82214] Apache Wicket up to 1.5.14/6.21.x/7.1.x Input Element cross site scripting
7029| [82213] Apache Wicket up to 1.5.14/6.21.x/7.1.x ModalWindow Title getWindowOpenJavaScript cross site scripting
7030| [82212] Apache Ranger up to 0.5.0 Policy Admin Tool privilege escalation
7031| [82211] Apache OFBiz up to 12.04.06/13.07.02 ModelFormField.java DisplayEntityField.getDescription cross site scripting
7032| [82082] Apache JetSpeed up to 2.3.0 User Manager Service privilege escalation
7033| [82081] Apache OpenMeetings up to 3.1.0 SOAP API information disclosure
7034| [82080] Apache OpenMeetings up to 3.1.0 Event cross site scripting
7035| [82078] Apache OpenMeetings up to 3.1.0 Import/Export System Backup ZIP Archive directory traversal
7036| [82077] Apache OpenMeetings up to 3.1.0 Password Reset sendHashByUser privilege escalation
7037| [82076] Apache Ranger up to 0.5.1 privilege escalation
7038| [82075] Apache JetSpeed up to 2.3.0 Portal cross site scripting
7039| [82074] Apache JetSpeed up to 2.3.0 cross site scripting
7040| [82073] Apache JetSpeed up to 2.3.0 User Manager Service sql injection
7041| [82072] Apache JetSpeed up to 2.3.0 Portal Site Manager ZIP Archive directory traversal
7042| [82058] Apache LDAP Studio/Directory Studio up to 2.0.0-M9 CSV Export privilege escalation
7043| [82053] Apache Ranger up to 0.4.x Policy Admin Tool privilege escalation
7044| [82052] Apache Ranger up to 0.4.x Policy Admin Tool HTTP Request cross site scripting
7045| [81696] Apache ActiveMQ up to 5.13.1 HTTP Header privilege escalation
7046| [81695] Apache Xerces-C up to 3.1.2 internal/XMLReader.cpp memory corruption
7047| [81622] HPE Asset Manager 9.40/9.41/9.50 Apache Commons Collections Library Java Object privilege escalation
7048| [81406] HPE Service Manager up to 9.35 P3/9.41 P1 Apache Commons Collections Library Command privilege escalation
7049| [81405] HPE Operations Orchestration up to 10.50 Apache Commons Collections Library Command privilege escalation
7050| [81427] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
7051| [81426] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
7052| [81372] Apache Struts up to 2.3.24.1 I18NInterceptor cross site scripting
7053| [81371] Apache Struts up to 2.3.24.1 Double OGNL Evaluation privilege escalation
7054| [81370] Apache Struts up to 2.3.24.1 Java URLDecoder cross site scripting
7055| [81084] Apache Tomcat 6.0/7.0/8.0/9.0 ServletContext directory traversal
7056| [81083] Apache Tomcat 7.0/8.0/9.0 Index Page cross site request forgery
7057| [81082] Apache Tomcat 7.0/8.0/9.0 ResourceLinkFactory.setGlobalContext privilege escalation
7058| [81081] Apache Tomcat 6.0/7.0/8.0/9.0 Error information disclosure
7059| [81080] Apache Tomcat 6.0/7.0/8.0/9.0 Session Persistence privilege escalation
7060| [81079] Apache Tomcat 6.0/7.0/8.0/9.0 StatusManagerServlet information disclosure
7061| [81078] Apache Tomcat 7.0/8.0/9.0 Session privilege escalation
7062| [80970] Apache Solr up to 5.3.0 Admin UI plugins.js cross site scripting
7063| [80969] Apache Solr up to 5.2 Schema schema-browser.js cross site scripting
7064| [80968] Apache Solr up to 5.0 analysis.js cross site scripting
7065| [80940] HP Continuous Delivery Automation 1.30 Apache Commons Collections Library privilege escalation
7066| [80823] Apache CloudStack up to 4.5.1 KVM Virtual Machine Migration privilege escalation
7067| [80822] Apache CloudStack up to 4.5.1 API Call information disclosure
7068| [80778] Apache Camel up to 2.15.4/2.16.0 camel-xstream privilege escalation
7069| [80750] HPE Operations Manager 8.x/9.0 on Windows Apache Commons Collections Library privilege escalation
7070| [80724] Apache Hive up to 1.2.1 Authorization Framework privilege escalation
7071| [80577] Oracle Secure Global Desktop 4.63/4.71/5.2 Apache HTTP Server denial of service
7072| [80165] Intel McAfee ePolicy Orchestrator up to 4.6.9/5.0.3/5.3.1 Apache Commons Collections Library privilege escalation
7073| [80116] Apache Subversion up to 1.9.2 svn Protocol libsvn_ra_svn/marshal.c read_string memory corruption
7074| [80115] Apache ActiveMQ up to 5.12.x Broker Service privilege escalation
7075| [80036] IBM Cognos Business Intelligence Apache Commons Collections Library InvokerTransformer privilege escalation
7076| [79873] VMware vCenter Operations/vRealize Orchestrator Apache Commons Collections Library Serialized Java Object privilege escalation
7077| [79840] Apache Cordova File Transfer Plugin up to 1.2.x on Android unknown vulnerability
7078| [79839] Apache TomEE Serialized Java Stream EjbObjectInputStream privilege escalation
7079| [79791] Cisco Products Apache Commons Collections Library privilege escalation
7080| [79539] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
7081| [79538] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
7082| [79294] Apache Cordova-Android up to 3.6 BridgeSecret Random Generator weak encryption
7083| [79291] Apache Cordova-Android up to 4.0 Javascript Whitelist privilege escalation
7084| [79244] Apache CXF up to 2.7.17/3.0.7/3.1.2 SAML Web SSO Module SAML Response weak authentication
7085| [79243] Oracle WebLogic Server 10.3.6.0/12.1.2.0/12.1.3.0/12.2.1.0 WLS Security com.bea.core.apache.commons.collections.jar privilege escalation
7086| [78989] Apache Ambari up to 2.1.1 Open Redirect
7087| [78988] Apache Ambari up to 2.0.1/2.1.0 Password privilege escalation
7088| [78987] Apache Ambari up to 2.0.x cross site scripting
7089| [78986] Apache Ambari up to 2.0.x Proxy Endpoint api/v1/proxy privilege escalation
7090| [78780] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
7091| [78779] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
7092| [78778] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
7093| [78777] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
7094| [78776] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
7095| [78775] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
7096| [78774] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
7097| [78297] Apache Commons Components HttpClient up to 4.3.5 HTTPS Timeout denial of service
7098| [77406] Apache Flex BlazeDS AMF Message XML External Entity
7099| [77429] Apache ActiveMQ up to 5.10.0 LDAPLoginModule privilege escalation
7100| [77399] Apache ActiveMQ up to 5.10.0 LDAPLoginModule weak authentication
7101| [77375] Apache Tapestry up to 5.3.5 Client-Side Object Storage privilege escalation
7102| [77331] Apache ActiveMQ up to 5.11.1 on Windows Fileserver Upload/Download directory traversal
7103| [77299] Apache Solr Real-Time Module up to 7.x-1.1 Index Content information disclosure
7104| [77247] Apache ActiveMQ up to 5.10 TransportConnection.java processControlCommand denial of service
7105| [77083] Apache Groovy up to 2.4.3 MethodClosure.java MethodClosure memory corruption
7106| [76953] Apache Subversion 1.7.0/1.8.0/1.8.10 svn_repos_trace_node_locations information disclosure
7107| [76952] Apache Subversion 1.7.0/1.8.0/1.8.10 mod_authz_svn anonymous/authenticated information disclosure
7108| [76567] Apache Struts 2.3.20 unknown vulnerability
7109| [76733] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 ap_some_auth_required unknown vulnerability
7110| [76732] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 Request apr_brigade_flatten privilege escalation
7111| [76731] Apache HTTP Server 2.4.12 ErrorDocument 400 Crash denial of service
7112| [75690] Apache Camel up to 2.13.3/2.14.1 XPathBuilder.java XML External Entity
7113| [75689] Apache Camel up to 2.13.3/2.14.1 XML Converter Setup XmlConverter.java SAXSource privilege escalation
7114| [75668] Apache Sling API/Sling Servlets Post up to 2.2.1 HtmlResponse cross site scripting
7115| [75601] Apache Jackrabbit up to 2.10.0 WebDAV Request XML External Entity
7116| [75420] Apache Tomcat up to 6.0.43/7.0.58/8.0.16 Security Manager privilege escalation
7117| [75145] Apache OpenOffice up to 4.1.1 HWP Filter Crash denial of service
7118| [75032] Apache Tomcat Connectors up to 1.2.40 mod_jk privilege escalation
7119| [75135] PHP 5.4/5.5 HTTP Request sapi_apache2.c apache2handler privilege escalation
7120| [74793] Apache Tomcat File Upload denial of service
7121| [74708] Apple MacOS X up to 10.10.2 Apache denial of service
7122| [74707] Apple MacOS X up to 10.10.2 Apache denial of service
7123| [74706] Apple MacOS X up to 10.10.2 Apache memory corruption
7124| [74705] Apple MacOS X up to 10.10.2 Apache denial of service
7125| [74704] Apple MacOS X up to 10.10.2 Apache denial of service
7126| [74703] Apple MacOS X up to 10.10.2 Apache denial of service
7127| [74702] Apple MacOS X up to 10.10.2 Apache denial of service
7128| [74701] Apple MacOS X up to 10.10.2 Apache cross site request forgery
7129| [74700] Apple MacOS X up to 10.10.2 Apache unknown vulnerability
7130| [74661] Apache Flex up to 4.14.0 asdoc index.html cross site scripting
7131| [74609] Apache Cassandra up to 1.2.19/2.0.13/2.1.3 JMX/RMI Interface privilege escalation
7132| [74469] Apache Xerces-C up to 7.0 internal/XMLReader.cpp denial of service
7133| [74468] Apache Batik up to 1.6 denial of service
7134| [74414] Apache Mod-gnutls up to 0.5.1 Authentication spoofing
7135| [74371] Apache Standard Taglibs up to 1.2.0 memory corruption
7136| [74367] Apache HTTP Server up to 2.4.12 mod_lua lua_request.c wsupgrade denial of service
7137| [74174] Apache WSS4J up to 2.0.0 privilege escalation
7138| [74172] Apache ActiveMQ up to 5.5.0 Administration Console cross site scripting
7139| [69092] Apache Tomcat up to 6.0.42/7.0.54/8.0.8 HTTP Request Smuggling privilege escalation
7140| [73831] Apache Qpid up to 0.30 Access Restriction unknown vulnerability
7141| [73731] Apache XML Security unknown vulnerability
7142| [68660] Oracle BI Publisher 10.1.3.4.2/11.1.1.7 Apache Tomcat cross site scripting
7143| [73659] Apache CloudStack up to 4.3.0 Stack-Based unknown vulnerability
7144| [73593] Apache Traffic Server up to 5.1.0 denial of service
7145| [73511] Apache POI up to 3.10 Deadlock denial of service
7146| [73510] Apache Solr up to 4.3.0 cross site scripting
7147| [68447] Apache Subversion up to 1.7.18/1.8.10 mod_dav_svn Crash denial of service
7148| [68446] Apache Subversion up to 1.7.18/1.8.10 REPORT Request Crash denial of service
7149| [73173] Apache CloudStack Stack-Based unknown vulnerability
7150| [68357] Apache Struts up to 2.3.16.3 Random Number Generator cross site request forgery
7151| [73106] Apache Hadoop up to 2.4.0 Symlink privilege escalation
7152| [68575] Apache HTTP Server up to 2.4.10 LuaAuthzProvider mod_lua.c privilege escalation
7153| [72890] Apache Qpid 0.30 unknown vulnerability
7154| [72887] Apache Hive 0.13.0 File Permission privilege escalation
7155| [72878] Apache Cordova 3.5.0 cross site request forgery
7156| [72877] Apache Cordova 3.5.0 cross site request forgery
7157| [72876] Apache Cordova 3.5.0 cross site request forgery
7158| [68435] Apache HTTP Server 2.4.10 mod_proxy_fcgi.c handle_headers denial of service
7159| [68065] Apache CXF up to 3.0.1 JAX-RS SAML denial of service
7160| [68064] Apache CXF up to 3.0.0 SAML Token denial of service
7161| [67913] Oracle Retail Markdown Optimization 12.0/13.0/13.1/13.2/13.4 Apache commons-beanutils-1.8.0.jar memory corruption
7162| [67912] Oracle Retail Invoice Matching up to 14.0 Apache commons-beanutils-1.8.0.jar memory corruption
7163| [67911] Oracle Retail Clearance Optimization Engine 13.3/13.4/14.0 Apache commons-beanutils-1.8.0.jar memory corruption
7164| [67910] Oracle Retail Allocation up to 13.2 Apache commons-beanutils-1.8.0.jar memory corruption
7165| [71835] Apache Shiro 1.0.0/1.1.0/1.2.0/1.2.1/1.2.2 unknown vulnerability
7166| [71633] Apachefriends XAMPP 1.8.1 cross site scripting
7167| [71629] Apache Axis2/C spoofing
7168| [67633] Apple Mac OS X up to 10.9.4 apache_mod_php ext/standard/dns.c dns_get_record memory corruption
7169| [67631] Apple Mac OS X up to 10.9.4 apache_mod_php Symlink memory corruption
7170| [67630] Apple Mac OS X up to 10.9.4 apache_mod_php cdf_read_property_info denial of service
7171| [67629] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_count_chain denial of service
7172| [67628] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_check_stream_offset denial of service
7173| [67627] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c mconvert memory corruption
7174| [67626] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c denial of service
7175| [67625] Apple Mac OS X up to 10.9.4 apache_mod_php Crash denial of service
7176| [67624] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_property_info denial of service
7177| [67623] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_unpack_summary_info denial of service
7178| [67622] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_short_sector denial of service
7179| [67620] Apple Mac OS X up to 10.9.4 apache_mod_php magic/Magdir/commands denial of service
7180| [67790] Apache HTTP Server mod_cache NULL Pointer Dereference denial of service
7181| [67522] Apache Tomcat up to 7.0.39 JSP Upload privilege escalation
7182| [70809] Apache POI up to 3.11 Crash denial of service
7183| [70808] Apache POI up to 3.10 unknown vulnerability
7184| [70806] Apache Commons-httpclient 4.2/4.2.1/4.2.2 spoofing
7185| [70749] Apache Axis up to 1.4 getCN spoofing
7186| [70701] Apache Traffic Server up to 3.3.5 denial of service
7187| [70700] Apache OFBiz up to 12.04.03 cross site scripting
7188| [67402] Apache OpenOffice 4.0.0/4.0.1/4.1.0 Calc privilege escalation
7189| [67401] Apache OpenOffice up to 4.1.0 OLE Object information disclosure
7190| [70661] Apache Subversion up to 1.6.17 denial of service
7191| [70660] Apache Subversion up to 1.6.17 spoofing
7192| [70659] Apache Subversion up to 1.6.17 spoofing
7193| [67183] Apache HTTP Server up to 2.4.9 mod_proxy denial of service
7194| [67180] Apache HTTP Server up to 2.4.9 WinNT MPM Memory Leak denial of service
7195| [67185] Apache HTTP Server up to 2.4.9 mod_status Heap-Based memory corruption
7196| [67184] Apache HTTP Server 2.4.5/2.4.6 mod_cache NULL Pointer Dereference denial of service
7197| [67182] Apache HTTP Server up to 2.4.9 mod_deflate Memory Consumption denial of service
7198| [67181] Apache HTTP Server up to 2.4.9 mod_cgid denial of service
7199| [70338] Apache Syncope up to 1.1.7 unknown vulnerability
7200| [70295] Apache CXF up to 2.7.9 Cleartext information disclosure
7201| [70106] Apache Open For Business Project up to 10.04.0 getServerError cross site scripting
7202| [70105] Apache MyFaces up to 2.1.5 JavaServer Faces directory traversal
7203| [69846] Apache HBase up to 0.94.8 information disclosure
7204| [69783] Apache CouchDB up to 1.2.0 memory corruption
7205| [13383] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 XML Parser privilege escalation
7206| [13300] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi setuid() privilege escalation
7207| [13299] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi Content-Type Header information disclosure
7208| [13164] Apache CXF up to 2.6.13/2.7.10 SOAP OutgoingChainInterceptor.java Invalid Content denial of service
7209| [13163] Apache CXF up to 2.6.13/2.7.10 SOAP HTML Content denial of service
7210| [13158] Apache Struts up to 2.3.16.2 ParametersInterceptor getClass privilege escalation
7211| [69515] Apache Struts up to 2.3.15.0 CookieInterceptor memory corruption
7212| [13086] Apache Struts up to 1.3.10 Class Loader privilege escalation
7213| [13067] Apache Struts up to 2.3.16.1 Class Loader privilege escalation
7214| [69431] Apache Archiva up to 1.3.6 cross site scripting
7215| [69385] Apache Syncope up to 1.1.6 unknown vulnerability
7216| [69338] Apache Xalan-Java up to 2.7.1 system-property unknown vulnerability
7217| [12742] Trustwave ModSecurity up to 2.7.5 Chunk Extension apache2/modsecurity.c modsecurity_tx_init() privilege escalation
7218| [12741] Trustwave ModSecurity up to 2.7.6 Chunked HTTP Transfer apache2/modsecurity.c modsecurity_tx_init Trailing Header privilege escalation
7219| [13387] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Content-Length Header privilege escalation
7220| [13386] Apache Tomcat Security Manager up to 6.0.39/7.0.53/8.0.5 XSLT privilege escalation
7221| [13385] Apache Tomcat 8.0.0/8.0.1/8.0.3 AJP Request Zero Length denial of service
7222| [13384] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Chunked HTTP Request denial of service
7223| [12748] Apache CouchDB 1.5.0 UUIDS /_uuids denial of service
7224| [66739] Apache Camel up to 2.12.2 unknown vulnerability
7225| [66738] Apache Camel up to 2.12.2 unknown vulnerability
7226| [12667] Apache HTTP Server 2.4.7 mod_log_config.c log_cookie denial of service
7227| [66695] Apache CouchDB up to 1.2.0 cross site scripting
7228| [66694] Apache CouchDB up to 1.2.0 Partition partition2 directory traversal
7229| [66689] Apache HTTP Server up to 2.0.33 mod_dav dav_xml_get_cdata denial of service
7230| [12518] Apache Tomcat up to 6.0.38/7.0.49/8.0.0-RC9 HTTP Header denial of service
7231| [66498] Apache expressions up to 3.3.0 Whitelist unknown vulnerability
7232| [12781] Apache Struts up to 2.3.8 ParametersInterceptor getClass denial of service
7233| [12439] Apache Tomcat 6.0.33 XML XXE information disclosure
7234| [12438] Apache Tomcat 6.0.33/6.0.34/6.0.35/6.0.36/6.0.37 coyoteadapter.java disableURLRewriting privilege escalation
7235| [66356] Apache Wicket up to 6.8.0 information disclosure
7236| [12209] Apache Tomcat 8.0.0-RC1/8.0.1/7.0.0/7.0.50 Content-Type Header for Multi-Part Request Infinite Loop denial of service
7237| [66322] Apache ActiveMQ up to 5.8.0 cross site scripting
7238| [12291] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
7239| [66255] Apache Open For Business Project up to 10.04.3 cross site scripting
7240| [66200] Apache Hadoop up to 2.0.5 Security Feature information disclosure
7241| [66072] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
7242| [66068] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
7243| [11928] Oracle Secure Global Desktop up to 4.71 Apache Tomcat unknown vulnerability
7244| [11924] Oracle Secure Global Desktop up to 4.63 Apache Tomcat denial of service
7245| [11922] Oracle Secure Global Desktop up to 4.63 Apache Tomcat unknown vulnerability
7246| [66049] Apache XML Security for Java up to 1.4.6 Memory Consumption denial of service
7247| [12199] Apache Subversion up to 1.8.5 mod_dav_svn/repos.c get_resource denial of service
7248| [65946] askapache Firefox Adsense up to 3.0 askapache-firefox-adsense.php cross site request forgery
7249| [65668] Apache Solr 4.0.0 Updater denial of service
7250| [65665] Apache Solr up to 4.3.0 denial of service
7251| [65664] Apache Solr 3.6.0/3.6.1/3.6.2/4.0.0 Updater denial of service
7252| [65663] Apache Solr up to 4.5.1 ResourceLoader directory traversal
7253| [65658] Apache roller 4.0/4.0.1/5.0/5.0.1 unknown vulnerability
7254| [65657] Apache Roller 4.0/4.0.1/5.0/5.0.1 cross site scripting
7255| [11325] Apache Subversion 1.7.13 mod_dontdothat Bypass denial of service
7256| [11324] Apache Subversion up to 1.8.4 mod_dav_svn denial of service
7257| [11098] Apache Tomcat 5.5.25 HTTP Request cross site request forgery
7258| [65410] Apache Struts 2.3.15.3 cross site scripting
7259| [65386] Apache Solr up to 2.2.1 on TYPO3 cross site scripting
7260| [65385] Apache Solr up to 2.2.1 on TYPO3 unknown vulnerability
7261| [11044] Apache Struts 2.3.15.3 showConfig.action cross site scripting
7262| [11043] Apache Struts 2.3.15.3 actionNames.action cross site scripting
7263| [11018] cPanel WHM up to 11.40.0.11 Apache mod_userdir Tweak Interface privilege escalation
7264| [65342] Apache Sling 1.0.2/1.0.4/1.0.6/1.1.0/1.1.2 Auth Core cross site scripting
7265| [65340] Apache Shindig 2.5.0 information disclosure
7266| [65316] Apache Mod Fcgid up to 2.3.7 mod_fcgid fcgid_bucket.c fcgid_header_bucket_read memory corruption
7267| [65313] Apache Sling 2.2.0/2.3.0 AbstractCreateOperation.java deepGetOrCreateNode denial of service
7268| [10826] Apache Struts 2 File privilege escalation
7269| [65204] Apache Camel up to 2.10.1 unknown vulnerability
7270| [10460] Apache Struts 2.0.0/2.3.15.1 Action Mapping Mechanism Bypass privilege escalation
7271| [10459] Apache Struts 2.0.0/2.3.15 Dynamic Method Invocation unknown vulnerability
7272| [10160] Apache Subversion 1.8.0/1.8.1/1.8.2 svnwcsub.py handle_options race condition
7273| [10159] Apache Subversion up to 1.8.2 svnserve write_pid_file() race condition
7274| [10158] Apache Subversion 1.8.0/1.8.1/1.8.2 daemonize.py daemon::daemonize race condition
7275| [10157] Apache Subversion up to 1.8.1 FSFS Repository Symlink privilege escalation
7276| [64808] Fail2ban up to 0.8.9 apache-auth.conf denial of service
7277| [64760] Best Practical RT up to 4.0.12 Apache::Session::File information disclosure
7278| [64722] Apache XML Security for C++ Heap-based memory corruption
7279| [64719] Apache XML Security for C++ Heap-based memory corruption
7280| [64718] Apache XML Security for C++ verify denial of service
7281| [64717] Apache XML Security for C++ getURIBaseTXFM memory corruption
7282| [64716] Apache XML Security for C++ spoofing
7283| [64701] Apache CXF up to 2.7.3 XML Parser Memory Consumption denial of service
7284| [64700] Apache CloudStack up to 4.1.0 Stack-Based cross site scripting
7285| [64667] Apache Open For Business Project up to 10.04.04 unknown vulnerability
7286| [64666] Apache Open For Business Project up to 10.04.04 cross site scripting
7287| [9891] Apache HTTP Server 2.2.22 suEXEC Feature .htaccess information disclosure
7288| [64509] Apache ActiveMQ up to 5.8.0 scheduled.jsp cross site scripting
7289| [9826] Apache Subversion up to 1.8.0 mod_dav_svn denial of service
7290| [9683] Apache HTTP Server 2.4.5 mod_session_dbd denial of service
7291| [64485] Apache Struts up to 2.2.3.0 privilege escalation
7292| [9568] Apache Struts up to 2.3.15 DefaultActionMapper cross site request forgery
7293| [9567] Apache Struts up to 2.3.15 DefaultActionMapper memory corruption
7294| [64467] Apache Geronimo 3.0 memory corruption
7295| [64466] Apache OpenJPA up to 2.2.1 Serialization memory corruption
7296| [64457] Apache Struts up to 2.2.3.0 cross site scripting
7297| [64326] Alejandro Garza Apachesolr Autocomplete up to 7.x-1.1 cross site scripting
7298| [9184] Apache Qpid up to 0.20 SSL misconfiguration
7299| [8935] Apache Subversion up to 1.7.9 FSFS Format Repository denial of service
7300| [8934] Apache Subversion up to 1.7.9 Svnserve Server denial of service
7301| [8933] Apache Subversion up to 1.6.21 check-mime-type.pl svnlook memory corruption
7302| [8932] Apache Subversion up to 1.6.21 svn-keyword-check.pl svnlook changed memory corruption
7303| [9022] Apache Struts up to 2.3.14.2 OGNL Expression memory corruption
7304| [8873] Apache Struts 2.3.14 privilege escalation
7305| [8872] Apache Struts 2.3.14 privilege escalation
7306| [8746] Apache HTTP Server Log File Terminal Escape Sequence Filtering mod_rewrite.c do_rewritelog privilege escalation
7307| [8666] Apache Tomcat up to 7.0.32 AsyncListener information disclosure
7308| [8665] Apache Tomcat up to 7.0.29 Chunked Transfer Encoding Extension Size denial of service
7309| [8664] Apache Tomcat up to 7.0.32 FORM Authentication weak authentication
7310| [64075] Apache Subversion up to 1.7.7 mod_dav_svn Crash denial of service
7311| [64074] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
7312| [64073] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
7313| [64072] Apache Subversion up to 1.7.7 mod_dav_svn NULL Pointer Dereference denial of service
7314| [64071] Apache Subversion up to 1.7.8 mod_dav_svn Memory Consumption denial of service
7315| [8768] Apache Struts up to 2.3.14 on Mac EL and OGNL Interpreter memory corruption
7316| [64006] Apache ActiveMQ up to 5.7.0 denial of service
7317| [64005] Apache ActiveMQ up to 5.7.0 Default Configuration denial of service
7318| [64004] Apache ActiveMQ up to 5.7.0 PortfolioPublishServlet.java cross site scripting
7319| [8427] Apache Tomcat Session Transaction weak authentication
7320| [63960] Apache Maven 3.0.4 Default Configuration spoofing
7321| [63751] Apache qpid up to 0.20 qpid::framing::Buffer denial of service
7322| [63750] Apache qpid up to 0.20 checkAvailable denial of service
7323| [63749] Apache Qpid up to 0.20 Memory Consumption denial of service
7324| [63748] Apache Qpid up to 0.20 Default Configuration denial of service
7325| [63747] Apache Rave up to 0.20 User Account information disclosure
7326| [7889] Apache Subversion up to 1.6.17 mod_dav_svn/svn_fs_file_length() denial of service
7327| [63646] Apache HTTP Server up to 2.2.23/2.4.3 mod_proxy_balancer.c balancer_handler cross site scripting
7328| [7688] Apache CXF up to 2.7.1 WSS4JInterceptor Bypass weak authentication
7329| [7687] Apache CXF up to 2.7.2 Token weak authentication
7330| [63334] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
7331| [63299] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
7332| [7202] Apache HTTP Server 2.4.2 on Oracle Solaris ld_library_path cross site scripting
7333| [7075] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector NioEndpoint.java denial of service
7334| [7074] Apache Tomcat up to 6.0.35/7.0.29 FORM Authentication RealmBase.java weak authentication
7335| [7073] Apache Tomcat up to 6.0.35/7.0.31 CSRF Prevention Filter cross site request forgery
7336| [63090] Apache Tomcat up to 4.1.24 denial of service
7337| [63089] Apache HTTP Server up to 2.2.13 mod_proxy_ajp denial of service
7338| [62933] Apache Tomcat up to 5.5.0 Access Restriction unknown vulnerability
7339| [62929] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector Memory Consumption denial of service
7340| [62833] Apache CXF -/2.6.0 spoofing
7341| [62832] Apache Axis2 up to 1.6.2 spoofing
7342| [62831] Apache Axis up to 1.4 Java Message Service spoofing
7343| [62830] Apache Commons-httpclient 3.0 Payments spoofing
7344| [62826] Apache Libcloud up to 0.11.0 spoofing
7345| [62757] Apache Open For Business Project up to 10.04.0 unknown vulnerability
7346| [8830] Red Hat JBoss Enterprise Application Platform 6.0.1 org.apache.catalina.connector.Response.encodeURL information disclosure
7347| [62661] Apache Axis2 unknown vulnerability
7348| [62658] Apache Axis2 unknown vulnerability
7349| [62467] Apache Qpid up to 0.17 denial of service
7350| [62417] Apache CXF 2.4.7/2.4.8/2.5.3/2.5.4/2.6.1 spoofing
7351| [6301] Apache HTTP Server mod_pagespeed cross site scripting
7352| [6300] Apache HTTP Server mod_pagespeed Hostname information disclosure
7353| [6123] Apache Wicket up to 1.5.7 Ajax Link cross site scripting
7354| [62035] Apache Struts up to 2.3.4 denial of service
7355| [61916] Apache QPID 0.14/0.16/0.5/0.6 unknown vulnerability
7356| [6998] Apache Tomcat 5.5.35/6.0.35/7.0.28 DIGEST Authentication Session State Caching privilege escalation
7357| [6997] Apache Tomcat 5.5.35/6.0.35/7.0.28 HTTP Digest Authentication Implementation privilege escalation
7358| [6092] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_ajp.c information disclosure
7359| [6090] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_http.c information disclosure
7360| [61507] Apache POI up to 3.8 UnhandledDataStructure denial of service
7361| [6070] Apache Struts up to 2.3.4 Token Name Configuration Parameter privilege escalation
7362| [6069] Apache Struts up to 2.3.4 Request Parameter OGNL Expression denial of service
7363| [5764] Oracle Solaris 10 Apache HTTP Server information disclosure
7364| [5700] Oracle Secure Backup 10.3.0.3/10.4.0.1 Apache denial of service
7365| [61255] Apache Hadoop 2.0.0 Kerberos unknown vulnerability
7366| [61229] Apache Sling up to 2.1.1 denial of service
7367| [61152] Apache Commons-compress 1.0/1.1/1.2/1.3/1.4 denial of service
7368| [61094] Apache Roller up to 5.0 cross site scripting
7369| [61093] Apache Roller up to 5.0 cross site request forgery
7370| [61005] Apache OpenOffice 3.3/3.4 unknown vulnerability
7371| [9673] Apache HTTP Server up to 2.4.4 mod_dav mod_dav.c Request denial of service
7372| [5436] Apache OpenOffice 3.3/3.4 WPXContentListener.cpp _closeTableRow() File memory corruption
7373| [5435] Apache OpenOffice 3.3/3.4 vclmi.dll File memory corruption
7374| [60730] PHP 5.4.0/5.4.1/5.4.2 apache_request_headers memory corruption
7375| [60708] Apache Qpid 0.12 unknown vulnerability
7376| [5032] Apache Hadoop up to 0.20.205.0/1.0.1/0.23.1 Kerberos/MapReduce Security Feature privilege escalation
7377| [4949] Apache Struts File Upload XSLTResult.java XSLT File privilege escalation
7378| [4955] Apache Traffic Server 3.0.3/3.1.2 HTTP Header Parser memory corruption
7379| [4882] Apache Wicket up to 1.5.4 directory traversal
7380| [4881] Apache Wicket up to 1.4.19 cross site scripting
7381| [4884] Apache HTTP Server up to 2.3.6 mod_fcgid fcgid_spawn_ctl.c FcgidMaxProcessesPerClass HTTP Requests denial of service
7382| [60352] Apache Struts up to 2.2.3 memory corruption
7383| [60153] Apache Portable Runtime up to 1.4.3 denial of service
7384| [4598] Apache Struts 1.3.10 upload-submit.do cross site scripting
7385| [4597] Apache Struts 1.3.10 processSimple.do cross site scripting
7386| [4596] Apache Struts 2.0.14/2.2.3 struts2-rest-showcase/orders cross site scripting
7387| [4595] Apache Struts 2.0.14/2.2.3 struts2-showcase/person/editPerson.action cross site scripting
7388| [4583] Apache HTTP Server up to 2.2.21 Threaded MPM denial of service
7389| [4582] Apache HTTP Server up to 2.2.21 protocol.c information disclosure
7390| [4571] Apache Struts up to 2.3.1.2 privilege escalation
7391| [4557] Apache Tomcat up to 7.0.21 Caching/Recycling information disclosure
7392| [59934] Apache Tomcat up to 6.0.9 DigestAuthenticator.java unknown vulnerability
7393| [59933] Apache Tomcat up to 6.0.9 Access Restriction unknown vulnerability
7394| [59932] Apache Tomcat up to 6.0.9 unknown vulnerability
7395| [59931] Apache Tomcat up to 6.0.9 Access Restriction information disclosure
7396| [59902] Apache Struts up to 2.2.3 Interfaces unknown vulnerability
7397| [4528] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
7398| [4527] Apache Struts up to 2.2.3 ExceptionDelegator cross site scripting
7399| [59888] Apache Tomcat up to 6.0.6 denial of service
7400| [59886] Apache ActiveMQ up to 5.5.1 Crash denial of service
7401| [4513] Apache Struts up to 2.3.1 ParameterInterceptor directory traversal
7402| [4512] Apache Struts up to 2.2.3 CookieInterceptor command injection
7403| [59850] Apache Geronimo up to 2.2.1 denial of service
7404| [59825] Apache HTTP Server up to 2.1.7 mod_reqtimeout denial of service
7405| [59556] Apache HTTP Server up to 2.0.53 mod_proxy information disclosure
7406| [58467] Apache libcloud 0.2.0/0.3.0/0.3.1/0.4.0 Access Restriction spoofing
7407| [58413] Apache Tomcat up to 6.0.10 spoofing
7408| [58381] Apache Wicket up to 1.4.17 cross site scripting
7409| [58296] Apache Tomcat up to 7.0.19 unknown vulnerability
7410| [57888] Apache HttpClient 4.0/4.0.1/4.1 Authorization information disclosure
7411| [57587] Apache Subversion up to 1.6.16 mod_dav_svn information disclosure
7412| [57585] Apache Subversion up to 1.6.16 mod_dav_svn Memory Consumption denial of service
7413| [57584] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
7414| [57577] Apache Rampart-C 1.3.0 Access Restriction rampart_timestamp_token_validate privilege escalation
7415| [57568] Apache Archiva up to 1.3.4 cross site scripting
7416| [57567] Apache Archiva up to 1.3.4 cross site request forgery
7417| [57481] Apache Tomcat 7.0.12/7.0.13 Access Restriction unknown vulnerability
7418| [4355] Apache HTTP Server APR apr_fnmatch denial of service
7419| [57435] Apache Struts up to 2.2.1.1 FileHandler.java cross site scripting
7420| [57425] Apache Struts up to 2.2.1.1 cross site scripting
7421| [4352] Apache HTTP Server 2.2.x APR apr_fnmatch denial of service
7422| [57025] Apache Tomcat up to 7.0.11 information disclosure
7423| [57024] Apache Tomcat 7.0.11 Access Restriction information disclosure
7424| [56774] IBM WebSphere Application Server up to 7.0.0.14 org.apache.jasper.runtime.JspWriterImpl.response denial of service
7425| [56824] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
7426| [56832] Apache Tomcat up to 7.0.10 Access Restriction information disclosure
7427| [56830] Apache Tomcat up to 7.0.9 Access Restriction privilege escalation
7428| [12440] Apache Tomcat 6.0.33 Malicious Request cross site scripting
7429| [56512] Apache Continuum up to 1.4.0 cross site scripting
7430| [4285] Apache Tomcat 5.x JVM getLocale() denial of service
7431| [4284] Apache Tomcat 5.x HTML Manager cross site scripting
7432| [4283] Apache Tomcat 5.x ServletContect privilege escalation
7433| [56441] Apache Tomcat up to 7.0.6 denial of service
7434| [56300] Apache CouchDB up to 1.0.1 Web Administration Interface cross site scripting
7435| [55967] Apache Subversion up to 1.6.4 rev_hunt.c denial of service
7436| [55966] Apache Subversion up to 1.6.4 mod_dav_svn repos.c walk denial of service
7437| [55095] Apache Axis2 up to 1.6 Default Password memory corruption
7438| [55631] Apache Archiva up to 1.3.1 User Account cross site request forgery
7439| [55556] Apache Tomcat up to 6.0.29 Default Configuration information disclosure
7440| [55553] Apache Tomcat up to 7.0.4 sessionsList.jsp cross site scripting
7441| [55162] Apache MyFaces up to 2.0.0 Authentication Code unknown vulnerability
7442| [54881] Apache Subversion up to 1.6.12 mod_dav_svn authz.c privilege escalation
7443| [54879] Apache APR-util up to 0.9.14 mod_reqtimeout apr_brigade_split_line denial of service
7444| [54693] Apache Traffic Server DNS Cache unknown vulnerability
7445| [54416] Apache CouchDB up to 0.11.0 cross site request forgery
7446| [54394] Apache CXF up to 2.2.8 Memory Consumption denial of service
7447| [54261] Apache Tomcat jsp/cal/cal2.jsp cross site scripting
7448| [54166] Apache HTTP Server up to 2.2.12 mod_cache Crash denial of service
7449| [54385] Apache Struts up to 2.1.8.1 ParameterInterceptor unknown vulnerability
7450| [54012] Apache Tomcat up to 6.0.10 denial of service
7451| [53763] Apache Axis2 1.3/1.4/1.4.1/1.5/1.5.1 Memory Consumption denial of service
7452| [53368] Apache MyFaces 1.1.7/1.2.8 cross site scripting
7453| [53397] Apache axis2 1.4.1/1.5.1 Administration Console cross site scripting
7454| [52894] Apache Tomcat up to 6.0.7 information disclosure
7455| [52960] Apache ActiveMQ up to 5.4-snapshot information disclosure
7456| [52843] Apache HTTP Server mod_auth_shadow unknown vulnerability
7457| [52786] Apache Open For Business Project up to 09.04 cross site scripting
7458| [52587] Apache ActiveMQ up to 5.3.0 cross site request forgery
7459| [52586] Apache ActiveMQ up to 5.3.0 cross site scripting
7460| [52584] Apache CouchDB up to 0.10.1 information disclosure
7461| [51757] Apache HTTP Server 2.0.44 cross site scripting
7462| [51756] Apache HTTP Server 2.0.44 spoofing
7463| [51717] Apache HTTP Server up to 1.3.3 mod_proxy ap_proxy_send_fb memory corruption
7464| [51690] Apache Tomcat up to 6.0 directory traversal
7465| [51689] Apache Tomcat up to 6.0 information disclosure
7466| [51688] Apache Tomcat up to 6.0 directory traversal
7467| [50886] HP Operations Manager 8.10 on Windows File Upload org.apache.catalina.manager.HTMLManagerServlet memory corruption
7468| [50802] Apache Tomcat up to 3.3 Default Password weak authentication
7469| [50626] Apache Solr 1.0.0 cross site scripting
7470| [49857] Apache HTTP Server mod_proxy_ftp cross site scripting
7471| [49856] Apache HTTP Server 2.2.13 mod_proxy_ftp ap_proxy_ftp_handler denial of service
7472| [49348] Apache Xerces-C++ 2.7.0 Stack-Based denial of service
7473| [86789] Apache Portable Runtime memory/unix/apr_pools.c unknown vulnerability
7474| [49283] Apache APR-util up to 1.3.8 apr-util misc/apr_rmm.c apr_rmm_realloc memory corruption
7475| [48952] Apache HTTP Server up to 1.3.6 mod_deflate denial of service
7476| [48626] Apache Tomcat up to 4.1.23 Access Restriction directory traversal
7477| [48431] Apache Tomcat up to 4.1.23 j_security_check cross site scripting
7478| [48430] Apache Tomcat up to 4.1.23 mod_jk denial of service
7479| [47801] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site request forgery
7480| [47800] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site scripting
7481| [47799] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console directory traversal
7482| [47648] Apache Tiles 2.1.0/2.1.1 cross site scripting
7483| [47640] Apache Struts 2.0.11/2.0.6/2.0.8/2.0.9/2.1 cross site scripting
7484| [47638] Apache Tomcat up to 4.1.23 mod_jk information disclosure
7485| [47636] Apache Struts 2.0.9 xip_client.html cross site scripting
7486| [47593] Apache Mod Perl 1 perl-status Apache::Status cross site scripting
7487| [47637] Apache Struts 1.0.2/1.1/1.2.4/1.2.7/1.2.8 cross site scripting
7488| [47239] Apache Struts up to 2.1.2 Beta struts directory traversal
7489| [47214] Apachefriends xampp 1.6.8 spoofing
7490| [47213] Apachefriends xampp 1.6.8 htaccess cross site request forgery
7491| [47162] Apachefriends XAMPP 1.4.4 weak authentication
7492| [47065] Apache Tomcat 4.1.23 cross site scripting
7493| [46834] Apache Tomcat up to 5.5.20 cross site scripting
7494| [46004] Apache Jackrabbit 1.4/1.5.0 search.jsp cross site scripting
7495| [49205] Apache Roller 2.3/3.0/3.1/4.0 Search cross site scripting
7496| [86625] Apache Struts directory traversal
7497| [44461] Apache Tomcat up to 5.5.0 information disclosure
7498| [44389] Apache Xerces-C++ XML Parser Memory Consumption denial of service
7499| [44352] Apache Friends XAMPP 1.6.8 adodb.php cross site scripting
7500| [43663] Apache Tomcat up to 6.0.16 directory traversal
7501| [43612] Apache Friends XAMPP 1.6.7 iart.php cross site scripting
7502| [43556] Apache HTTP Server up to 2.1.8 mod_proxy_ftp proxy_ftp.c cross site scripting
7503| [43516] Apache Tomcat up to 4.1.20 directory traversal
7504| [43509] Apache Tomcat up to 6.0.13 cross site scripting
7505| [42637] Apache Tomcat up to 6.0.16 cross site scripting
7506| [42325] Apache HTTP Server up to 2.1.8 Error Page cross site scripting
7507| [41838] Apache-SSL 1.3.34 1.57 expandcert privilege escalation
7508| [41091] Apache Software Foundation Mod Jk up to 2.0.1 mod_jk2 Stack-based memory corruption
7509| [40924] Apache Tomcat up to 6.0.15 information disclosure
7510| [40923] Apache Tomcat up to 6.0.15 unknown vulnerability
7511| [40922] Apache Tomcat up to 6.0 information disclosure
7512| [40710] Apache HTTP Server up to 2.0.61 mod_negotiation cross site scripting
7513| [40709] Apache HTTP Server up to 2.0.53 mod_negotiation cross site scripting
7514| [40656] Apache Tomcat 5.5.20 information disclosure
7515| [40503] Apache HTTP Server mod_proxy_ftp cross site scripting
7516| [40502] Apache HTTP Server up to 2.2.5 mod_proxy_balancer memory corruption
7517| [40501] Apache HTTP Server 2.2.6 mod_proxy_balancer cross site request forgery
7518| [40398] Apache HTTP Server up to 2.2 mod_proxy_balancer cross site scripting
7519| [40397] Apache HTTP Server up to 2.2 mod_proxy_balancer balancer_handler denial of service
7520| [40234] Apache Tomcat up to 6.0.15 directory traversal
7521| [40221] Apache HTTP Server 2.2.6 information disclosure
7522| [40027] David Castro Apache Authcas 0.4 sql injection
7523| [3495] Apache OpenOffice up to 2.3 Database Document Processor Designfehler
7524| [3489] Apache HTTP Server 2.x HTTP Header cross site scripting
7525| [3414] Apache Tomcat WebDAV Stored Umgehungs-Angriff
7526| [39489] Apache Jakarta Slide up to 2.1 directory traversal
7527| [39540] Apache Geronimo 2.0/2.0.1/2.0.2/2.1 unknown vulnerability
7528| [3310] Apache OpenOffice 1.1.3/2.0.4/2.2.1 TIFF Image Parser Heap-based memory corruption
7529| [38768] Apache HTTP Server up to 2.1.7 mod_autoindex.c cross site scripting
7530| [38952] Apache Geronimo 2.0.1/2.1 unknown vulnerability
7531| [38658] Apache Tomcat 4.1.31 cal2.jsp cross site request forgery
7532| [38524] Apache Geronimo 2.0 unknown vulnerability
7533| [3256] Apache Tomcat up to 6.0.13 cross site scripting
7534| [38331] Apache Tomcat 4.1.24 information disclosure
7535| [38330] Apache Tomcat 4.1.24 information disclosure
7536| [38185] Apache Tomcat 3.3/3.3.1/3.3.1a/3.3.2 Error Message CookieExample cross site scripting
7537| [37967] Apache Tomcat up to 4.1.36 Error Message sendmail.jsp cross site scripting
7538| [37647] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 Authorization unknown vulnerability
7539| [37646] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 unknown vulnerability
7540| [3141] Apache Tomcat up to 4.1.31 Accept-Language Header cross site scripting
7541| [3133] Apache Tomcat up to 6.0 HTTP cross site scripting
7542| [37292] Apache Tomcat up to 5.5.1 cross site scripting
7543| [3130] Apache OpenOffice 2.2.1 RTF Document Heap-based memory corruption
7544| [36981] Apache Tomcat JK Web Server Connector up to 1.2.22 mod_jk directory traversal
7545| [36892] Apache Tomcat up to 4.0.0 hello.jsp cross site scripting
7546| [37320] Apache MyFaces Tomahawk up to 1.1.4 cross site scripting
7547| [36697] Apache Tomcat up to 5.5.17 implicit-objects.jsp cross site scripting
7548| [36491] Apache Axis 1.0 Installation javaioFileNotFoundException information disclosure
7549| [36400] Apache Tomcat 5.5.15 mod_jk cross site scripting
7550| [36698] Apache Tomcat up to 4.0.0 cal2.jsp cross site scripting
7551| [36224] XAMPP Apache Distribution up to 1.6.0a adodb.php connect memory corruption
7552| [36225] XAMPP Apache Distribution 1.6.0a sql injection
7553| [2997] Apache httpd/Tomcat 5.5/6.0 directory traversal
7554| [35896] Apache Apache Test up to 1.29 mod_perl denial of service
7555| [35653] Avaya S8300 Cm 3.1.2 Apache Tomcat unknown vulnerability
7556| [35402] Apache Tomcat JK Web Server Connector 1.2.19 mod_jk.so map_uri_to_worker memory corruption
7557| [35067] Apache Stats up to 0.0.2 extract unknown vulnerability
7558| [35025] Apache Stats up to 0.0.3 extract unknown vulnerability
7559| [34252] Apache HTTP Server denial of service
7560| [2795] Apache OpenOffice 2.0.4 WMF/EMF File Heap-based memory corruption
7561| [33877] Apache Opentaps 0.9.3 cross site scripting
7562| [33876] Apache Open For Business Project unknown vulnerability
7563| [33875] Apache Open For Business Project cross site scripting
7564| [2703] Apache Jakarta Tomcat up to 5.x der_get_oid() memory corruption
7565| [2611] Apache HTTP Server up to 1.0.1 set_var Format String
7566| [31827] XMB Extreme Message Board up to 1.9.6 Apache HTTP Server memcp.php directory traversal
7567| [2452] Apache HTTP Server up to 2.2.3 on Windows mod_alias unknown vulnerability
7568| [31663] vbPortal Apache HTTP Server index.php directory traversal
7569| [2414] Apache HTTP Server up to 2.2.3 mod_rewrite memory corruption
7570| [2393] Apache HTTP Server up to 2.2.2 HTTP Header cross site scripting
7571| [30623] Apache James 2.2.0 SMTP Server denial of service
7572| [30176] PHP-Fusion up to 6.00.306 Apache HTTP Server .php.gif privilege escalation
7573|
7574| MITRE CVE - https://cve.mitre.org:
7575| [CVE-2013-4156] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.
7576| [CVE-2013-4131] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.
7577| [CVE-2013-3239] phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
7578| [CVE-2013-3060] The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
7579| [CVE-2013-2765] The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
7580| [CVE-2013-2251] Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
7581| [CVE-2013-2249] mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.
7582| [CVE-2013-2248] Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
7583| [CVE-2013-2189] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.
7584| [CVE-2013-2135] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
7585| [CVE-2013-2134] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
7586| [CVE-2013-2115] Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
7587| [CVE-2013-2071] java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
7588| [CVE-2013-2067] java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
7589| [CVE-2013-1966] Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
7590| [CVE-2013-1965] Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
7591| [CVE-2013-1896] mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
7592| [CVE-2013-1884] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
7593| [CVE-2013-1879] Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
7594| [CVE-2013-1862] mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
7595| [CVE-2013-1849] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
7596| [CVE-2013-1847] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
7597| [CVE-2013-1846] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
7598| [CVE-2013-1845] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
7599| [CVE-2013-1814] The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
7600| [CVE-2013-1777] The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not property implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
7601| [CVE-2013-1768] The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
7602| [CVE-2013-1088] Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
7603| [CVE-2013-1048] The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
7604| [CVE-2013-0966] The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI.
7605| [CVE-2013-0942] Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
7606| [CVE-2013-0941] EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
7607| [CVE-2013-0253] The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
7608| [CVE-2013-0248] The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
7609| [CVE-2013-0239] Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
7610| [CVE-2012-6573] Cross-site scripting (XSS) vulnerability in the Apache Solr Autocomplete module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving autocomplete results.
7611| [CVE-2012-6551] The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
7612| [CVE-2012-6092] Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
7613| [CVE-2012-5887] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
7614| [CVE-2012-5886] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
7615| [CVE-2012-5885] The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
7616| [CVE-2012-5786] The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
7617| [CVE-2012-5785] Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
7618| [CVE-2012-5784] Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
7619| [CVE-2012-5783] Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
7620| [CVE-2012-5633] The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
7621| [CVE-2012-5616] Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
7622| [CVE-2012-5568] Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
7623| [CVE-2012-5351] Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
7624| [CVE-2012-4558] Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
7625| [CVE-2012-4557] The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
7626| [CVE-2012-4556] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
7627| [CVE-2012-4555] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
7628| [CVE-2012-4534] org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
7629| [CVE-2012-4528] The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
7630| [CVE-2012-4501] Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
7631| [CVE-2012-4460] The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
7632| [CVE-2012-4459] Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
7633| [CVE-2012-4458] The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
7634| [CVE-2012-4446] The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
7635| [CVE-2012-4431] org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
7636| [CVE-2012-4418] Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
7637| [CVE-2012-4387] Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
7638| [CVE-2012-4386] The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
7639| [CVE-2012-4360] Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
7640| [CVE-2012-4063] The Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying XML Signature transforms to documents, which allows remote attackers to cause a denial of service via unspecified vectors.
7641| [CVE-2012-4001] The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.
7642| [CVE-2012-3908] Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
7643| [CVE-2012-3546] org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
7644| [CVE-2012-3544] Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
7645| [CVE-2012-3526] The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
7646| [CVE-2012-3513] munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
7647| [CVE-2012-3506] Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
7648| [CVE-2012-3502] The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
7649| [CVE-2012-3499] Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
7650| [CVE-2012-3467] Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
7651| [CVE-2012-3451] Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
7652| [CVE-2012-3446] Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
7653| [CVE-2012-3376] DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
7654| [CVE-2012-3373] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
7655| [CVE-2012-3126] Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Apache Tomcat Agent.
7656| [CVE-2012-3123] Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, related to Apache HTTP Server.
7657| [CVE-2012-2760] mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.
7658| [CVE-2012-2733] java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
7659| [CVE-2012-2687] Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
7660| [CVE-2012-2381] Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
7661| [CVE-2012-2380] Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.
7662| [CVE-2012-2379] Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
7663| [CVE-2012-2378] Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
7664| [CVE-2012-2329] Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
7665| [CVE-2012-2145] Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
7666| [CVE-2012-2138] The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
7667| [CVE-2012-2098] Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
7668| [CVE-2012-1574] The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
7669| [CVE-2012-1181] fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
7670| [CVE-2012-1089] Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.
7671| [CVE-2012-1007] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
7672| [CVE-2012-1006] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
7673| [CVE-2012-0883] envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
7674| [CVE-2012-0840] tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
7675| [CVE-2012-0838] Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
7676| [CVE-2012-0788] The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
7677| [CVE-2012-0394] ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
7678| [CVE-2012-0393] The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
7679| [CVE-2012-0392] The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
7680| [CVE-2012-0391] The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
7681| [CVE-2012-0256] Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
7682| [CVE-2012-0216] The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
7683| [CVE-2012-0213] The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
7684| [CVE-2012-0053] protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
7685| [CVE-2012-0047] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.
7686| [CVE-2012-0031] scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
7687| [CVE-2012-0022] Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
7688| [CVE-2012-0021] The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
7689| [CVE-2011-5064] DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
7690| [CVE-2011-5063] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
7691| [CVE-2011-5062] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
7692| [CVE-2011-5057] Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
7693| [CVE-2011-5034] Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
7694| [CVE-2011-4905] Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.
7695| [CVE-2011-4858] Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
7696| [CVE-2011-4668] IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
7697| [CVE-2011-4449] actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
7698| [CVE-2011-4415] The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
7699| [CVE-2011-4317] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
7700| [CVE-2011-3639] The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
7701| [CVE-2011-3620] Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
7702| [CVE-2011-3607] Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
7703| [CVE-2011-3376] org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
7704| [CVE-2011-3375] Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
7705| [CVE-2011-3368] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
7706| [CVE-2011-3348] The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
7707| [CVE-2011-3192] The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
7708| [CVE-2011-3190] Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
7709| [CVE-2011-2729] native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
7710| [CVE-2011-2712] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
7711| [CVE-2011-2688] SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
7712| [CVE-2011-2526] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
7713| [CVE-2011-2516] Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
7714| [CVE-2011-2481] Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
7715| [CVE-2011-2329] The rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart/C 1.3.0 does not properly calculate the expiration of timestamp tokens, which allows remote attackers to bypass intended access restrictions by leveraging an expired token, a different vulnerability than CVE-2011-0730.
7716| [CVE-2011-2204] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
7717| [CVE-2011-2088] XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
7718| [CVE-2011-2087] Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
7719| [CVE-2011-1928] The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
7720| [CVE-2011-1921] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.
7721| [CVE-2011-1783] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.
7722| [CVE-2011-1772] Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
7723| [CVE-2011-1752] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.
7724| [CVE-2011-1610] Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
7725| [CVE-2011-1582] Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
7726| [CVE-2011-1571] Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
7727| [CVE-2011-1570] Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
7728| [CVE-2011-1503] The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
7729| [CVE-2011-1502] Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
7730| [CVE-2011-1498] Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
7731| [CVE-2011-1475] The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
7732| [CVE-2011-1419] Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
7733| [CVE-2011-1318] Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by accessing a JSP page of an application that is repeatedly stopped and restarted.
7734| [CVE-2011-1184] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
7735| [CVE-2011-1183] Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
7736| [CVE-2011-1176] The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
7737| [CVE-2011-1088] Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
7738| [CVE-2011-1077] Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
7739| [CVE-2011-1026] Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.
7740| [CVE-2011-0715] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
7741| [CVE-2011-0534] Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
7742| [CVE-2011-0533] Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta
7743| [CVE-2011-0419] Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
7744| [CVE-2011-0013] Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
7745| [CVE-2010-4644] Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.
7746| [CVE-2010-4539] The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
7747| [CVE-2010-4476] The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
7748| [CVE-2010-4455] Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.2 and 11.1.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Apache Plugin.
7749| [CVE-2010-4408] Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
7750| [CVE-2010-4312] The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
7751| [CVE-2010-4172] Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
7752| [CVE-2010-3872] The fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.6 for the Apache HTTP Server does not use bytewise pointer arithmetic in certain circumstances, which has unspecified impact and attack vectors related to "untrusted FastCGI applications" and a "stack buffer overwrite."
7753| [CVE-2010-3863] Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
7754| [CVE-2010-3854] Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
7755| [CVE-2010-3718] Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
7756| [CVE-2010-3449] Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1
7757| [CVE-2010-3315] authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
7758| [CVE-2010-3083] sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
7759| [CVE-2010-2952] Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.
7760| [CVE-2010-2791] mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
7761| [CVE-2010-2375] Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
7762| [CVE-2010-2234] Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
7763| [CVE-2010-2227] Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
7764| [CVE-2010-2103] Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
7765| [CVE-2010-2086] Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
7766| [CVE-2010-2076] Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
7767| [CVE-2010-2068] mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
7768| [CVE-2010-2057] shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
7769| [CVE-2010-1632] Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
7770| [CVE-2010-1623] Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
7771| [CVE-2010-1587] The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
7772| [CVE-2010-1452] The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
7773| [CVE-2010-1325] Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting. NOTE: some sources report that this is a vulnerability in a product named "Apache SLMS," but that is incorrect.
7774| [CVE-2010-1244] Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
7775| [CVE-2010-1157] Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
7776| [CVE-2010-1151] Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.
7777| [CVE-2010-0684] Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
7778| [CVE-2010-0434] The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
7779| [CVE-2010-0432] Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
7780| [CVE-2010-0425] modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
7781| [CVE-2010-0408] The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
7782| [CVE-2010-0390] Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions, allows remote attackers to execute arbitrary code by uploading a file with a pjpeg or jpeg extension, then accessing it via a direct request to the file in original/. NOTE: some of these details are obtained from third party information.
7783| [CVE-2010-0219] Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
7784| [CVE-2010-0010] Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
7785| [CVE-2010-0009] Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
7786| [CVE-2009-5120] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
7787| [CVE-2009-5119] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
7788| [CVE-2009-5006] The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote authenticated users to cause a denial of service (NULL pointer dereference, daemon crash, and cluster outage) by attempting to modify the alternate of an exchange.
7789| [CVE-2009-5005] The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.
7790| [CVE-2009-4355] Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
7791| [CVE-2009-4269] The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
7792| [CVE-2009-3923] The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.
7793| [CVE-2009-3890] Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.
7794| [CVE-2009-3843] HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
7795| [CVE-2009-3821] Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
7796| [CVE-2009-3555] The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
7797| [CVE-2009-3548] The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
7798| [CVE-2009-3250] The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.
7799| [CVE-2009-3095] The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
7800| [CVE-2009-3094] The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
7801| [CVE-2009-2902] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
7802| [CVE-2009-2901] The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
7803| [CVE-2009-2823] The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the HTTP TRACE method, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software.
7804| [CVE-2009-2699] The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
7805| [CVE-2009-2696] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
7806| [CVE-2009-2693] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
7807| [CVE-2009-2625] XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
7808| [CVE-2009-2412] Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR
7809| [CVE-2009-2299] The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
7810| [CVE-2009-1956] Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
7811| [CVE-2009-1955] The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
7812| [CVE-2009-1903] The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.
7813| [CVE-2009-1891] The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
7814| [CVE-2009-1890] The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
7815| [CVE-2009-1885] Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
7816| [CVE-2009-1462] The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.
7817| [CVE-2009-1275] Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
7818| [CVE-2009-1195] The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
7819| [CVE-2009-1191] mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
7820| [CVE-2009-1012] Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
7821| [CVE-2009-0918] Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
7822| [CVE-2009-0796] Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
7823| [CVE-2009-0783] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
7824| [CVE-2009-0781] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
7825| [CVE-2009-0754] PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
7826| [CVE-2009-0580] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
7827| [CVE-2009-0486] Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
7828| [CVE-2009-0039] Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
7829| [CVE-2009-0038] Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring
7830| [CVE-2009-0033] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
7831| [CVE-2009-0026] Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
7832| [CVE-2009-0023] The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
7833| [CVE-2008-6879] Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
7834| [CVE-2008-6755] ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.
7835| [CVE-2008-6722] Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.
7836| [CVE-2008-6682] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
7837| [CVE-2008-6505] Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
7838| [CVE-2008-6504] ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
7839| [CVE-2008-5696] Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the ApacheAdmin console, which allows remote attackers to reconfigure the Apache HTTP Server via console operations.
7840| [CVE-2008-5676] Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to "transformation caching."
7841| [CVE-2008-5519] The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
7842| [CVE-2008-5518] Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet)
7843| [CVE-2008-5515] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
7844| [CVE-2008-5457] Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
7845| [CVE-2008-4308] The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
7846| [CVE-2008-4008] Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
7847| [CVE-2008-3666] Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-dependent attackers to cause a denial of service (panic) via vectors involving creation of a crafted file and use of the sendfilev system call, as demonstrated by a file served by an Apache 2.2.x web server with EnableSendFile configured
7848| [CVE-2008-3271] Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
7849| [CVE-2008-3257] Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
7850| [CVE-2008-2939] Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
7851| [CVE-2008-2938] Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
7852| [CVE-2008-2742] Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory. NOTE: this is only a vulnerability in environments that support multiple extensions, such as Apache with the mod_mime module enabled.
7853| [CVE-2008-2717] TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
7854| [CVE-2008-2579] Unspecified vulnerability in the WebLogic Server Plugins for Apache, Sun and IIS web servers component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 has unknown impact and remote attack vectors.
7855| [CVE-2008-2384] SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
7856| [CVE-2008-2370] Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
7857| [CVE-2008-2364] The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
7858| [CVE-2008-2168] Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
7859| [CVE-2008-2025] Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
7860| [CVE-2008-1947] Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
7861| [CVE-2008-1734] Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.
7862| [CVE-2008-1678] Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
7863| [CVE-2008-1232] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
7864| [CVE-2008-0869] Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
7865| [CVE-2008-0732] The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
7866| [CVE-2008-0555] The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.
7867| [CVE-2008-0457] Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
7868| [CVE-2008-0456] CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
7869| [CVE-2008-0455] Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
7870| [CVE-2008-0128] The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
7871| [CVE-2008-0005] mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
7872| [CVE-2008-0002] Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
7873| [CVE-2007-6750] The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.
7874| [CVE-2007-6726] Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
7875| [CVE-2007-6514] Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive.
7876| [CVE-2007-6423] ** DISPUTED ** Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue.
7877| [CVE-2007-6422] The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.
7878| [CVE-2007-6421] Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
7879| [CVE-2007-6420] Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
7880| [CVE-2007-6388] Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
7881| [CVE-2007-6361] Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote attackers to read certain files under temp/, as demonstrated by a log file that records the titles of blog entries. NOTE: access to temp/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
7882| [CVE-2007-6342] SQL injection vulnerability in the David Castro AuthCAS module (AuthCAS.pm) 0.4 for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the SESSION_COOKIE_NAME (session ID) in a cookie.
7883| [CVE-2007-6286] Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
7884| [CVE-2007-6258] Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.
7885| [CVE-2007-6231] Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4) status_top_x.inc.php, or (5) libchart-1.1/libchart.php in include/. NOTE: access to include/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
7886| [CVE-2007-6203] Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
7887| [CVE-2007-5797] SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
7888| [CVE-2007-5731] Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
7889| [CVE-2007-5461] Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
7890| [CVE-2007-5342] The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
7891| [CVE-2007-5333] Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
7892| [CVE-2007-5156] Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
7893| [CVE-2007-5085] Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.
7894| [CVE-2007-5000] Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
7895| [CVE-2007-4724] Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
7896| [CVE-2007-4723] Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a "/...../" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.
7897| [CVE-2007-4641] Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting code into an Apache log file.
7898| [CVE-2007-4556] Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
7899| [CVE-2007-4548] The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
7900| [CVE-2007-4465] Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
7901| [CVE-2007-3847] The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
7902| [CVE-2007-3571] The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
7903| [CVE-2007-3386] Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
7904| [CVE-2007-3385] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
7905| [CVE-2007-3384] Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.
7906| [CVE-2007-3383] Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
7907| [CVE-2007-3382] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
7908| [CVE-2007-3304] Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
7909| [CVE-2007-3303] Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
7910| [CVE-2007-3101] Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.
7911| [CVE-2007-2450] Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
7912| [CVE-2007-2449] Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the '
7913| [CVE-2007-2353] Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
7914| [CVE-2007-2025] Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.
7915| [CVE-2007-1863] cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
7916| [CVE-2007-1862] The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.
7917| [CVE-2007-1860] mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
7918| [CVE-2007-1858] The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.
7919| [CVE-2007-1842] Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, a related issue to CVE-2006-2019.
7920| [CVE-2007-1801] Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by inc/lang.php.
7921| [CVE-2007-1743] suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.
7922| [CVE-2007-1742] suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
7923| [CVE-2007-1741] Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
7924| [CVE-2007-1720] Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
7925| [CVE-2007-1636] Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.
7926| [CVE-2007-1633] Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by bbcode_ref.php.
7927| [CVE-2007-1577] Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tplname] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
7928| [CVE-2007-1539] Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the module_name parameter, as demonstrated via a static PHP code injection attack in an Apache log file.
7929| [CVE-2007-1524] Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the settings[skin] parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via themes/default/.
7930| [CVE-2007-1491] Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties.
7931| [CVE-2007-1358] Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
7932| [CVE-2007-1349] PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
7933| [CVE-2007-0975] Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the _REQUEST superglobal array.
7934| [CVE-2007-0930] Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function.
7935| [CVE-2007-0792] The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
7936| [CVE-2007-0774] Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
7937| [CVE-2007-0637] Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the galeria parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by zd_numer.php.
7938| [CVE-2007-0451] Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
7939| [CVE-2007-0450] Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
7940| [CVE-2007-0419] The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
7941| [CVE-2007-0173] Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
7942| [CVE-2007-0098] Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
7943| [CVE-2007-0086] ** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
7944| [CVE-2006-7217] Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
7945| [CVE-2006-7216] Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
7946| [CVE-2006-7197] The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.
7947| [CVE-2006-7196] Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
7948| [CVE-2006-7195] Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
7949| [CVE-2006-7098] The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.
7950| [CVE-2006-6869] Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang cookie to error.php, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
7951| [CVE-2006-6675] Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecifeid parameters in Welcome web-app.
7952| [CVE-2006-6613] Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_lang[include_file] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
7953| [CVE-2006-6589] Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCH_STRING parameter, a different issue than CVE-2006-6587. NOTE: some of these details are obtained from third party information.
7954| [CVE-2006-6588] The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown impact.
7955| [CVE-2006-6587] Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
7956| [CVE-2006-6445] Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
7957| [CVE-2006-6071] TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
7958| [CVE-2006-6047] Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
7959| [CVE-2006-5894] Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by lang.php.
7960| [CVE-2006-5752] Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.
7961| [CVE-2006-5733] Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
7962| [CVE-2006-5263] Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter, as demonstrated by a parameter value naming an Apache HTTP Server log file that apparently contains PHP code.
7963| [CVE-2006-4994] Multiple unquoted Windows search path vulnerabilities in Apache Friends XAMPP 1.5.2 might allow local users to gain privileges via a malicious program file in %SYSTEMDRIVE%, which is run when XAMPP attempts to execute (1) FileZillaServer.exe, (2) mysqld-nt.exe, (3) Perl.exe, or (4) xamppcontrol.exe with an unquoted "Program Files" pathname.
7964| [CVE-2006-4636] Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
7965| [CVE-2006-4625] PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
7966| [CVE-2006-4558] DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
7967| [CVE-2006-4191] Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by header.php.
7968| [CVE-2006-4154] Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.
7969| [CVE-2006-4110] Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.
7970| [CVE-2006-4004] Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
7971| [CVE-2006-3918] http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
7972| [CVE-2006-3835] Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (
7973| [CVE-2006-3747] Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
7974| [CVE-2006-3362] Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
7975| [CVE-2006-3102] Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles directory.
7976| [CVE-2006-3070] write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
7977| [CVE-2006-2831] Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
7978| [CVE-2006-2806] The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.
7979| [CVE-2006-2743] Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.
7980| [CVE-2006-2514] Coppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.
7981| [CVE-2006-2330] PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
7982| [CVE-2006-1777] Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.
7983| [CVE-2006-1564] Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory.
7984| [CVE-2006-1548] Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
7985| [CVE-2006-1547] ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
7986| [CVE-2006-1546] Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
7987| [CVE-2006-1393] Multiple cross-site scripting (XSS) vulnerabilities in the mod_pubcookie Apache application server module in University of Washington Pubcookie 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.
7988| [CVE-2006-1346] Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang[*][file] parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by index.php.
7989| [CVE-2006-1292] Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.
7990| [CVE-2006-1243] Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included using install05.php.
7991| [CVE-2006-1095] Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
7992| [CVE-2006-1079] htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
7993| [CVE-2006-1078] Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
7994| [CVE-2006-0743] Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
7995| [CVE-2006-0254] Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
7996| [CVE-2006-0150] Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
7997| [CVE-2006-0144] The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
7998| [CVE-2006-0042] Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.
7999| [CVE-2005-4857] eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error".
8000| [CVE-2005-4849] Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
8001| [CVE-2005-4836] The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
8002| [CVE-2005-4814] Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory.
8003| [CVE-2005-4703] Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
8004| [CVE-2005-3745] Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
8005| [CVE-2005-3630] Fedora Directory Server before 10 allows remote attackers to obtain sensitive information, such as the password from adm.conf via an IFRAME element, probably involving an Apache httpd.conf configuration that orders "allow" directives before "deny" directives.
8006| [CVE-2005-3510] Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
8007| [CVE-2005-3392] Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.
8008| [CVE-2005-3357] mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
8009| [CVE-2005-3352] Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
8010| [CVE-2005-3319] The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
8011| [CVE-2005-3164] The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
8012| [CVE-2005-2970] Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.
8013| [CVE-2005-2963] The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.
8014| [CVE-2005-2728] The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
8015| [CVE-2005-2660] apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
8016| [CVE-2005-2088] The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
8017| [CVE-2005-1754] ** DISPUTED ** JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
8018| [CVE-2005-1753] ** DISPUTED ** ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
8019| [CVE-2005-1344] Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
8020| [CVE-2005-1268] Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
8021| [CVE-2005-1266] Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.
8022| [CVE-2005-0808] Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
8023| [CVE-2005-0182] The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.
8024| [CVE-2005-0108] Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.
8025| [CVE-2004-2734] webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
8026| [CVE-2004-2680] mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.
8027| [CVE-2004-2650] Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
8028| [CVE-2004-2343] ** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.
8029| [CVE-2004-2336] Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
8030| [CVE-2004-2115] Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
8031| [CVE-2004-1834] mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.
8032| [CVE-2004-1765] Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.
8033| [CVE-2004-1545] UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.hwp, which allows remote attackers to upload and execute arbitrary code.
8034| [CVE-2004-1438] The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.
8035| [CVE-2004-1405] MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
8036| [CVE-2004-1404] Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
8037| [CVE-2004-1387] The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
8038| [CVE-2004-1084] Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles.
8039| [CVE-2004-1083] Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
8040| [CVE-2004-1082] mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
8041| [CVE-2004-0942] Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.
8042| [CVE-2004-0940] Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
8043| [CVE-2004-0885] The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
8044| [CVE-2004-0811] Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.
8045| [CVE-2004-0809] The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
8046| [CVE-2004-0786] The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
8047| [CVE-2004-0751] The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).
8048| [CVE-2004-0748] mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.
8049| [CVE-2004-0747] Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.
8050| [CVE-2004-0700] Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
8051| [CVE-2004-0646] Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod_jrun and (2) mod_jrun20 for Apache, with verbose logging enabled, allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.
8052| [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
8053| [CVE-2004-0493] The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
8054| [CVE-2004-0492] Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
8055| [CVE-2004-0490] cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
8056| [CVE-2004-0488] Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
8057| [CVE-2004-0263] PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.
8058| [CVE-2004-0174] Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."
8059| [CVE-2004-0173] Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.
8060| [CVE-2004-0113] Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
8061| [CVE-2004-0009] Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user.
8062| [CVE-2003-1581] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
8063| [CVE-2003-1580] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
8064| [CVE-2003-1573] The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
8065| [CVE-2003-1521] Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
8066| [CVE-2003-1516] The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
8067| [CVE-2003-1502] mod_throttle 3.0 allows local users with Apache privileges to access shared memory that points to a file that is writable by the apache user, which could allow local users to gain privileges.
8068| [CVE-2003-1418] Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child proccess IDs (PID).
8069| [CVE-2003-1307] ** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP."
8070| [CVE-2003-1172] Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
8071| [CVE-2003-1171] Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data.
8072| [CVE-2003-1138] The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).
8073| [CVE-2003-1054] mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname, as parsed by the ap_parse_uri_components function in Apache, which triggers a null dereference.
8074| [CVE-2003-0993] mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
8075| [CVE-2003-0987] mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
8076| [CVE-2003-0866] The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
8077| [CVE-2003-0844] mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
8078| [CVE-2003-0843] Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode and using the Apache log, allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header.
8079| [CVE-2003-0789] mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.
8080| [CVE-2003-0771] Gallery.pm in Apache::Gallery (aka A::G) uses predictable temporary filenames when running Inline::C, which allows local users to execute arbitrary code by creating and modifying the files before Apache::Gallery does.
8081| [CVE-2003-0658] Docview before 1.1-18 in Caldera OpenLinux 3.1.1, SCO Linux 4.0, OpenServer 5.0.7, configures the Apache web server in a way that allows remote attackers to read arbitrary publicly readable files via a certain URL, possibly related to rewrite rules.
8082| [CVE-2003-0542] Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.
8083| [CVE-2003-0460] The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.
8084| [CVE-2003-0254] Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.
8085| [CVE-2003-0253] The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.
8086| [CVE-2003-0249] ** DISPUTED ** PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report."
8087| [CVE-2003-0245] Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.
8088| [CVE-2003-0192] Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.
8089| [CVE-2003-0189] The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.
8090| [CVE-2003-0134] Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.
8091| [CVE-2003-0132] A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
8092| [CVE-2003-0083] Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
8093| [CVE-2003-0020] Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.
8094| [CVE-2003-0017] Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
8095| [CVE-2003-0016] Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
8096| [CVE-2002-2310] ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than Apache, which allows remote attackers to obtain usernames and passwords.
8097| [CVE-2002-2309] php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
8098| [CVE-2002-2272] Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
8099| [CVE-2002-2103] Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
8100| [CVE-2002-2029] PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
8101| [CVE-2002-2012] Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
8102| [CVE-2002-2009] Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
8103| [CVE-2002-2008] Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
8104| [CVE-2002-2007] The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
8105| [CVE-2002-2006] The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
8106| [CVE-2002-1895] The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
8107| [CVE-2002-1850] mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
8108| [CVE-2002-1793] HTTP Server mod_ssl module running on HP-UX 11.04 with Virtualvault OS (VVOS) 4.5 through 4.6 closes the connection when the Apache server times out during an SSL request, which may allow attackers to cause a denial of service.
8109| [CVE-2002-1658] Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
8110| [CVE-2002-1635] The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
8111| [CVE-2002-1593] mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.
8112| [CVE-2002-1592] The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
8113| [CVE-2002-1567] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
8114| [CVE-2002-1394] Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
8115| [CVE-2002-1233] A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
8116| [CVE-2002-1157] Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
8117| [CVE-2002-1156] Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
8118| [CVE-2002-1148] The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
8119| [CVE-2002-0935] Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
8120| [CVE-2002-0843] Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
8121| [CVE-2002-0840] Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
8122| [CVE-2002-0839] The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
8123| [CVE-2002-0682] Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
8124| [CVE-2002-0661] Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
8125| [CVE-2002-0658] OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.
8126| [CVE-2002-0654] Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
8127| [CVE-2002-0653] Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
8128| [CVE-2002-0513] The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
8129| [CVE-2002-0493] Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
8130| [CVE-2002-0392] Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
8131| [CVE-2002-0259] InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache directory, or (2) mplog.txt, which could allow local users to gain privileges.
8132| [CVE-2002-0249] PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.
8133| [CVE-2002-0240] PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
8134| [CVE-2002-0082] The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
8135| [CVE-2002-0061] Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
8136| [CVE-2001-1556] The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
8137| [CVE-2001-1534] mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
8138| [CVE-2001-1510] Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
8139| [CVE-2001-1449] The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
8140| [CVE-2001-1385] The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
8141| [CVE-2001-1342] Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.
8142| [CVE-2001-1217] Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
8143| [CVE-2001-1216] Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
8144| [CVE-2001-1072] Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.
8145| [CVE-2001-1013] Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
8146| [CVE-2001-0925] The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
8147| [CVE-2001-0829] A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
8148| [CVE-2001-0766] Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.
8149| [CVE-2001-0731] Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.
8150| [CVE-2001-0730] split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header.
8151| [CVE-2001-0729] Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash) characters.
8152| [CVE-2001-0590] Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
8153| [CVE-2001-0131] htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
8154| [CVE-2001-0108] PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
8155| [CVE-2001-0042] PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequences.
8156| [CVE-2000-1247] The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.
8157| [CVE-2000-1210] Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
8158| [CVE-2000-1206] Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
8159| [CVE-2000-1205] Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.
8160| [CVE-2000-1204] Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root.
8161| [CVE-2000-1168] IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.
8162| [CVE-2000-1016] The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL.
8163| [CVE-2000-0913] mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.
8164| [CVE-2000-0883] The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory.
8165| [CVE-2000-0869] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary diretories via the PROPFIND HTTP request method.
8166| [CVE-2000-0868] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/.
8167| [CVE-2000-0791] Trustix installs the httpsd program for Apache-SSL with world-writeable permissions, which allows local users to replace it with a Trojan horse.
8168| [CVE-2000-0760] The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
8169| [CVE-2000-0759] Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
8170| [CVE-2000-0628] The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files.
8171| [CVE-2000-0505] The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
8172| [CVE-1999-1412] A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.
8173| [CVE-1999-1293] mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
8174| [CVE-1999-1237] Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
8175| [CVE-1999-1199] Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.
8176| [CVE-1999-1053] guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
8177| [CVE-1999-0926] Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
8178| [CVE-1999-0678] A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.
8179| [CVE-1999-0448] IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.
8180| [CVE-1999-0289] The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL.
8181| [CVE-1999-0236] ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
8182| [CVE-1999-0107] Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.
8183| [CVE-1999-0071] Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.
8184|
8185| SecurityFocus - https://www.securityfocus.com/bid/:
8186| [104554] Apache HBase CVE-2018-8025 Security Bypass Vulnerability
8187| [104465] Apache Geode CVE-2017-15695 Remote Code Execution Vulnerability
8188| [104418] Apache Storm CVE-2018-8008 Arbitrary File Write Vulnerability
8189| [104399] Apache Storm CVE-2018-1332 User Impersonation Vulnerability
8190| [104348] Apache UIMA CVE-2017-15691 XML External Entity Injection Vulnerability
8191| [104313] Apache NiFi XML External Entity Injection and Denial of Service Vulnerability
8192| [104259] Apache Geode CVE-2017-12622 Authorization Bypass Vulnerability
8193| [104257] Apache Sling XSS Protection API CVE-2017-15717 Cross Site Scripting Vulnerability
8194| [104253] Apache ZooKeeper CVE-2018-8012 Security Bypass Vulnerability
8195| [104252] Apache Batik CVE-2018-8013 Information Disclosure Vulnerability
8196| [104239] Apache Solr CVE-2018-8010 XML External Entity Multiple Information Disclosure Vulnerabilities
8197| [104215] Apache ORC CVE-2018-8015 Denial of Service Vulnerability
8198| [104203] Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability
8199| [104161] Apache Ambari CVE-2018-8003 Directory Traversal Vulnerability
8200| [104140] Apache Derby CVE-2018-1313 Security Bypass Vulnerability
8201| [104135] Apache Tika CVE-2018-1338 Denial of Service Vulnerability
8202| [104008] Apache Fineract CVE-2018-1291 SQL Injection Vulnerability
8203| [104007] Apache Fineract CVE-2018-1292 SQL Injection Vulnerability
8204| [104005] Apache Fineract CVE-2018-1289 SQL Injection Vulnerability
8205| [104001] Apache Tika CVE-2018-1335 Remote Command Injection Vulnerability
8206| [103975] Apache Fineract CVE-2018-1290 SQL Injection Vulnerability
8207| [103974] Apache Solr CVE-2018-1308 XML External Entity Injection Vulnerability
8208| [103772] Apache Traffic Server CVE-2017-7671 Denial of Service Vulnerability
8209| [103770] Apache Traffic Server CVE-2017-5660 Security Bypass Vulnerability
8210| [103751] Apache Hive CVE-2018-1282 SQL Injection Vulnerability
8211| [103750] Apache Hive CVE-2018-1284 Security Bypass Vulnerability
8212| [103692] Apache Ignite CVE-2018-1295 Arbitrary Code Execution Vulnerability
8213| [103528] Apache HTTP Server CVE-2018-1302 Denial of Service Vulnerability
8214| [103525] Apache HTTP Server CVE-2017-15715 Remote Security Bypass Vulnerability
8215| [103524] Apache HTTP Server CVE-2018-1312 Remote Security Bypass Vulnerability
8216| [103522] Apache HTTP Server CVE-2018-1303 Denial of Service Vulnerability
8217| [103520] Apache HTTP Server CVE-2018-1283 Remote Security Vulnerability
8218| [103516] Apache Struts CVE-2018-1327 Denial of Service Vulnerability
8219| [103515] Apache HTTP Server CVE-2018-1301 Denial of Service Vulnerability
8220| [103512] Apache HTTP Server CVE-2017-15710 Denial of Service Vulnerability
8221| [103508] Apache Syncope CVE-2018-1321 Multiple Remote Code Execution Vulnerabilities
8222| [103507] Apache Syncope CVE-2018-1322 Multiple Information Disclosure Vulnerabilities
8223| [103490] Apache Commons Compress CVE-2018-1324 Multiple Denial Of Service Vulnerabilities
8224| [103434] APACHE Allura CVE-2018-1319 HTTP Response Splitting Vulnerability
8225| [103389] Apache Tomcat JK Connector CVE-2018-1323 Directory Traversal Vulnerability
8226| [103222] Apache CloudStack CVE-2013-4317 Information Disclosure Vulnerability
8227| [103219] Apache Xerces-C CVE-2017-12627 Null Pointer Dereference Denial of Service Vulnerability
8228| [103206] Apache Geode CVE-2017-15693 Remote Code Execution Vulnerability
8229| [103205] Apache Geode CVE-2017-15692 Remote Code Execution Vulnerability
8230| [103170] Apache Tomcat CVE-2018-1304 Security Bypass Vulnerability
8231| [103144] Apache Tomcat CVE-2018-1305 Security Bypass Vulnerability
8232| [103102] Apache Oozie CVE-2017-15712 Information Disclosure Vulnerability
8233| [103098] Apache Karaf CVE-2016-8750 LDAP Injection Vulnerability
8234| [103069] Apache Tomcat CVE-2017-15706 Remote Security Weakness
8235| [103068] Apache JMeter CVE-2018-1287 Security Bypass Vulnerability
8236| [103067] Apache Qpid Dispatch Router 'router_core/connections.c' Denial of Service Vulnerability
8237| [103036] Apache CouchDB CVE-2017-12636 Remote Code Execution Vulnerability
8238| [103025] Apache Thrift CVE-2016-5397 Remote Command Injection Vulnerability
8239| [102879] Apache POI CVE-2017-12626 Multiple Denial of Service Vulnerabilities
8240| [102842] Apache NiFi CVE-2017-12632 Host Header Injection Vulnerability
8241| [102815] Apache NiFi CVE-2017-15697 Multiple Cross Site Scripting Vulnerabilities
8242| [102488] Apache Geode CVE-2017-9795 Remote Code Execution Vulnerability
8243| [102229] Apache Sling CVE-2017-15700 Information Disclosure Vulnerability
8244| [102226] Apache Drill CVE-2017-12630 Cross Site Scripting Vulnerability
8245| [102154] Multiple Apache Products CVE-2017-15708 Remote Code Execution Vulnerability
8246| [102127] Apache CXF Fediz CVE-2017-12631 Multiple Cross Site Request Forgery Vulnerabilities
8247| [102041] Apache Qpid Broker-J CVE-2017-15701 Denial of Service Vulnerability
8248| [102040] Apache Qpid Broker CVE-2017-15702 Security Weakness
8249| [102021] Apache Struts CVE-2017-15707 Denial of Service Vulnerability
8250| [101980] EMC RSA Authentication Agent for Web: Apache Web Server Authentication Bypass Vulnerability
8251| [101876] Apache Camel CVE-2017-12634 Deserialization Remote Code Execution Vulnerability
8252| [101874] Apache Camel CVE-2017-12633 Deserialization Remote Code Execution Vulnerability
8253| [101872] Apache Karaf CVE-2014-0219 Local Denial of Service Vulnerability
8254| [101868] Apache CouchDB CVE-2017-12635 Remote Privilege Escalation Vulnerability
8255| [101859] Apache CXF CVE-2017-12624 Denial of Service Vulnerability
8256| [101844] Apache Sling Servlets Post CVE-2017-11296 Cross Site Scripting Vulnerability
8257| [101686] Apache Hive CVE-2017-12625 Information Disclosure Vulnerability
8258| [101644] Apache Wicket CVE-2012-5636 Cross Site Scripting Vulnerability
8259| [101631] Apache Traffic Server CVE-2015-3249 Multiple Remote Code Execution Vulnerabilities
8260| [101630] Apache Traffic Server CVE-2014-3624 Access Bypass Vulnerability
8261| [101625] Apache jUDDI CVE-2009-1197 Security Bypass Vulnerability
8262| [101623] Apache jUDDI CVE-2009-1198 Cross Site Scripting Vulnerability
8263| [101620] Apache Subversion 'libsvn_fs_fs/fs_fs.c' Denial of Service Vulnerability
8264| [101585] Apache OpenOffice Multiple Remote Code Execution Vulnerabilities
8265| [101577] Apache Wicket CVE-2016-6806 Cross Site Request Forgery Vulnerability
8266| [101575] Apache Wicket CVE-2014-0043 Information Disclosure Vulnerability
8267| [101570] Apache Geode CVE-2017-9797 Information Disclosure Vulnerability
8268| [101562] Apache Derby CVE-2010-2232 Arbitrary File Overwrite Vulnerability
8269| [101560] Apache Portable Runtime Utility CVE-2017-12613 Multiple Information Disclosure Vulnerabilities
8270| [101558] Apache Portable Runtime Utility Local Out-of-Bounds Read Denial of Service Vulnerability
8271| [101532] Apache James CVE-2017-12628 Arbitrary Command Execution Vulnerability
8272| [101516] Apache HTTP Server CVE-2017-12171 Security Bypass Vulnerability
8273| [101261] Apache Solr/Lucene CVE-2017-12629 Information Disclosure and Remote Code Execution Vulnerabilities
8274| [101230] Apache Roller CVE-2014-0030 XML External Entity Injection Vulnerability
8275| [101173] Apache IMPALA CVE-2017-9792 Information Disclosure Vulnerability
8276| [101052] Apache Commons Jelly CVE-2017-12621 Security Bypass Vulnerability
8277| [101027] Apache Mesos CVE-2017-7687 Denial of Service Vulnerability
8278| [101023] Apache Mesos CVE-2017-9790 Denial of Service Vulnerability
8279| [100954] Apache Tomcat CVE-2017-12617 Incomplete Fix Remote Code Execution Vulnerability
8280| [100946] Apache Wicket CVE-2014-7808 Cross Site Request Forgery Vulnerability
8281| [100901] Apache Tomcat CVE-2017-12615 Remote Code Execution Vulnerability
8282| [100897] Apache Tomcat CVE-2017-12616 Information Disclosure Vulnerability
8283| [100880] Apache Directory LDAP API CVE-2015-3250 Unspecified Information Disclosure Vulnerability
8284| [100872] Apache HTTP Server CVE-2017-9798 Information Disclosure Vulnerability
8285| [100870] Apache Solr CVE-2017-9803 Remote Privilege Escalation Vulnerability
8286| [100859] puppetlabs-apache CVE-2017-2299 Information Disclosure Vulnerability
8287| [100829] Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability
8288| [100823] Apache Spark CVE-2017-12612 Deserialization Remote Code Execution Vulnerability
8289| [100612] Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability
8290| [100611] Apache Struts CVE-2017-9793 Denial of Service Vulnerability
8291| [100609] Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability
8292| [100587] Apache Atlas CVE-2017-3155 Cross Frame Scripting Vulnerability
8293| [100581] Apache Atlas CVE-2017-3154 Information Disclosure Vulnerability
8294| [100578] Apache Atlas CVE-2017-3153 Cross Site Scripting Vulnerability
8295| [100577] Apache Atlas CVE-2017-3152 Cross Site Scripting Vulnerability
8296| [100547] Apache Atlas CVE-2017-3151 HTML Injection Vulnerability
8297| [100536] Apache Atlas CVE-2017-3150 Cross Site Scripting Vulnerability
8298| [100449] Apache Pony Mail CVE-2016-4460 Authentication Bypass Vulnerability
8299| [100447] Apache2Triad Multiple Security Vulnerabilities
8300| [100284] Apache Sling Servlets Post CVE-2017-9802 Cross Site Scripting Vulnerability
8301| [100280] Apache Tomcat CVE-2017-7674 Security Bypass Vulnerability
8302| [100259] Apache Subversion CVE-2017-9800 Remote Command Execution Vulnerability
8303| [100256] Apache Tomcat CVE-2017-7675 Directory Traversal Vulnerability
8304| [100235] Apache Storm CVE-2017-9799 Remote Code Execution Vulnerability
8305| [100082] Apache Commons Email CVE-2017-9801 SMTP Header Injection Vulnerability
8306| [99873] Apache Sling XSS Protection API CVE-2016-6798 XML External Entity Injection Vulnerability
8307| [99870] Apache Sling API CVE-2016-5394 Cross Site Scripting Vulnerability
8308| [99603] Apache Spark CVE-2017-7678 Cross Site Scripting Vulnerability
8309| [99592] Apache OpenMeetings CVE-2017-7685 Security Bypass Vulnerability
8310| [99587] Apache OpenMeetings CVE-2017-7673 Security Bypass Vulnerability
8311| [99586] Apache OpenMeetings CVE-2017-7688 Security Bypass Vulnerability
8312| [99584] Apache OpenMeetings CVE-2017-7684 Denial of Service Vulnerability
8313| [99577] Apache OpenMeetings CVE-2017-7663 Cross Site Scripting Vulnerability
8314| [99576] Apache OpenMeetings CVE-2017-7664 XML External Entity Injection Vulnerability
8315| [99569] Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability
8316| [99568] Apache HTTP Server CVE-2017-9789 Denial of Service Vulnerability
8317| [99563] Apache Struts CVE-2017-7672 Denial of Service Vulnerability
8318| [99562] Apache Struts Spring AOP Functionality Denial of Service Vulnerability
8319| [99509] Apache Impala CVE-2017-5652 Information Disclosure Vulnerability
8320| [99508] Apache IMPALA CVE-2017-5640 Authentication Bypass Vulnerability
8321| [99486] Apache Traffic Control CVE-2017-7670 Denial of Service Vulnerability
8322| [99485] Apache Solr CVE-2017-7660 Security Bypass Vulnerability
8323| [99484] Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability
8324| [99292] Apache Ignite CVE-2017-7686 Information Disclosure Vulnerability
8325| [99170] Apache HTTP Server CVE-2017-7679 Buffer Overflow Vulnerability
8326| [99137] Apache HTTP Server CVE-2017-7668 Denial of Service Vulnerability
8327| [99135] Apache HTTP Server CVE-2017-3167 Authentication Bypass Vulnerability
8328| [99134] Apache HTTP Server CVE-2017-3169 Denial of Service Vulnerability
8329| [99132] Apache HTTP Server CVE-2017-7659 Denial of Service Vulnerability
8330| [99112] Apache Thrift CVE-2015-3254 Denial of Service Vulnerability
8331| [99067] Apache Ranger CVE-2016-8751 HTML Injection Vulnerability
8332| [99018] Apache NiFi CVE-2017-7667 Cross Frame Scripting Vulnerability
8333| [99009] Apache NiFi CVE-2017-7665 Cross Site Scripting Vulnerability
8334| [98961] Apache Ranger CVE-2017-7677 Security Bypass Vulnerability
8335| [98958] Apache Ranger CVE-2017-7676 Security Bypass Vulnerability
8336| [98888] Apache Tomcat CVE-2017-5664 Security Bypass Vulnerability
8337| [98814] Apache Zookeeper CVE-2017-5637 Denial of Service Vulnerability
8338| [98795] Apache Hadoop CVE-2017-7669 Remote Privilege Escalation Vulnerability
8339| [98739] Apache Knox CVE-2017-5646 User Impersonation Vulnerability
8340| [98669] Apache Hive CVE-2016-3083 Security Bypass Vulnerability
8341| [98646] Apache Atlas CVE-2016-8752 Information Disclosure Vulnerability
8342| [98570] Apache Archiva CVE-2017-5657 Multiple Cross-Site Request Forgery Vulnerabilities
8343| [98489] Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities
8344| [98485] Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability
8345| [98466] Apache Ambari CVE-2017-5655 Insecure Temporary File Handling Vulnerability
8346| [98365] Apache Cordova For Android CVE-2016-6799 Information Disclosure Vulnerability
8347| [98025] Apache Hadoop CVE-2017-3161 Cross Site Scripting Vulnerability
8348| [98017] Apache Hadoop CVE-2017-3162 Input Validation Vulnerability
8349| [97971] Apache CXF CVE-2017-5656 Information Disclosure Vulnerability
8350| [97968] Apache CXF CVE-2017-5653 Spoofing Vulnerability
8351| [97967] Apache ActiveMQ CVE-2015-7559 Denial of Service Vulnerability
8352| [97949] Apache Traffic Server CVE-2017-5659 Denial of Service Vulnerability
8353| [97948] Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability
8354| [97947] Apache FOP CVE-2017-5661 XML External Entity Information Disclosure Vulnerability
8355| [97945] Apache Traffic Server CVE-2016-5396 Denial of Service Vulnerability
8356| [97702] Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability
8357| [97582] Apache CXF CVE-2016-6812 Cross Site Scripting Vulnerability
8358| [97579] Apache CXF JAX-RS CVE-2016-8739 XML External Entity Injection Vulnerability
8359| [97544] Apache Tomcat CVE-2017-5651 Information Disclosure Vulnerability
8360| [97531] Apache Tomcat CVE-2017-5650 Denial of Service Vulnerability
8361| [97530] Apache Tomcat CVE-2017-5648 Information Disclosure Vulnerability
8362| [97509] Apache Ignite CVE-2016-6805 Information Disclosure and XML External Entity Injection Vulnerabilities
8363| [97383] Apache Flex BlazeDS CVE-2017-5641 Remote Code Execution Vulnerability
8364| [97378] Apache Geode CVE-2017-5649 Information Disclosure Vulnerability
8365| [97229] Apache Ambari CVE-2016-4976 Local Information Disclosure Vulnerability
8366| [97226] Apache Camel CVE-2017-5643 Server Side Request Forgery Security Bypass Vulnerability
8367| [97184] Apache Ambari CVE-2016-6807 Remote Command Execution Vulnerability
8368| [97179] Apache Camel CVE-2016-8749 Java Deserialization Multiple Remote Code Execution Vulnerabilities
8369| [96983] Apache POI CVE-2017-5644 Denial Of Service Vulnerability
8370| [96895] Apache Tomcat CVE-2016-8747 Information Disclosure Vulnerability
8371| [96731] Apache NiFi CVE-2017-5636 Remote Code Injection Vulnerability
8372| [96730] Apache NiFi CVE-2017-5635 Security Bypass Vulnerability
8373| [96729] Apache Struts CVE-2017-5638 Remote Code Execution Vulnerability
8374| [96540] IBM Development Package for Apache Spark CVE-2016-4970 Denial of Service Vulnerability
8375| [96398] Apache CXF CVE-2017-3156 Information Disclosure Vulnerability
8376| [96321] Apache Camel CVE-2017-3159 Remote Code Execution Vulnerability
8377| [96293] Apache Tomcat 'http11/AbstractInputBuffer.java' Denial of Service Vulnerability
8378| [96228] Apache Brooklyn Cross Site Request Forgery and Multiple Cross Site Scripting Vulnerabilities
8379| [95998] Apache Ranger CVE-2016-8746 Security Bypass Vulnerability
8380| [95929] Apache Groovy CVE-2016-6497 Information Disclosure Vulnerability
8381| [95838] Apache Cordova For Android CVE-2017-3160 Man in the Middle Security Bypass Vulnerability
8382| [95675] Apache Struts Remote Code Execution Vulnerability
8383| [95621] Apache NiFi CVE-2106-8748 Cross Site Scripting Vulnerability
8384| [95429] Apache Groovy CVE-2016-6814 Remote Code Execution Vulnerability
8385| [95335] Apache Hadoop CVE-2016-3086 Information Disclosure Vulnerability
8386| [95168] Apache Wicket CVE-2016-6793 Denial of Service Vulnerability
8387| [95136] Apache Qpid Broker for Java CVE-2016-8741 Remote Information Disclosure Vulnerability
8388| [95078] Apache HTTP Server CVE-2016-0736 Remote Security Vulnerability
8389| [95077] Apache HTTP Server CVE-2016-8743 Security Bypass Vulnerability
8390| [95076] Apache HTTP Server CVE-2016-2161 Denial of Service Vulnerability
8391| [95020] Apache Tika CVE-2015-3271 Remote Information Disclosure Vulnerability
8392| [94950] Apache Hadoop CVE-2016-5001 Local Information Disclosure Vulnerability
8393| [94882] Apache ActiveMQ CVE-2016-6810 HTML Injection Vulnerability
8394| [94828] Apache Tomcat CVE-2016-8745 Information Disclosure Vulnerability
8395| [94766] Apache CouchDB CVE-2016-8742 Local Privilege Escalation Vulnerability
8396| [94657] Apache Struts CVE-2016-8738 Denial of Service Vulnerability
8397| [94650] Apache HTTP Server CVE-2016-8740 Denial of Service Vulnerability
8398| [94588] Apache Subversion CVE-2016-8734 XML External Entity Denial of Service Vulnerability
8399| [94513] Apache Karaf CVE-2016-8648 Remote Code Execution Vulnerability
8400| [94463] Apache Tomcat CVE-2016-8735 Remote Code Execution Vulnerability
8401| [94462] Apache Tomcat CVE-2016-6817 Denial of Service Vulnerability
8402| [94461] Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability
8403| [94418] Apache OpenOffice CVE-2016-6803 Local Privilege Escalation Vulnerability
8404| [94247] Apache Tika CVE-2016-6809 Remote Code Execution Vulnerability
8405| [94221] Apache Ranger CVE-2016-6815 Local Privilege Escalation Vulnerability
8406| [94145] Apache OpenMeetings CVE-2016-8736 Remote Code Execution Vulnerability
8407| [93945] Apache CloudStack CVE-2016-6813 Authorization Bypass Vulnerability
8408| [93944] Apache Tomcat Security Manager CVE-2016-6796 Security Bypass Vulnerability
8409| [93943] Apache Tomcat CVE-2016-6794 Security Bypass Vulnerability
8410| [93942] Apache Tomcat Security Manager CVE-2016-5018 Security Bypass Vulnerability
8411| [93940] Apache Tomcat CVE-2016-6797 Security Bypass Vulnerability
8412| [93939] Apache Tomcat CVE-2016-0762 Information Disclosure Vulnerability
8413| [93774] Apache OpenOffice CVE-2016-6804 DLL Loading Remote Code Execution Vulnerability
8414| [93773] Apache Struts CVE-2016-6795 Directory Traversal Vulnerability
8415| [93478] Apache Tomcat CVE-2016-6325 Local Privilege Escalation Vulnerability
8416| [93472] Apache Tomcat CVE-2016-5425 Insecure File Permissions Vulnerability
8417| [93429] Apache Tomcat JK Connector CVE-2016-6808 Remote Buffer Overflow Vulnerability
8418| [93263] Apache Tomcat CVE-2016-1240 Local Privilege Escalation Vulnerability
8419| [93236] Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability
8420| [93142] Apache ActiveMQ Artemis CVE-2016-4978 Remote Code Execution Vulnerability
8421| [93132] Apache Derby CVE-2015-1832 XML External Entity Information Disclosure Vulnerability
8422| [93044] Apache Zookeeper CVE-2016-5017 Buffer Overflow Vulnerability
8423| [92966] Apache Jackrabbit CVE-2016-6801 Cross-Site Request Forgery Vulnerability
8424| [92947] Apache Shiro CVE-2016-6802 Remote Security Bypass Vulnerability
8425| [92905] Apache CXF Fediz CVE-2016-4464 Security Bypass Vulnerability
8426| [92577] Apache Ranger CVE-2016-5395 HTML Injection Vulnerability
8427| [92331] Apache HTTP Server CVE-2016-1546 Remote Denial of Service Vulnerability
8428| [92328] Apache Hive CVE-2016-0760 Multiple Remote Code Execution Vulnerabilities
8429| [92320] Apache APR-util and httpd CVE-2016-6312 Denial of Service Vulnerability
8430| [92100] Apache POI CVE-2016-5000 XML External Entity Injection Vulnerability
8431| [92079] Apache OpenOffice CVE-2016-1513 Remote Code Execution Vulnerability
8432| [91818] Apache Tomcat CVE-2016-5388 Security Bypass Vulnerability
8433| [91816] Apache HTTP Server CVE-2016-5387 Security Bypass Vulnerability
8434| [91788] Apache Qpid Proton CVE-2016-4467 Certificate Verification Security Bypass Vulnerability
8435| [91738] Apache XML-RPC CVE-2016-5003 Remote Code Execution Vulnerability
8436| [91736] Apache XML-RPC Multiple Security Vulnerabilities
8437| [91707] Apache Archiva CVE-2016-5005 HTML Injection Vulnerability
8438| [91703] Apache Archiva CVE-2016-4469 Multiple Cross-Site Request Forgery Vulnerabilities
8439| [91566] Apache HTTP Server CVE-2016-4979 Authentication Bypass Vulnerability
8440| [91537] Apache QPID CVE-2016-4974 Deserialization Security Bypass Vulnerability
8441| [91501] Apache Xerces-C CVE-2016-4463 Stack Buffer Overflow Vulnerability
8442| [91453] Apache Commons FileUpload CVE-2016-3092 Denial Of Service Vulnerability
8443| [91284] Apache Struts CVE-2016-4431 Security Bypass Vulnerability
8444| [91282] Apache Struts CVE-2016-4433 Security Bypass Vulnerability
8445| [91281] Apache Struts CVE-2016-4430 Cross-Site Request Forgery Vulnerability
8446| [91280] Apache Struts CVE-2016-4436 Security Bypass Vulnerability
8447| [91278] Apache Struts CVE-2016-4465 Denial of Service Vulnerability
8448| [91277] Apache Struts Incomplete Fix Remote Code Execution Vulnerability
8449| [91275] Apache Struts CVE-2016-4438 Remote Code Execution Vulnerability
8450| [91217] Apache Continuum 'saveInstallation.action' Command Execution Vulnerability
8451| [91141] Apache CloudStack CVE-2016-3085 Authentication Bypass Vulnerability
8452| [91068] Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability
8453| [91067] Apache Struts CVE-2016-1182 Security Bypass Vulnerability
8454| [91024] Apache Shiro CVE-2016-4437 Information Disclosure Vulnerability
8455| [90988] Apache Ranger CVE-2016-2174 SQL Injection Vulnerability
8456| [90961] Apache Struts CVE-2016-3093 Denial of Service Vulnerability
8457| [90960] Apache Struts CVE-2016-3087 Remote Code Execution Vulnerability
8458| [90921] Apache Qpid CVE-2016-4432 Authentication Bypass Vulnerability
8459| [90920] Apache Qpid CVE-2016-3094 Denial of Service Vulnerability
8460| [90902] Apache PDFBox CVE-2016-2175 XML External Entity Injection Vulnerability
8461| [90897] Apache Tika CVE-2016-4434 XML External Entity Injection Vulnerability
8462| [90827] Apache ActiveMQ CVE-2016-3088 Multiple Arbitrary File Upload Vulnerabilities
8463| [90755] Apache Ambari CVE-2016-0707 Multiple Local Information Disclosure Vulnerabilities
8464| [90482] Apache CVE-2004-1387 Local Security Vulnerability
8465| [89762] Apache CVE-2001-1556 Remote Security Vulnerability
8466| [89417] Apache Subversion CVE-2016-2167 Authentication Bypass Vulnerability
8467| [89326] RETIRED: Apache Subversion CVE-2016-2167 Security Bypass Vulnerability
8468| [89320] Apache Subversion CVE-2016-2168 Remote Denial of Service Vulnerability
8469| [88826] Apache Struts CVE-2016-3082 Remote Code Execution Vulnerability
8470| [88797] Apache Cordova For iOS CVE-2015-5208 Arbitrary Code Execution Vulnerability
8471| [88764] Apache Cordova iOS CVE-2015-5207 Multiple Security Bypass Vulnerabilities
8472| [88701] Apache CVE-2001-1449 Remote Security Vulnerability
8473| [88635] Apache CVE-2000-1204 Remote Security Vulnerability
8474| [88590] Apache WWW server CVE-1999-1199 Denial-Of-Service Vulnerability
8475| [88496] Apache CVE-2000-1206 Remote Security Vulnerability
8476| [87828] Apache CVE-1999-1237 Remote Security Vulnerability
8477| [87784] Apache CVE-1999-1293 Denial-Of-Service Vulnerability
8478| [87327] Apache Struts CVE-2016-3081 Remote Code Execution Vulnerability
8479| [86622] Apache Stats CVE-2007-0975 Remote Security Vulnerability
8480| [86399] Apache CVE-2007-1743 Local Security Vulnerability
8481| [86397] Apache CVE-2007-1742 Local Security Vulnerability
8482| [86311] Apache Struts CVE-2016-4003 Cross Site Scripting Vulnerability
8483| [86174] Apache Wicket CVE-2015-5347 Cross Site Scripting Vulnerability
8484| [85971] Apache OFBiz CVE-2016-2170 Java Deserialization Remote Code Execution Vulnerability
8485| [85967] Apache OFBiz CVE-2015-3268 HTML Injection Vulnerability
8486| [85759] Apache Jetspeed CVE-2016-2171 Unauthorized Access Vulnerability
8487| [85758] Apache Jetspeed CVE-2016-0712 Cross Site Scripting Vulnerability
8488| [85756] Apache Jetspeed CVE-2016-0710 Multiple SQL Injection Vulnerabilities
8489| [85755] Apache Jetspeed CVE-2016-0711 Mulitple HTML Injection Vulnerabilities
8490| [85754] Apache Jetspeed CVE-2016-0709 Directory Traversal Vulnerability
8491| [85730] Apache Subversion CVE-2015-5343 Integer Overflow Vulnerability
8492| [85691] Apache Ranger CVE-2016-0735 Security Bypass Vulnerability
8493| [85578] Apache ActiveMQ CVE-2010-1244 Cross-Site Request Forgery Vulnerability
8494| [85554] Apache OpenMeetings CVE-2016-2164 Multiple Information Disclosure Vulnerabilities
8495| [85553] Apache OpenMeetings CVE-2016-0783 Information Disclosure Vulnerability
8496| [85552] Apache OpenMeetings CVE-2016-2163 HTML Injection Vulnerability
8497| [85550] Apache OpenMeetings CVE-2016-0784 Directory Traversal Vulnerability
8498| [85386] Apache Hadoop CVE-2015-7430 Local Privilege Escalation Vulnerability
8499| [85377] Apache Qpid Proton Python API CVE-2016-2166 Man in the Middle Security Bypass Vulnerability
8500| [85205] Apache Solr CVE-2015-8796 Cross Site Scripting Vulnerability
8501| [85203] Apache Solr CVE-2015-8795 Mulitple HTML Injection Vulnerabilities
8502| [85163] Apache Geronimo CVE-2008-0732 Local Security Vulnerability
8503| [85131] Apache Struts 'TextParseUtil.translateVariables()' Method Remote Code Execution Vulnerability
8504| [85070] Apache Struts CVE-2016-2162 Cross Site Scripting Vulnerability
8505| [85066] Apache Struts CVE-2016-0785 Remote Code Execution Vulnerability
8506| [84422] Apache TomEE CVE-2016-0779 Unspecified Security Vulnerability
8507| [84321] Apache ActiveMQ CVE-2016-0734 Clickjacking Vulnerability
8508| [84316] Apache ActiveMQ CVE-2016-0782 Multiple Cross Site Scripting Vulnerabilities
8509| [83910] Apache Wicket CVE-2015-7520 Cross Site Scripting Vulnerability
8510| [83423] Apache Xerces-C CVE-2016-0729 Buffer Overflow Vulnerability
8511| [83330] Apache Tomcat CVE-2015-5351 Cross Site Request Forgery Vulnerability
8512| [83329] Apache Tomcat CVE-2015-5174 Directory Traversal Vulnerability
8513| [83328] Apache Tomcat CVE-2015-5345 Directory Traversal Vulnerability
8514| [83327] Apache Tomcat Security Manager CVE-2016-0714 Remote Code Execution Vulnerability
8515| [83326] Apache Tomcat CVE-2016-0763 Security Bypass Vulnerability
8516| [83324] Apache Tomcat Security Manager CVE-2016-0706 Information Disclosure Vulnerability
8517| [83323] Apache Tomcat CVE-2015-5346 Session Fixation Vulnerability
8518| [83259] Apache Hadoop CVE-2015-1776 Information Disclosure Vulnerability
8519| [83243] Apache Solr CVE-2015-8797 Cross Site Scripting Vulnerability
8520| [83119] Apache Sling CVE-2016-0956 Information Disclosure Vulnerability
8521| [83002] Apache CVE-2000-1205 Cross-Site Scripting Vulnerability
8522| [82871] Apache Ranger Authentication Bypass and Security Bypass Vulnerabilities
8523| [82800] Apache CloudStack CVE-2015-3251 Information Disclosure Vulnerability
8524| [82798] Apache CloudStack CVE-2015-3252 Authentication Bypass Vulnerability
8525| [82732] Apache Gallery CVE-2003-0771 Local Security Vulnerability
8526| [82676] Apache CVE-2003-1581 Cross-Site Scripting Vulnerability
8527| [82550] Apache Struts CVE-2015-5209 Security Bypass Vulnerability
8528| [82300] Apache Subversion CVE-2015-5259 Integer Overflow Vulnerability
8529| [82260] Apache Camel CVE-2015-5344 Remote Code Execution Vulnerability
8530| [82234] Apache Hive CVE-2015-7521 Security Bypass Vulnerability
8531| [82082] Apache CVE-1999-0289 Remote Security Vulnerability
8532| [81821] Apache Distribution for Solaris CVE-2007-2080 SQL-Injection Vulnerability
8533| [80696] Apache Camel CVE-2015-5348 Information Disclosure Vulnerability
8534| [80525] Apache CVE-2003-1580 Remote Security Vulnerability
8535| [80354] Drupal Apache Solr Search Module Access Bypass Vulnerability
8536| [80193] Apache CVE-1999-0107 Denial-Of-Service Vulnerability
8537| [79812] Apache Directory Studio CVE-2015-5349 Command Injection Vulnerability
8538| [79744] Apache HBase CVE-2015-1836 Unauthorized Access Vulnerability
8539| [79204] Apache TomEE 'EjbObjectInputStream' Remote Code Execution Vulnerability
8540| [77679] Apache Cordova For Android CVE-2015-8320 Weak Randomization Security Bypass Vulnerability
8541| [77677] Apache Cordova For Android CVE-2015-5256 Security Bypass Vulnerability
8542| [77591] Apache CXF SAML SSO Processing CVE-2015-5253 Security Bypass Vulnerability
8543| [77521] Apache Commons Collections 'InvokerTransformer.java' Remote Code Execution Vulnerability
8544| [77110] Apache HttpComponents HttpClient CVE-2015-5262 Denial of Service Vulnerability
8545| [77086] Apache Ambari CVE-2015-1775 Server Side Request Forgery Security Bypass Vulnerability
8546| [77085] Apache Ambari CVE-2015-3270 Remote Privilege Escalation Vulnerability
8547| [77082] Apache Ambari 'targetURI' Parameter Open Redirection Vulnerability
8548| [77059] Apache Ambari CVE-2015-3186 Cross Site Scripting Vulnerability
8549| [76933] Apache James Server Unspecified Command Execution Vulnerability
8550| [76832] Apache cordova-plugin-file-transfer CVE-2015-5204 HTTP Header Injection Vulnerability
8551| [76625] Apache Struts CVE-2015-5169 Cross Site Scripting Vulnerability
8552| [76624] Apache Struts CVE-2015-2992 Cross Site Scripting Vulnerability
8553| [76522] Apache Tapestry CVE-2014-1972 Security Bypass Vulnerability
8554| [76486] Apache CXF Fediz CVE-2015-5175 Denial of Service Vulnerability
8555| [76452] Apache ActiveMQ CVE-2015-1830 Directory Traversal Vulnerability
8556| [76446] Apache Subversion 'libsvn_fs_fs/tree.c' Denial of Service Vulnerability
8557| [76274] Apache Subversion CVE-2015-3184 Information Disclosure Vulnerability
8558| [76273] Apache Subversion CVE-2015-3187 Information Disclosure Vulnerability
8559| [76272] Apache ActiveMQ CVE-2014-3576 Denial of Service Vulnerability
8560| [76221] Apache Ranger CVE-2015-0266 Access Bypass Vulnerability
8561| [76208] Apache Ranger CVE-2015-0265 JavaScript Code Injection Vulnerability
8562| [76025] Apache ActiveMQ Artemis CVE-2015-3208 XML External Entity Information Disclosure Vulnerability
8563| [75965] Apache HTTP Server CVE-2015-3185 Security Bypass Vulnerability
8564| [75964] Apache HTTP Server CVE-2015-0253 Remote Denial of Service Vulnerability
8565| [75963] Apache HTTP Server CVE-2015-3183 Security Vulnerability
8566| [75940] Apache Struts CVE-2015-1831 Security Bypass Vulnerability
8567| [75919] Apache Groovy CVE-2015-3253 Remote Code Execution Vulnerability
8568| [75338] Apache Storm CVE-2015-3188 Remote Code Execution Vulnerability
8569| [75275] Drupal Apache Solr Real-Time Module Access Bypass Vulnerability
8570| [74866] Apache Cordova For Android CVE-2015-1835 Security Bypass Vulnerability
8571| [74839] Apache Sling API and Sling Servlets CVE-2015-2944 Cross Site Scripting Vulnerability
8572| [74761] Apache Jackrabbit CVE-2015-1833 XML External Entity Information Disclosure Vulnerability
8573| [74686] Apache Ambari '/var/lib/ambari-server/ambari-env.sh' Local Privilege Escalation Vulnerability
8574| [74665] Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability
8575| [74475] Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability
8576| [74423] Apache Struts CVE-2015-0899 Security Bypass Vulnerability
8577| [74338] Apache OpenOffice HWP Filter Memory Corruption Vulnerability
8578| [74265] Apache Tomcat 'mod_jk' CVE-2014-8111 Information Disclosure Vulnerability
8579| [74260] Apache Subversion CVE-2015-0248 Multiple Denial of Service Vulnerabilities
8580| [74259] Apache Subversion 'deadprops.c' Security Bypass Vulnerability
8581| [74204] PHP 'sapi/apache2handler/sapi_apache2.c' Remote Code Execution Vulnerability
8582| [74158] Apache HTTP Server 'protocol.c' Remote Denial of Service Vulnerability
8583| [73954] Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability
8584| [73851] Apache2 CVE-2012-0216 Cross-Site Scripting Vulnerability
8585| [73478] Apache Cassandra CVE-2015-0225 Remote Code Execution Vulnerability
8586| [73041] Apache HTTP Server 'mod_lua' Module Denial of Service Vulnerability
8587| [73040] Apache HTTP Server 'mod_lua.c' Local Access Bypass Vulnerability
8588| [72809] Apache Standard Taglibs CVE-2015-0254 XML External Entity Injection Vulnerability
8589| [72717] Apache Tomcat CVE-2014-0227 Chunk Request Remote Denial Of Service Vulnerability
8590| [72557] Apache WSS4J CVE-2015-0227 Security Bypass Vulnerability
8591| [72553] Apache WSS4J CVE-2015-0226 Information Disclosure Vulnerability
8592| [72513] Apache ActiveMQ CVE-2014-3612 LDAP Authentication Bypass Vulnerability
8593| [72511] Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities
8594| [72510] Apache ActiveMQ CVE-2014-3600 XML External Entity Injection Vulnerability
8595| [72508] Apache ActiveMQ Apollo CVE-2014-3579 XML External Entity Injection Vulnerability
8596| [72319] Apache Qpid CVE-2015-0223 Security Bypass Vulnerability
8597| [72317] Apache Qpid CVE-2015-0224 Incomplete Fix Multiple Denial of Service Vulnerabilities
8598| [72115] Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability
8599| [72053] Apache HTTP Server 'mod_remoteip.c' IP Address Spoofing Vulnerability
8600| [72030] Apache Qpid CVE-2015-0203 Multiple Denial of Service Vulnerabilities
8601| [71879] Apache Traffic Server 'HttpTransact.cc' Denial of Service Vulnerability
8602| [71726] Apache Subversion CVE-2014-3580 Remote Denial of Service Vulnerability
8603| [71725] Apache Subversion CVE-2014-8108 Remote Denial of Service Vulnerability
8604| [71657] Apache HTTP Server 'mod_proxy_fcgi' Module Denial of Service Vulnerability
8605| [71656] Apache HTTP Server 'mod_cache' Module Denial of Service Vulnerability
8606| [71548] Apache Struts CVE-2014-7809 Security Bypass Vulnerability
8607| [71466] Apache Hadoop CVE-2014-3627 Information Disclosure Vulnerability
8608| [71353] Apache HTTP Server 'LuaAuthzProvider' Authorization Bypass Vulnerability
8609| [71004] Apache Qpid CVE-2014-3629 XML External Entity Injection Vulnerability
8610| [70970] Apache Traffic Server Cross Site Scripting Vulnerability
8611| [70738] Apache CXF CVE-2014-3584 Denial of Service Vulnerability
8612| [70736] Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
8613| [69728] Apache Tomcat CVE-2013-4444 Arbitrary File Upload Vulnerability
8614| [69648] Apache POI CVE-2014-3574 Denial Of Service Vulnerability
8615| [69647] Apache POI OpenXML parser CVE-2014-3529 XML External Entity Information Disclosure Vulnerability
8616| [69351] Apache OpenOffice Calc CVE-2014-3524 Command Injection Vulnerability
8617| [69295] Apache Axis Incomplete Fix CVE-2014-3596 SSL Certificate Validation Security Bypass Vulnerability
8618| [69286] Apache OFBiz CVE-2014-0232 Multiple Cross Site Scripting Vulnerabilities
8619| [69258] Apache HttpComponents Incomplete Fix CVE-2014-3577 SSL Validation Security Bypass Vulnerability
8620| [69257] Apache HttpComponents Incomplete Fix SSL Certificate Validation Security Bypass Vulnerability
8621| [69248] Apache HTTP Server CVE-2013-4352 Remote Denial of Service Vulnerability
8622| [69237] Apache Subversion CVE-2014-3522 SSL Certificate Validation Information Disclosure Vulnerability
8623| [69173] Apache Traffic Server CVE-2014-3525 Unspecified Security Vulnerability
8624| [69046] Apache Cordova For Android CVE-2014-3502 Information Disclosure Vulnerability
8625| [69041] Apache Cordova For Android CVE-2014-3501 Security Bypass Vulnerability
8626| [69038] Apache Cordova For Android CVE-2014-3500 Security Bypass Vulnerability
8627| [68995] Apache Subversion CVE-2014-3528 Insecure Authentication Weakness
8628| [68966] Apache Subversion 'irkerbridge.py' Local Privilege Escalation Vulnerability
8629| [68965] Apache Subversion 'svnwcsub.py' Local Privilege Escalation Vulnerability
8630| [68863] Apache HTTP Server 'mod_cache' Module Remote Denial of Service Vulnerability
8631| [68747] Apache HTTP Server CVE-2014-3523 Remote Denial of Service Vulnerability
8632| [68745] Apache HTTP Server CVE-2014-0118 Remote Denial of Service Vulnerability
8633| [68742] Apache HTTP Server CVE-2014-0231 Remote Denial of Service Vulnerability
8634| [68740] Apache HTTP Server CVE-2014-0117 Remote Denial of Service Vulnerability
8635| [68678] Apache HTTP Server 'mod_status' CVE-2014-0226 Remote Code Execution Vulnerability
8636| [68445] Apache CXF UsernameToken Information Disclosure Vulnerability
8637| [68441] Apache CXF SAML Tokens Validation Security Bypass Vulnerability
8638| [68431] Apache Syncope CVE-2014-3503 Insecure Password Generation Weakness
8639| [68229] Apache Harmony PRNG Entropy Weakness
8640| [68111] Apache 'mod_wsgi' Module Privilege Escalation Vulnerability
8641| [68072] Apache Tomcat CVE-2014-0186 Remote Denial of Service Vulnerability
8642| [68039] Apache Hive CVE-2014-0228 Security Bypass Vulnerability
8643| [67673] Apache Tomcat CVE-2014-0095 AJP Request Remote Denial Of Service Vulnerability
8644| [67671] Apache Tomcat CVE-2014-0075 Chunk Request Remote Denial Of Service Vulnerability
8645| [67669] Apache Tomcat CVE-2014-0119 XML External Entity Information Disclosure Vulnerability
8646| [67668] Apache Tomcat CVE-2014-0099 Request Processing Information Disclosure Vulnerability
8647| [67667] Apache Tomcat CVE-2014-0096 XML External Entity Information Disclosure Vulnerability
8648| [67534] Apache 'mod_wsgi' Module CVE-2014-0242 Information Disclosure Vulnerability
8649| [67532] Apache 'mod_wsgi' Module Local Privilege Escalation Vulnerability
8650| [67530] Apache Solr Search Template Cross Site Scripting Vulnerability
8651| [67236] Apache CXF CVE-2014-0109 Remote Denial of Service Vulnerability
8652| [67232] Apache CXF CVE-2014-0110 Denial of Service Vulnerability
8653| [67121] Apache Struts ClassLoader Manipulation CVE-2014-0114 Security Bypass Vulnerability
8654| [67081] Apache Struts 'getClass()' Method Security Bypass Vulnerability
8655| [67064] Apache Struts ClassLoader Manipulation Incomplete Fix Security Bypass Vulnerability
8656| [67013] Apache Zookeeper CVE-2014-0085 Local Information Disclosure Vulnerability
8657| [66998] Apache Archiva CVE-2013-2187 Unspecified Cross Site Scripting Vulnerability
8658| [66991] Apache Archiva CVE-2013-2187 HTML Injection Vulnerability
8659| [66927] Apache Syncope CVE-2014-0111 Remote Code Execution Vulnerability
8660| [66474] Apache CouchDB Universally Unique IDentifier (UUID) Remote Denial of Service Vulnerability
8661| [66397] Apache Xalan-Java Library CVE-2014-0107 Security Bypass Vulnerability
8662| [66303] Apache HTTP Server Multiple Denial of Service Vulnerabilities
8663| [66041] RETIRED: Apache Struts CVE-2014-0094 Classloader Manipulation Security Bypass Vulnerability
8664| [65999] Apache Struts ClassLoader Manipulation CVE-2014-0094 Security Bypass Vulnerability
8665| [65967] Apache Cordova File-Transfer Unspecified Security Vulnerability
8666| [65959] Apache Cordova InAppBrowser Remote Privilege Escalation Vulnerability
8667| [65935] Apache Shiro 'login.jsp' Authentication Bypass Vulnerability
8668| [65902] Apache Camel CVE-2014-0003 Remote Code Execution Vulnerability
8669| [65901] Apache Camel CVE-2014-0002 XML External Entity Information Disclosure Vulnerability
8670| [65773] Apache Tomcat CVE-2013-4286 Security Bypass Vulnerability
8671| [65769] Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability
8672| [65768] Apache Tomcat CVE-2013-4590 XML External Entity Information Disclosure Vulnerability
8673| [65767] Apache Tomcat CVE-2013-4322 Incomplete Fix Denial of Service Vulnerability
8674| [65615] Apache ActiveMQ 'refresh' Parameter Cross Site Scripting Vulnerability
8675| [65434] Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability
8676| [65431] Apache Wicket CVE-2013-2055 Information Disclosure Vulnerability
8677| [65400] Apache Commons FileUpload CVE-2014-0050 Denial Of Service Vulnerability
8678| [64782] Apache CloudStack Virtual Router Component Security Bypass Vulnerability
8679| [64780] Apache CloudStack Unauthorized Access Vulnerability
8680| [64617] Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
8681| [64437] Apache Santuario XML Security For JAVA XML Signature Denial of Service Vulnerability
8682| [64427] Apache Solr Multiple XML External Entity Injection Vulnerabilities
8683| [64009] Apache Solr CVE-2013-6408 XML External Entity Injection Vulnerability
8684| [64008] Apache Solr CVE-2013-6407 XML External Entity Injection Vulnerability
8685| [63981] Apache Subversion 'mod_dav_svn' Module Denial of Service Vulnerability
8686| [63966] Apache Subversion CVE-2013-4505 Security Bypass Vulnerability
8687| [63963] Apache Roller CVE-2013-4171 Cross Site Scripting Vulnerability
8688| [63935] Apache Solr 'SolrResourceLoader' Directory Traversal Vulnerability
8689| [63928] Apache Roller CVE-2013-4212 OGNL Expression Injection Remote Code Execution Vulnerability
8690| [63515] Apache Tomcat Manager Component CVE-2013-6357 Cross Site Request Forgery Vulnerability
8691| [63403] Apache Struts Multiple Cross Site Scripting Vulnerabilities
8692| [63400] Apache 'mod_pagespeed' Module Unspecified Cross Site Scripting Vulnerability
8693| [63260] Apache Shindig CVE-2013-4295 XML External Entity Information Disclosure Vulnerability
8694| [63241] Apache Sling 'AbstractAuthenticationFormServlet' Open Redirection Vulnerability
8695| [63174] Apache Commons FileUpload 'DiskFileItem' Class Null Byte Arbitrary File Write Vulnerability
8696| [62939] Apache 'mod_fcgid' Module CVE-2013-4365 Heap Buffer Overflow Vulnerability
8697| [62903] Apache Sling 'deepGetOrCreateNode()' Function Denial Of Service Vulnerability
8698| [62706] Apache Camel CVE-2013-4330 Information Disclosure Vulnerability
8699| [62677] Apache 'mod_accounting' Module CVE-2013-5697 SQL Injection Vulnerability
8700| [62674] TYPO3 Apache Solr Unspecified Cross Site Scripting and PHP Code Execution Vulnerabilities
8701| [62587] Apache Struts CVE-2013-4316 Remote Code Execution Vulnerability
8702| [62584] Apache Struts CVE-2013-4310 Security Bypass Vulnerability
8703| [62266] Apache Subversion CVE-2013-4277 Insecure Temporary File Creation Vulnerability
8704| [61984] Apache Hadoop RPC Authentication CVE-2013-2192 Man in the Middle Security Bypass Vulnerability
8705| [61981] Apache HBase RPC Authentication Man In The Middle Security Bypass Vulnerability
8706| [61638] Apache CloudStack CVE-2013-2136 Multiple Cross Site Scripting Vulnerabilities
8707| [61454] Apache Subversion CVE-2013-4131 Denial Of Service Vulnerability
8708| [61379] Apache HTTP Server CVE-2013-2249 Unspecified Remote Security Vulnerability
8709| [61370] Apache OFBiz CVE-2013-2317 'View Log' Cross Site Scripting Vulnerability
8710| [61369] Apache OFBiz Nested Expression Remote Code Execution Vulnerability
8711| [61196] Apache Struts CVE-2013-2248 Multiple Open Redirection Vulnerabilities
8712| [61189] Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities
8713| [61129] Apache HTTP Server CVE-2013-1896 Remote Denial of Service Vulnerability
8714| [61030] Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities
8715| [60875] Apache Geronimo RMI Classloader Security Bypass Vulnerability
8716| [60846] Apache Santuario XML Security for JAVA XML Signature CVE-2013-2172 Security Bypass Vulnerability
8717| [60817] Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability
8718| [60800] Apache Qpid Python Client SSL Certificate Verification Information Disclosure Vulnerability
8719| [60599] Apache Santuario XML Security for C++ CVE-2013-2156 Remote Heap Buffer Overflow Vulnerability
8720| [60595] Apache Santuario XML Security for C++ XML Signature CVE-2013-2155 Denial of Service Vulnerability
8721| [60594] Apache Santuario XML Security for C++ CVE-2013-2154 Stack Buffer Overflow Vulnerability
8722| [60592] Apache Santuario XML Security for C++ XML Signature CVE-2013-2153 Security Bypass Vulnerability
8723| [60534] Apache OpenJPA Object Deserialization Arbitrary File Creation or Overwrite Vulnerability
8724| [60346] Apache Struts CVE-2013-2134 OGNL Expression Injection Vulnerability
8725| [60345] Apache Struts CVE-2013-2135 OGNL Expression Injection Vulnerability
8726| [60267] Apache Subversion CVE-2013-1968 Remote Denial of Service Vulnerability
8727| [60265] Apache Subversion CVE-2013-2088 Command Injection Vulnerability
8728| [60264] Apache Subversion CVE-2013-2112 Remote Denial of Service Vulnerability
8729| [60187] Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness
8730| [60186] Apache Tomcat CVE-2013-1976 Insecure Temporary File Handling Vulnerability
8731| [60167] Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability
8732| [60166] Apache Struts 'includeParams' CVE-2013-1966 Security Bypass Vulnerability
8733| [60082] Apache Struts 'ParameterInterceptor' Class OGNL CVE-2013-1965 Security Bypass Vulnerability
8734| [59826] Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability
8735| [59799] Apache Tomcat CVE-2013-2067 Session Fixation Vulnerability
8736| [59798] Apache Tomcat CVE-2013-2071 Information Disclosure Vulnerability
8737| [59797] Apache Tomcat CVE-2012-3544 Denial of Service Vulnerability
8738| [59670] Apache VCL Multiple Input Validation Vulnerabilities
8739| [59464] Apache CloudStack CVE-2013-2758 Hash Information Disclosure Vulnerability
8740| [59463] Apache CloudStack CVE-2013-2756 Authentication Bypass Vulnerability
8741| [59402] Apache ActiveMQ CVE-2013-3060 Information Disclosure and Denial of Service Vulnerability
8742| [59401] Apache ActiveMQ CVE-2012-6551 Denial of Service Vulnerability
8743| [59400] Apache ActiveMQ CVE-2012-6092 Multiple Cross Site Scripting Vulnerabilities
8744| [58898] Apache Subversion CVE-2013-1884 Remote Denial of Service Vulnerability
8745| [58897] Apache Subversion 'mod_dav_svn/lock.c' Remote Denial of Service Vulnerability
8746| [58895] Apache Subversion 'mod_dav_svn' Remote Denial of Service Vulnerability
8747| [58455] Apache Rave User RPC API CVE-2013-1814 Information Disclosure Vulnerability
8748| [58379] Apache Qpid CVE-2012-4446 Authentication Bypass Vulnerability
8749| [58378] Apache Qpid CVE-2012-4460 Denial of Service Vulnerability
8750| [58376] Apache Qpid CVE-2012-4458 Denial of Service Vulnerability
8751| [58337] Apache Qpid CVE-2012-4459 Denial of Service Vulnerability
8752| [58326] Apache Commons FileUpload CVE-2013-0248 Insecure Temporary File Creation Vulnerability
8753| [58325] Debian Apache HTTP Server CVE-2013-1048 Symlink Attack Local Privilege Escalation Vulnerability
8754| [58323] Apache Subversion 'svn_fs_file_length()' Remote Denial of Service Vulnerability
8755| [58165] Apache HTTP Server Multiple Cross Site Scripting Vulnerabilities
8756| [58136] Apache Maven CVE-2013-0253 SSL Certificate Validation Security Bypass Vulnerability
8757| [58124] Apache Tomcat 'log/logdir' Directory Insecure File Permissions Vulnerability
8758| [58073] Apache Commons HttpClient CVE-2012-5783 SSL Certificate Validation Security Bypass Vulnerability
8759| [57876] Apache CXF WS-SecurityPolicy Authentication Bypass Vulnerability
8760| [57874] Apache CXF CVE-2012-5633 Security Bypass Vulnerability
8761| [57463] Apache OFBiz CVE-2013-0177 Multiple Cross Site Scripting Vulnerabilities
8762| [57425] Apache CXF CVE-2012-5786 SSL Certificate Validation Security Bypass Vulnerability
8763| [57321] Apache CouchDB CVE-2012-5650 Cross Site Scripting Vulnerability
8764| [57314] Apache CouchDB CVE-2012-5649 Remote Code Execution Vulnerability
8765| [57267] Apache Axis2/C SSL Certificate Validation Security Bypass Vulnerability
8766| [57259] Apache CloudStack CVE-2012-5616 Local Information Disclosure Vulnerability
8767| [56814] Apache Tomcat CVE-2012-4431 Cross-Site Request Forgery Vulnerability
8768| [56813] Apache Tomcat CVE-2012-4534 Denial of Service Vulnerability
8769| [56812] Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability
8770| [56753] Apache Apache HTTP Server 'mod_proxy_ajp Module Denial Of Service Vulnerability
8771| [56686] Apache Tomcat CVE-2012-5568 Denial of Service Vulnerability
8772| [56408] Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability
8773| [56403] Apache Tomcat DIGEST Authentication Multiple Security Weaknesses
8774| [56402] Apache Tomcat CVE-2012-2733 Denial of Service Vulnerability
8775| [56171] Apache OFBiz CVE-2012-3506 Unspecified Security Vulnerability
8776| [55876] Apache CloudStack CVE-2012-4501 Security Bypass Vulnerability
8777| [55628] Apache CXF SOAP Action Spoofing Security Bypass Vulnerability
8778| [55608] Apache Qpid (qpidd) Denial of Service Vulnerability
8779| [55536] Apache 'mod_pagespeed' Module Cross Site Scripting and Security Bypass Vulnerabilities
8780| [55508] Apache Axis2 XML Signature Wrapping Security Vulnerability
8781| [55445] Apache Wicket CVE-2012-3373 Cross Site Scripting Vulnerability
8782| [55346] Apache Struts Cross Site Request Forgery and Denial of Service Vulnerabilities
8783| [55290] Drupal Apache Solr Autocomplete Module Cross Site Scripting Vulnerability
8784| [55165] Apache Struts2 Skill Name Remote Code Execution Vulnerability
8785| [55154] Apache 'mod-rpaf' Module Denial of Service Vulnerability
8786| [55131] Apache HTTP Server HTML-Injection And Information Disclosure Vulnerabilities
8787| [54954] Apache QPID NullAuthenticator Authentication Bypass Vulnerability
8788| [54798] Apache Libcloud Man In The Middle Vulnerability
8789| [54358] Apache Hadoop CVE-2012-3376 Information Disclosure Vulnerability
8790| [54341] Apache Sling CVE-2012-2138 Denial Of Service Vulnerability
8791| [54268] Apache Hadoop Symlink Attack Local Privilege Escalation Vulnerability
8792| [54189] Apache Roller Cross Site Request Forgery Vulnerability
8793| [54187] Apache Roller CVE-2012-2381 Cross Site Scripting Vulnerability
8794| [53880] Apache CXF Child Policies Security Bypass Vulnerability
8795| [53877] Apache CXF Elements Validation Security Bypass Vulnerability
8796| [53676] Apache Commons Compress and Apache Ant CVE-2012-2098 Denial Of Service Vulnerability
8797| [53487] Apache POI CVE-2012-0213 Denial Of Service Vulnerability
8798| [53455] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability
8799| [53305] Apache Qpid CVE-2011-3620 Unauthorized Access Security Bypass Vulnerability
8800| [53046] Apache HTTP Server 'LD_LIBRARY_PATH' Insecure Library Loading Arbitrary Code Execution Vulnerability
8801| [53025] Apache OFBiz Unspecified Remote Code Execution Vulnerability
8802| [53023] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
8803| [52939] Apache Hadoop CVE-2012-1574 Unspecified User Impersonation Vulnerability
8804| [52702] Apache Struts2 'XSLTResult.java' Remote Arbitrary File Upload Vulnerability
8805| [52696] Apache Traffic Server HTTP Host Header Handling Heap Based Buffer Overflow Vulnerability
8806| [52680] Apache Wicket 'pageMapName' Parameter Cross Site Scripting Vulnerability
8807| [52679] Apache Wicket Hidden Files Information Disclosure Vulnerability
8808| [52565] Apache 'mod_fcgid' Module Denial Of Service Vulnerability
8809| [52146] TYPO3 Apache Solr Extension Unspecified Cross Site Scripting Vulnerability
8810| [51939] Apache MyFaces 'ln' Parameter Information Disclosure Vulnerability
8811| [51917] Apache APR Hash Collision Denial Of Service Vulnerability
8812| [51902] Apache Struts Multiple HTML Injection Vulnerabilities
8813| [51900] Apache Struts CVE-2012-1007 Multiple Cross Site Scripting Vulnerabilities
8814| [51886] Apache CXF UsernameToken Policy Validation Security Bypass Vulnerability
8815| [51869] Apache HTTP Server CVE-2011-3639 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
8816| [51706] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
8817| [51705] Apache HTTP Server CVE-2012-0021 mod_log_config Denial Of Service Vulnerability
8818| [51628] Apache Struts 'ParameterInterceptor' Class OGNL (CVE-2011-3923) Security Bypass Vulnerability
8819| [51447] Apache Tomcat Parameter Handling Denial of Service Vulnerability
8820| [51442] Apache Tomcat Request Object Security Bypass Vulnerability
8821| [51407] Apache HTTP Server Scoreboard Local Security Bypass Vulnerability
8822| [51257] Apache Struts Remote Command Execution and Arbitrary File Overwrite Vulnerabilities
8823| [51238] Apache Geronimo Hash Collision Denial Of Service Vulnerability
8824| [51200] Apache Tomcat Hash Collision Denial Of Service Vulnerability
8825| [50940] Apache Struts Session Tampering Security Bypass Vulnerability
8826| [50912] RETIRED: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability
8827| [50904] Apache ActiveMQ Failover Mechanism Remote Denial Of Service Vulnerability
8828| [50848] Apache MyFaces EL Expression Evaluation Security Bypass Vulnerability
8829| [50802] Apache HTTP Server 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
8830| [50639] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
8831| [50603] Apache Tomcat Manager Application Security Bypass Vulnerability
8832| [50494] Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
8833| [49957] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
8834| [49762] Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses
8835| [49728] Apache Struts Conversion Error OGNL Expression Evaluation Vulnerability
8836| [49616] Apache HTTP Server CVE-2011-3348 Denial Of Service Vulnerability
8837| [49470] Apache Tomcat CVE-2007-6286 Duplicate Request Processing Security Vulnerability
8838| [49353] Apache Tomcat AJP Protocol Security Bypass Vulnerability
8839| [49303] Apache HTTP Server CVE-2011-3192 Denial Of Service Vulnerability
8840| [49290] Apache Wicket Cross Site Scripting Vulnerability
8841| [49147] Apache Tomcat CVE-2011-2481 Information Disclosure Vulnerability
8842| [49143] Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability
8843| [48667] Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
8844| [48653] Apache 'mod_authnz_external' Module SQL Injection Vulnerability
8845| [48611] Apache XML Security for C++ Signature Key Parsing Denial of Service Vulnerability
8846| [48456] Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability
8847| [48015] Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities
8848| [48011] Apache Archiva Multiple Cross Site Scripting and HTML Injection Vulnerabilities
8849| [47929] Apache APR 'apr_fnmatch.c' Denial of Service Vulnerability
8850| [47890] Apache Struts 'javatemplates' Plugin Multiple Cross Site Scripting Vulnerabilities
8851| [47886] Apache Tomcat SecurityConstraints Security Bypass Vulnerability
8852| [47820] Apache APR 'apr_fnmatch()' Denial of Service Vulnerability
8853| [47784] Apache Struts XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability
8854| [47199] Apache Tomcat HTTP BIO Connector Information Disclosure Vulnerability
8855| [47196] Apache Tomcat Login Constraints Security Bypass Vulnerability
8856| [46974] Apache HttpComponents 'HttpClient' Information Disclosure Vulnerability
8857| [46953] Apache MPM-ITK Module Security Weakness
8858| [46734] Subversion 'mod_dav_svn' Apache Server NULL Pointer Dereference Denial Of Service Vulnerability
8859| [46685] Apache Tomcat '@ServletSecurity' Annotations Security Bypass Vulnerability
8860| [46311] Apache Continuum and Archiva Cross Site Scripting Vulnerability
8861| [46177] Apache Tomcat SecurityManager Security Bypass Vulnerability
8862| [46174] Apache Tomcat HTML Manager Interface HTML Injection Vulnerability
8863| [46166] Apache Tomcat JVM Denial of Service Vulnerability
8864| [46164] Apache Tomcat NIO Connector Denial of Service Vulnerability
8865| [46066] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
8866| [45655] Apache Subversion Server Component Multiple Remote Denial Of Service Vulnerabilities
8867| [45123] Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
8868| [45095] Apache Archiva Cross Site Request Forgery Vulnerability
8869| [45015] Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities
8870| [44900] Apache 'mod_fcgid' Module Unspecified Stack Buffer Overflow Vulnerability
8871| [44616] Apache Shiro Directory Traversal Vulnerability
8872| [44355] Apache MyFaces Encrypted View State Oracle Padding Security Vulnerability
8873| [44068] Apache::AuthenHook Local Information Disclosure Vulnerability
8874| [43862] Apache QPID SSL Connection Denial of Service Vulnerability
8875| [43673] Apache APR-util 'apr_brigade_split_line()' Denial of Service Vulnerability
8876| [43637] Apache XML-RPC SAX Parser Information Disclosure Vulnerability
8877| [43111] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
8878| [42637] Apache Derby 'BUILTIN' Authentication Insecure Password Hashing Vulnerability
8879| [42501] Apache CouchDB Cross Site Request Forgery Vulnerability
8880| [42492] Apache CXF XML DTD Processing Security Vulnerability
8881| [42121] Apache SLMS Insufficient Quoting Cross Site Request Forgery Vulnerability
8882| [42102] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
8883| [41963] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
8884| [41544] Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities
8885| [41076] Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability
8886| [40976] Apache Axis2 Document Type Declaration Processing Security Vulnerability
8887| [40827] Apache 'mod_proxy_http' Timeout Handling Information Disclosure Vulnerability
8888| [40343] Apache Axis2 'xsd' Parameter Directory Traversal Vulnerability
8889| [40327] Apache Axis2 'engagingglobally' Cross-Site Scripting Vulnerability
8890| [39771] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
8891| [39636] Apache ActiveMQ Source Code Information Disclosure Vulnerability
8892| [39635] Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability
8893| [39538] Apache mod_auth_shadow Race Condition Security Bypass Vulnerability
8894| [39489] Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities
8895| [39119] Apache ActiveMQ 'createDestination.action' HTML Injection Vulnerability
8896| [38580] Apache Subrequest Handling Information Disclosure Vulnerability
8897| [38494] Apache 'mod_isapi' Memory Corruption Vulnerability
8898| [38491] Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability
8899| [37966] Apache 1.3 mod_proxy HTTP Chunked Encoding Integer Overflow Vulnerability
8900| [37945] Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability
8901| [37944] Apache Tomcat WAR File Directory Traversal Vulnerability
8902| [37942] Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability
8903| [37149] Apache Tomcat 404 Error Page Cross Site Scripting Vulnerability
8904| [37027] RETIRED: Apache APR 'apr_uri_parse_hostinfo' Off By One Remote Code Execution Vulnerability
8905| [36990] Apache HTTP TRACE Cross Site Scripting Vulnerability
8906| [36954] Apache Tomcat Windows Installer Insecure Password Vulnerability
8907| [36889] TYPO3 Apache Solr Search Extension Unspecified Cross Site Scripting Vulnerability
8908| [36596] Apache HTTP Server Solaris Event Port Pollset Support Remote Denial Of Service Vulnerability
8909| [36260] Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
8910| [36254] Apache mod_proxy_ftp Remote Command Injection Vulnerability
8911| [35949] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
8912| [35840] Apache HTTP Server HTTP-Basic Authentication Bypass Vulnerability
8913| [35623] Apache 'mod_deflate' Remote Denial Of Service Vulnerability
8914| [35565] Apache 'mod_proxy' Remote Denial Of Service Vulnerability
8915| [35416] Apache Tomcat XML Parser Information Disclosure Vulnerability
8916| [35263] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
8917| [35253] Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
8918| [35251] Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
8919| [35221] Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
8920| [35196] Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
8921| [35193] Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
8922| [35115] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
8923| [34686] Apache Struts Multiple Cross Site Scripting Vulnerabilities
8924| [34663] Apache 'mod_proxy_ajp' Information Disclosure Vulnerability
8925| [34657] Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities
8926| [34562] Apache Geronimo Application Server Multiple Remote Vulnerabilities
8927| [34552] Apache ActiveMQ Web Console Multiple Unspecified HTML Injection Vulnerabilities
8928| [34412] Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability
8929| [34399] Apache Struts Unspecified Cross Site Scripting Vulnerability
8930| [34383] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
8931| [33913] Apache Tomcat POST Data Information Disclosure Vulnerability
8932| [33360] Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities
8933| [33110] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
8934| [32657] Novell NetWare ApacheAdmin Security Bypass Vulnerability
8935| [31805] Apache HTTP Server OS Fingerprinting Unspecified Security Vulnerability
8936| [31761] Oracle WebLogic Server Apache Connector Stack Based Buffer Overflow Vulnerability
8937| [31698] Apache Tomcat 'RemoteFilterValve' Security Bypass Vulnerability
8938| [31165] Kolab Groupware Server Apache Log File User Password Information Disclosure Vulnerability
8939| [30560] Apache 'mod_proxy_ftp' Wildcard Characters Cross-Site Scripting Vulnerability
8940| [30496] Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability
8941| [30494] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
8942| [29653] Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
8943| [29502] Apache Tomcat Host Manager Cross Site Scripting Vulnerability
8944| [28576] Apache-SSL Environment Variable Information Disclosure and Privilege Escalation Vulnerability
8945| [28484] Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability
8946| [28483] Apache Tomcat 'allowLinking' Accepts NULL Byte in URI Information Disclosure Vulnerability
8947| [28482] Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability
8948| [28481] Apache Tomcat Cross-Site Scripting Vulnerability
8949| [28477] Apache Tomcat AJP Connector Information Disclosure Vulnerability
8950| [27752] Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulnerabilities
8951| [27706] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
8952| [27703] Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
8953| [27409] Apache 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
8954| [27365] Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
8955| [27237] Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
8956| [27236] Apache 'mod_proxy_balancer' Multiple Vulnerabilities
8957| [27234] Apache 'mod_proxy_ftp' Undefined Charset UTF-7 Cross-Site Scripting Vulnerability
8958| [27006] Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
8959| [26939] Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
8960| [26838] Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
8961| [26762] Apache::AuthCAS Cookie SQL Injection Vulnerability
8962| [26663] Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness
8963| [26287] Apache Geronimo SQLLoginModule Authentication Bypass Vulnerability
8964| [26070] Apache Tomcat WebDav Remote Information Disclosure Vulnerability
8965| [25804] Apache Geronimo Management EJB Security Bypass Vulnerability
8966| [25653] Apache Mod_AutoIndex.C Undefined Charset Cross-Site Scripting Vulnerability
8967| [25531] Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
8968| [25489] Apache HTTP Server Mod_Proxy Denial of Service Vulnerability
8969| [25316] Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
8970| [25314] Apache Tomcat Host Manager Servlet Cross Site Scripting Vulnerability
8971| [25174] Apache Tomcat Error Message Reporting Cross Site Scripting Vulnerability
8972| [24999] Apache Tomcat SendMailServlet Cross-Site Scripting Vulnerability
8973| [24759] MySQLDumper Apache Access Control Authentication Bypass Vulnerability
8974| [24649] Apache HTTP Server Mod_Cache Denial of Service Vulnerability
8975| [24645] Apache HTTP Server Mod_Status Cross-Site Scripting Vulnerability
8976| [24553] Apache Mod_Mem_Cache Information Disclosure Vulnerability
8977| [24524] Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
8978| [24480] Apache MyFaces Tomahawk JSF Framework Autoscroll Parameter Cross Site Scripting Vulnerability
8979| [24476] Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
8980| [24475] Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability
8981| [24215] Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
8982| [24147] Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
8983| [24058] Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
8984| [23687] Apache AXIS Non-Existent WSDL Path Information Disclosure Vulnerability
8985| [23438] Apache HTTPD suEXEC Local Multiple Privilege Escalation Weaknesses
8986| [22960] Apache HTTP Server Tomcat Directory Traversal Vulnerability
8987| [22849] Apache mod_python Output Filter Mode Information Disclosure Vulnerability
8988| [22791] Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability
8989| [22732] Debian Apache Root Shell Local Privilege Escalation Vulnerabilities
8990| [22388] Apache Stats Extract Function Multiple Input Validation Vulnerabilities
8991| [21865] Apache And Microsoft IIS Range Denial of Service Vulnerability
8992| [21214] Apache Mod_Auth_Kerb Off-By-One Denial of Service Vulnerability
8993| [20527] Apache Mod_TCL Remote Format String Vulnerability
8994| [19661] Apache HTTP Server Arbitrary HTTP Request Headers Security Weakness
8995| [19447] Apache CGI Script Source Code Information Disclosure Vulnerability
8996| [19204] Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
8997| [19106] Apache Tomcat Information Disclosure Vulnerability
8998| [18138] Apache James SMTP Denial Of Service Vulnerability
8999| [17342] Apache Struts Multiple Remote Vulnerabilities
9000| [17095] Apache Log4Net Denial Of Service Vulnerability
9001| [16916] Apache mod_python FileSession Code Execution Vulnerability
9002| [16710] Apache Libapreq2 Quadratic Behavior Denial of Service Vulnerability
9003| [16260] Apache Geronimo Multiple Input Validation Vulnerabilities
9004| [16153] Apache mod_auth_pgsql Multiple Format String Vulnerabilities
9005| [16152] Apache Mod_SSL Custom Error Document Remote Denial Of Service Vulnerability
9006| [15834] Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability
9007| [15765] Apache James Spooler Memory Leak Denial Of Service Vulnerability
9008| [15762] Apache MPM Worker.C Denial Of Service Vulnerability
9009| [15512] Apache Struts Error Response Cross-Site Scripting Vulnerability
9010| [15413] PHP Apache 2 Virtual() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
9011| [15325] Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
9012| [15224] Apache Mod_Auth_Shadow Authentication Bypass Vulnerability
9013| [15177] PHP Apache 2 Local Denial of Service Vulnerability
9014| [14982] ApacheTop Insecure Temporary File Creation Vulnerability
9015| [14721] Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
9016| [14660] Apache CGI Byterange Request Denial of Service Vulnerability
9017| [14366] Apache mod_ssl CRL Handling Off-By-One Buffer Overflow Vulnerability
9018| [14106] Apache HTTP Request Smuggling Vulnerability
9019| [13778] Apache HTPasswd Password Command Line Argument Buffer Overflow Vulnerability
9020| [13777] Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability
9021| [13756] Apache Tomcat Java Security Manager Bypass Vulnerability
9022| [13537] Apache HTDigest Realm Command Line Argument Buffer Overflow Vulnerability
9023| [12877] Apache mod_ssl ssl_io_filter_cleanup Remote Denial Of Service Vulnerability
9024| [12795] Apache Tomcat Remote Malformed Request Denial Of Service Vulnerability
9025| [12619] Apache Software Foundation Batik Squiggle Browser Access Validation Vulnerability
9026| [12519] Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
9027| [12308] Apache Utilities Insecure Temporary File Creation Vulnerability
9028| [12217] Apache mod_auth_radius Malformed RADIUS Server Reply Integer Overflow Vulnerability
9029| [12181] Mod_DOSEvasive Apache Module Local Insecure Temporary File Creation Vulnerability
9030| [11803] Apache Jakarta Results.JSP Remote Cross-Site Scripting Vulnerability
9031| [11471] Apache mod_include Local Buffer Overflow Vulnerability
9032| [11360] Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
9033| [11239] Apache Satisfy Directive Access Control Bypass Vulnerability
9034| [11187] Apache Web Server Remote IPv6 Buffer Overflow Vulnerability
9035| [11185] Apache Mod_DAV LOCK Denial Of Service Vulnerability
9036| [11182] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
9037| [11154] Apache mod_ssl Remote Denial of Service Vulnerability
9038| [11094] Apache mod_ssl Denial Of Service Vulnerability
9039| [10789] Apache mod_userdir Module Information Disclosure Vulnerability
9040| [10736] Apache 'mod_ssl' Log Function Format String Vulnerability
9041| [10619] Apache ap_escape_html Memory Allocation Denial Of Service Vulnerability
9042| [10508] Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
9043| [10478] ClueCentral Apache Suexec Patch Security Weakness
9044| [10355] Apache 'mod_ssl' 'ssl_util_uuencode_binary()' Stack Buffer Overflow Vulnerability
9045| [10212] Apache mod_auth Malformed Password Potential Memory Corruption Vulnerability
9046| [9933] Apache mod_disk_cache Module Client Authentication Credential Storage Weakness
9047| [9930] Apache Error and Access Logs Escape Sequence Injection Vulnerability
9048| [9921] Apache Connection Blocking Denial Of Service Vulnerability
9049| [9885] Apache Mod_Security Module SecFilterScanPost Off-By-One Buffer Overflow Vulnerability
9050| [9874] Apache HTAccess LIMIT Directive Bypass Configuration Error Weakness
9051| [9829] Apache Mod_Access Access Control Rule Bypass Vulnerability
9052| [9826] Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnerability
9053| [9733] Apache Cygwin Directory Traversal Vulnerability
9054| [9599] Apache mod_php Global Variables Information Disclosure Weakness
9055| [9590] Apache-SSL Client Certificate Forging Vulnerability
9056| [9571] Apache mod_digest Client-Supplied Nonce Verification Vulnerability
9057| [9471] Apache mod_perl Module File Descriptor Leakage Vulnerability
9058| [9404] Mod-Auth-Shadow Apache Module Expired User Credential Weakness
9059| [9302] Apache mod_php Module File Descriptor Leakage Vulnerability
9060| [9129] Apache mod_python Module Malformed Query Denial of Service Vulnerability
9061| [8926] Apache Web Server mod_cgid Module CGI Data Redirection Vulnerability
9062| [8919] Apache Mod_Security Module Heap Corruption Vulnerability
9063| [8911] Apache Web Server Multiple Module Local Buffer Overflow Vulnerability
9064| [8898] Red Hat Apache Directory Index Default Configuration Error
9065| [8883] Apache Cocoon Directory Traversal Vulnerability
9066| [8824] Apache Tomcat Non-HTTP Request Denial Of Service Vulnerability
9067| [8822] Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
9068| [8725] Apache2 MOD_CGI STDERR Denial Of Service Vulnerability
9069| [8707] Apache htpasswd Password Entropy Weakness
9070| [8561] Apache::Gallery Insecure Local File Storage Privilege Escalation Vulnerability
9071| [8287] Mod_Mylo Apache Module REQSTR Buffer Overflow Vulnerability
9072| [8226] Apache HTTP Server Multiple Vulnerabilities
9073| [8138] Apache Web Server Type-Map Recursive Loop Denial Of Service Vulnerability
9074| [8137] Apache Web Server Prefork MPM Denial Of Service Vulnerability
9075| [8136] Macromedia Apache Web Server Encoded Space Source Disclosure Vulnerability
9076| [8135] Apache Web Server FTP Proxy IPV6 Denial Of Service Vulnerability
9077| [8134] Apache Web Server SSLCipherSuite Weak CipherSuite Renegotiation Weakness
9078| [7768] Apache Tomcat Insecure Directory Permissions Vulnerability
9079| [7725] Apache Basic Authentication Module Valid User Login Denial Of Service Vulnerability
9080| [7723] Apache APR_PSPrintf Memory Corruption Vulnerability
9081| [7448] Apache Mod_Auth_Any Remote Command Execution Vulnerability
9082| [7375] Apache Mod_Access_Referer NULL Pointer Dereference Denial of Service Vulnerability
9083| [7332] Apache Web Server OS2 Filestat Denial Of Service Vulnerability
9084| [7255] Apache Web Server File Descriptor Leakage Vulnerability
9085| [7254] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
9086| [6943] Apache Web Server MIME Boundary Information Disclosure Vulnerability
9087| [6939] Apache Web Server ETag Header Information Disclosure Weakness
9088| [6722] Apache Tomcat Web.XML File Contents Disclosure Vulnerability
9089| [6721] Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
9090| [6720] Apache Tomcat Example Web Application Cross Site Scripting Vulnerability
9091| [6662] Apache Web Server MS-DOS Device Name Denial Of Service Vulnerability
9092| [6661] Apache Web Server Default Script Mapping Bypass Vulnerability
9093| [6660] Apache Web Server Illegal Character HTTP Request File Disclosure Vulnerability
9094| [6659] Apache Web Server MS-DOS Device Name Arbitrary Code Execution Vulnerability
9095| [6562] Apache Tomcat Invoker Servlet File Disclosure Vulnerability
9096| [6320] Apache/Tomcat Mod_JK Chunked Encoding Denial Of Service Vulnerability
9097| [6117] Apache mod_php File Descriptor Leakage Vulnerability
9098| [6065] Apache 2 WebDAV CGI POST Request Information Disclosure Vulnerability
9099| [5996] Apache AB.C Web Benchmarking Buffer Overflow Vulnerability
9100| [5995] Apache AB.C Web Benchmarking Read_Connection() Buffer Overflow Vulnerability
9101| [5993] Multiple Apache HTDigest Buffer Overflow Vulnerabilities
9102| [5992] Apache HTDigest Insecure Temporary File Vulnerability
9103| [5991] Apache HTDigest Arbitrary Command Execution Vulnerability
9104| [5990] Apache HTPasswd Insecure Temporary File Vulnerability
9105| [5981] Multiple Apache HTDigest and HTPassWD Component Vulnerabilites
9106| [5884] Apache Web Server Scoreboard Memory Segment Overwriting SIGUSR1 Sending Vulnerability
9107| [5847] Apache Server Side Include Cross Site Scripting Vulnerability
9108| [5838] Apache Tomcat 3.2 Directory Disclosure Vulnerability
9109| [5816] Apache 2 mod_dav Denial Of Service Vulnerability
9110| [5791] HP VirtualVault Apache mod_ssl Denial Of Service Vulnerability
9111| [5787] Apache Oversized STDERR Buffer Denial Of Service Vulnerability
9112| [5786] Apache Tomcat DefaultServlet File Disclosure Vulnerability
9113| [5542] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
9114| [5486] Apache 2.0 CGI Path Disclosure Vulnerability
9115| [5485] Apache 2.0 Path Disclosure Vulnerability
9116| [5434] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
9117| [5256] Apache httpd 2.0 CGI Error Path Disclosure Vulnerability
9118| [5194] Apache Tomcat DOS Device Name Cross Site Scripting Vulnerability
9119| [5193] Apache Tomcat Servlet Mapping Cross Site Scripting Vulnerability
9120| [5067] Apache Tomcat Null Character Malformed Request Denial Of Service Vulnerability
9121| [5054] Apache Tomcat Web Root Path Disclosure Vulnerability
9122| [5033] Apache Chunked-Encoding Memory Corruption Vulnerability
9123| [4995] Apache Tomcat JSP Engine Denial of Service Vulnerability
9124| [4878] Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
9125| [4877] Apache Tomcat Example Files Web Root Path Disclosure Vulnerability
9126| [4876] Apache Tomcat Source.JSP Malformed Request Information Disclosure Vulnerability
9127| [4575] Apache Tomcat Servlet Path Disclosure Vulnerability
9128| [4557] Apache Tomcat System Path Information Disclosure Vulnerability
9129| [4437] Apache Error Message Cross-Site Scripting Vulnerability
9130| [4431] Apache PrintEnv/Test_CGI Script Injection Vulnerability
9131| [4358] Apache Double-Reverse Lookup Log Entry Spoofing Vulnerability
9132| [4335] Apache Win32 Batch File Remote Command Execution Vulnerability
9133| [4292] Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
9134| [4189] Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
9135| [4057] Apache 2 for Windows OPTIONS request Path Disclosure Vulnerability
9136| [4056] Apache 2 for Windows php.exe Path Disclosure Vulnerability
9137| [4037] Oracle 9iAS Apache PL/SQL Module Denial of Service Vulnerability
9138| [4032] Oracle 9iAS Apache PL/SQL Module Multiple Buffer Overflows Vulnerability
9139| [3796] Apache HTTP Request Unexpected Behavior Vulnerability
9140| [3790] Apache Non-Existent Log Directory Denial Of Service Vulnerability
9141| [3786] Apache Win32 PHP.EXE Remote File Disclosure Vulnerability
9142| [3727] Oracle 9I Application Server PL/SQL Apache Module Directory Traversal Vulnerability
9143| [3726] Oracle 9I Application Server PL/SQL Apache Module Buffer Overflow Vulnerability
9144| [3596] Apache Split-Logfile File Append Vulnerability
9145| [3521] Apache mod_usertrack Predictable ID Generation Vulnerability
9146| [3335] Red Hat Linux Apache Remote Username Enumeration Vulnerability
9147| [3316] MacOS X Client Apache Directory Contents Disclosure Vulnerability
9148| [3256] Apache mod_auth_oracle Remote SQL Query Manipulation Vulnerability
9149| [3255] Apache mod_auth_mysql Remote SQL Query Manipulation Vulnerability
9150| [3254] Apache AuthPG Remote SQL Query Manipulation Vulnerability
9151| [3253] Apache mod_auth_pgsql_sys Remote SQL Query Manipulation Vulnerability
9152| [3251] Apache mod_auth_pgsql Remote SQL Query Manipulation Vulnerability
9153| [3176] Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
9154| [3169] Apache Server Address Disclosure Vulnerability
9155| [3009] Apache Possible Directory Index Disclosure Vulnerability
9156| [2982] Apache Tomcat Cross-Site Scripting Vulnerability
9157| [2852] MacOS X Client Apache File Protection Bypass Vulnerability
9158| [2740] Apache Web Server HTTP Request Denial of Service Vulnerability
9159| [2518] Apache Tomcat 3.0 Directory Traversal Vulnerability
9160| [2503] Apache Artificially Long Slash Path Directory Listing Vulnerability
9161| [2300] NCSA/Apache httpd ScriptAlias Source Retrieval Vulnerability
9162| [2216] Apache Web Server DoS Vulnerability
9163| [2182] Apache /tmp File Race Vulnerability
9164| [2171] Oracle Apache+WebDB Documented Backdoor Vulnerability
9165| [2060] Apache Web Server with Php 3 File Disclosure Vulnerability
9166| [1821] Apache mod_cookies Buffer Overflow Vulnerability
9167| [1728] Apache Rewrite Module Arbitrary File Disclosure Vulnerability
9168| [1658] SuSE Apache CGI Source Code Viewing Vulnerability
9169| [1656] SuSE Apache WebDAV Directory Listings Vulnerability
9170| [1575] Trustix Apache-SSL RPM Permissions Vulnerability
9171| [1548] Apache Jakarta-Tomcat /admin Context Vulnerability
9172| [1532] Apache Tomcat Snoop Servlet Information Disclosure Vulnerability
9173| [1531] Apache Tomcat 3.1 Path Revealing Vulnerability
9174| [1457] Apache::ASP source.asp Example Script Vulnerability
9175| [1284] Apache HTTP Server (win32) Root Directory Access Vulnerability
9176| [1083] Cobalt Raq Apache .htaccess Disclosure Vulnerability
9177|
9178| IBM X-Force - https://exchange.xforce.ibmcloud.com:
9179| [86258] Apache CloudStack text fields cross-site scripting
9180| [85983] Apache Subversion mod_dav_svn module denial of service
9181| [85875] Apache OFBiz UEL code execution
9182| [85874] Apache OFBiz Webtools View Log screen cross-site scripting
9183| [85871] Apache HTTP Server mod_session_dbd unspecified
9184| [85756] Apache Struts OGNL expression command execution
9185| [85755] Apache Struts DefaultActionMapper class open redirect
9186| [85586] Apache ActiveMQ CVE-2013-1879 cross-site scripting
9187| [85574] Apache HTTP Server mod_dav denial of service
9188| [85573] Apache Struts Showcase App OGNL code execution
9189| [85496] Apache CXF denial of service
9190| [85423] Apache Geronimo RMI classloader code execution
9191| [85326] Apache Santuario XML Security for C++ buffer overflow
9192| [85323] Apache Santuario XML Security for Java spoofing
9193| [85319] Apache Qpid Python client SSL spoofing
9194| [85019] Apache Santuario XML Security for C++ CVE-2013-2156 buffer overflow
9195| [85018] Apache Santuario XML Security for C++ CVE-2013-2155 denial of service
9196| [85017] Apache Santuario XML Security for C++ CVE-2013-2154 buffer overflow
9197| [85016] Apache Santuario XML Security for C++ CVE-2013-2153 spoofing
9198| [84952] Apache Tomcat CVE-2012-3544 denial of service
9199| [84763] Apache Struts CVE-2013-2135 security bypass
9200| [84762] Apache Struts CVE-2013-2134 security bypass
9201| [84719] Apache Subversion CVE-2013-2088 command execution
9202| [84718] Apache Subversion CVE-2013-2112 denial of service
9203| [84717] Apache Subversion CVE-2013-1968 denial of service
9204| [84577] Apache Tomcat security bypass
9205| [84576] Apache Tomcat symlink
9206| [84543] Apache Struts CVE-2013-2115 security bypass
9207| [84542] Apache Struts CVE-2013-1966 security bypass
9208| [84154] Apache Tomcat session hijacking
9209| [84144] Apache Tomcat denial of service
9210| [84143] Apache Tomcat information disclosure
9211| [84111] Apache HTTP Server command execution
9212| [84043] Apache Virtual Computing Lab cross-site scripting
9213| [84042] Apache Virtual Computing Lab cross-site scripting
9214| [83782] Apache CloudStack information disclosure
9215| [83781] Apache CloudStack security bypass
9216| [83720] Apache ActiveMQ cross-site scripting
9217| [83719] Apache ActiveMQ denial of service
9218| [83718] Apache ActiveMQ denial of service
9219| [83263] Apache Subversion denial of service
9220| [83262] Apache Subversion denial of service
9221| [83261] Apache Subversion denial of service
9222| [83259] Apache Subversion denial of service
9223| [83035] Apache mod_ruid2 security bypass
9224| [82852] Apache Qpid federation_tag security bypass
9225| [82851] Apache Qpid qpid::framing::Buffer denial of service
9226| [82758] Apache Rave User RPC API information disclosure
9227| [82663] Apache Subversion svn_fs_file_length() denial of service
9228| [82642] Apache Qpid qpid::framing::Buffer::checkAvailable() denial of service
9229| [82641] Apache Qpid AMQP denial of service
9230| [82626] Apache HTTP Server on Debian GNU/Linux Debian apache2ctl symlink
9231| [82618] Apache Commons FileUpload symlink
9232| [82360] Apache HTTP Server manager interface cross-site scripting
9233| [82359] Apache HTTP Server hostnames cross-site scripting
9234| [82338] Apache Tomcat log/logdir information disclosure
9235| [82328] Apache Maven and Apache Maven Wagon SSL spoofing
9236| [82268] Apache OpenJPA deserialization command execution
9237| [81981] Apache CXF UsernameTokens security bypass
9238| [81980] Apache CXF WS-Security security bypass
9239| [81398] Apache OFBiz cross-site scripting
9240| [81240] Apache CouchDB directory traversal
9241| [81226] Apache CouchDB JSONP code execution
9242| [81225] Apache CouchDB Futon user interface cross-site scripting
9243| [81211] Apache Axis2/C SSL spoofing
9244| [81167] Apache CloudStack DeployVM information disclosure
9245| [81166] Apache CloudStack AddHost API information disclosure
9246| [81165] Apache CloudStack createSSHKeyPair API information disclosure
9247| [80518] Apache Tomcat cross-site request forgery security bypass
9248| [80517] Apache Tomcat FormAuthenticator security bypass
9249| [80516] Apache Tomcat NIO denial of service
9250| [80408] Apache Tomcat replay-countermeasure security bypass
9251| [80407] Apache Tomcat HTTP Digest Access Authentication security bypass
9252| [80317] Apache Tomcat slowloris denial of service
9253| [79984] Apache Commons HttpClient SSL spoofing
9254| [79983] Apache CXF SSL spoofing
9255| [79830] Apache Axis2/Java SSL spoofing
9256| [79829] Apache Axis SSL spoofing
9257| [79809] Apache Tomcat DIGEST security bypass
9258| [79806] Apache Tomcat parseHeaders() denial of service
9259| [79540] Apache OFBiz unspecified
9260| [79487] Apache Axis2 SAML security bypass
9261| [79212] Apache Cloudstack code execution
9262| [78734] Apache CXF SOAP Action security bypass
9263| [78730] Apache Qpid broker denial of service
9264| [78617] Eucalyptus Apache Santuario (XML Security for Java) denial of service
9265| [78563] Apache mod_pagespeed module unspecified cross-site scripting
9266| [78562] Apache mod_pagespeed module security bypass
9267| [78454] Apache Axis2 security bypass
9268| [78452] Websense Web Security and Web Filter Apache Tomcat information disclosure
9269| [78451] Websense Web Security and Web Filter Apache Tomcat cross-site scripting
9270| [78321] Apache Wicket unspecified cross-site scripting
9271| [78183] Apache Struts parameters denial of service
9272| [78182] Apache Struts cross-site request forgery
9273| [78153] Apache Solr Autocomplete module for Drupal autocomplete results cross-site scripting
9274| [77987] mod_rpaf module for Apache denial of service
9275| [77958] Apache Struts skill name code execution
9276| [77914] Apache HTTP Server mod_negotiation module cross-site scripting
9277| [77913] Apache HTTP Server mod_proxy_ajp information disclosure
9278| [77568] Apache Qpid broker security bypass
9279| [77421] Apache Libcloud spoofing
9280| [77059] Oracle Solaris Cluster Apache Tomcat Agent unspecified
9281| [77046] Oracle Solaris Apache HTTP Server information disclosure
9282| [76837] Apache Hadoop information disclosure
9283| [76802] Apache Sling CopyFrom denial of service
9284| [76692] Apache Hadoop symlink
9285| [76535] Apache Roller console cross-site request forgery
9286| [76534] Apache Roller weblog cross-site scripting
9287| [76152] Apache CXF elements security bypass
9288| [76151] Apache CXF child policies security bypass
9289| [75983] MapServer for Windows Apache file include
9290| [75857] Apache Commons Compress and Apache Ant bzip2 denial of service
9291| [75558] Apache POI denial of service
9292| [75545] PHP apache_request_headers() buffer overflow
9293| [75302] Apache Qpid SASL security bypass
9294| [75211] Debian GNU/Linux apache 2 cross-site scripting
9295| [74901] Apache HTTP Server LD_LIBRARY_PATH privilege escalation
9296| [74871] Apache OFBiz FlexibleStringExpander code execution
9297| [74870] Apache OFBiz multiple cross-site scripting
9298| [74750] Apache Hadoop unspecified spoofing
9299| [74319] Apache Struts XSLTResult.java file upload
9300| [74313] Apache Traffic Server header buffer overflow
9301| [74276] Apache Wicket directory traversal
9302| [74273] Apache Wicket unspecified cross-site scripting
9303| [74181] Apache HTTP Server mod_fcgid module denial of service
9304| [73690] Apache Struts OGNL code execution
9305| [73432] Apache Solr extension for TYPO3 unspecified cross-site scripting
9306| [73100] Apache MyFaces in directory traversal
9307| [73096] Apache APR hash denial of service
9308| [73052] Apache Struts name cross-site scripting
9309| [73030] Apache CXF UsernameToken security bypass
9310| [72888] Apache Struts lastName cross-site scripting
9311| [72758] Apache HTTP Server httpOnly information disclosure
9312| [72757] Apache HTTP Server MPM denial of service
9313| [72585] Apache Struts ParameterInterceptor security bypass
9314| [72438] Apache Tomcat Digest security bypass
9315| [72437] Apache Tomcat Digest security bypass
9316| [72436] Apache Tomcat DIGEST security bypass
9317| [72425] Apache Tomcat parameter denial of service
9318| [72422] Apache Tomcat request object information disclosure
9319| [72377] Apache HTTP Server scoreboard security bypass
9320| [72345] Apache HTTP Server HTTP request denial of service
9321| [72229] Apache Struts ExceptionDelegator command execution
9322| [72089] Apache Struts ParameterInterceptor directory traversal
9323| [72088] Apache Struts CookieInterceptor command execution
9324| [72047] Apache Geronimo hash denial of service
9325| [72016] Apache Tomcat hash denial of service
9326| [71711] Apache Struts OGNL expression code execution
9327| [71654] Apache Struts interfaces security bypass
9328| [71620] Apache ActiveMQ failover denial of service
9329| [71617] Apache HTTP Server mod_proxy module information disclosure
9330| [71508] Apache MyFaces EL security bypass
9331| [71445] Apache HTTP Server mod_proxy security bypass
9332| [71203] Apache Tomcat servlets privilege escalation
9333| [71181] Apache HTTP Server ap_pregsub() denial of service
9334| [71093] Apache HTTP Server ap_pregsub() buffer overflow
9335| [70336] Apache HTTP Server mod_proxy information disclosure
9336| [69804] Apache HTTP Server mod_proxy_ajp denial of service
9337| [69472] Apache Tomcat AJP security bypass
9338| [69396] Apache HTTP Server ByteRange filter denial of service
9339| [69394] Apache Wicket multi window support cross-site scripting
9340| [69176] Apache Tomcat XML information disclosure
9341| [69161] Apache Tomcat jsvc information disclosure
9342| [68799] mod_authnz_external module for Apache mysql-auth.pl SQL injection
9343| [68541] Apache Tomcat sendfile information disclosure
9344| [68420] Apache XML Security denial of service
9345| [68238] Apache Tomcat JMX information disclosure
9346| [67860] Apache Rampart/C rampart_timestamp_token_validate security bypass
9347| [67804] Apache Subversion control rules information disclosure
9348| [67803] Apache Subversion control rules denial of service
9349| [67802] Apache Subversion baselined denial of service
9350| [67672] Apache Archiva multiple cross-site scripting
9351| [67671] Apache Archiva multiple cross-site request forgery
9352| [67564] Apache APR apr_fnmatch() denial of service
9353| [67532] IBM WebSphere Application Server org.apache.jasper.runtime.JspWriterImpl.response denial of service
9354| [67515] Apache Tomcat annotations security bypass
9355| [67480] Apache Struts s:submit information disclosure
9356| [67414] Apache APR apr_fnmatch() denial of service
9357| [67356] Apache Struts javatemplates cross-site scripting
9358| [67354] Apache Struts Xwork cross-site scripting
9359| [66676] Apache Tomcat HTTP BIO information disclosure
9360| [66675] Apache Tomcat web.xml security bypass
9361| [66640] Apache HttpComponents HttpClient Proxy-Authorization information disclosure
9362| [66241] Apache HttpComponents information disclosure
9363| [66154] Apache Tomcat ServletSecurity security bypass
9364| [65971] Apache Tomcat ServletSecurity security bypass
9365| [65876] Apache Subversion mod_dav_svn denial of service
9366| [65343] Apache Continuum unspecified cross-site scripting
9367| [65162] Apache Tomcat NIO connector denial of service
9368| [65161] Apache Tomcat javax.servlet.ServletRequest.getLocale() denial of service
9369| [65160] Apache Tomcat HTML Manager interface cross-site scripting
9370| [65159] Apache Tomcat ServletContect security bypass
9371| [65050] Apache CouchDB web-based administration UI cross-site scripting
9372| [64773] Oracle HTTP Server Apache Plugin unauthorized access
9373| [64473] Apache Subversion blame -g denial of service
9374| [64472] Apache Subversion walk() denial of service
9375| [64407] Apache Axis2 CVE-2010-0219 code execution
9376| [63926] Apache Archiva password privilege escalation
9377| [63785] Apache CouchDB LD_LIBRARY_PATH privilege escalation
9378| [63493] Apache Archiva credentials cross-site request forgery
9379| [63477] Apache Tomcat HttpOnly session hijacking
9380| [63422] Apache Tomcat sessionsList.jsp cross-site scripting
9381| [63303] Apache mod_fcgid module fcgid_header_bucket_read() buffer overflow
9382| [62959] Apache Shiro filters security bypass
9383| [62790] Apache Perl cgi module denial of service
9384| [62576] Apache Qpid exchange denial of service
9385| [62575] Apache Qpid AMQP denial of service
9386| [62354] Apache Qpid SSL denial of service
9387| [62235] Apache APR-util apr_brigade_split_line() denial of service
9388| [62181] Apache XML-RPC SAX Parser information disclosure
9389| [61721] Apache Traffic Server cache poisoning
9390| [61202] Apache Derby BUILTIN authentication functionality information disclosure
9391| [61186] Apache CouchDB Futon cross-site request forgery
9392| [61169] Apache CXF DTD denial of service
9393| [61070] Apache Jackrabbit search.jsp SQL injection
9394| [61006] Apache SLMS Quoting cross-site request forgery
9395| [60962] Apache Tomcat time cross-site scripting
9396| [60883] Apache mod_proxy_http information disclosure
9397| [60671] Apache HTTP Server mod_cache and mod_dav denial of service
9398| [60264] Apache Tomcat Transfer-Encoding denial of service
9399| [59746] Apache Axis2 axis2/axis2-admin page session hijacking
9400| [59588] Apache Axis2/Java XML DTD (Document Type Declaration) data denial of service
9401| [59413] Apache mod_proxy_http timeout information disclosure
9402| [59058] Apache MyFaces unencrypted view state cross-site scripting
9403| [58827] Apache Axis2 xsd file include
9404| [58790] Apache Axis2 modules cross-site scripting
9405| [58299] Apache ActiveMQ queueBrowse cross-site scripting
9406| [58169] Apache Tomcat Web Application Manager / Host Manager cross-site request forgery
9407| [58056] Apache ActiveMQ .jsp source code disclosure
9408| [58055] Apache Tomcat realm name information disclosure
9409| [58046] Apache HTTP Server mod_auth_shadow security bypass
9410| [57841] Apache Open For Business Project (OFBiz) subject cross-site scripting
9411| [57840] Apache Open For Business Project (OFBiz) multiple parameters cross-site scripting
9412| [57429] Apache CouchDB algorithms information disclosure
9413| [57398] Apache ActiveMQ Web console cross-site request forgery
9414| [57397] Apache ActiveMQ createDestination.action cross-site scripting
9415| [56653] Apache HTTP Server DNS spoofing
9416| [56652] Apache HTTP Server DNS cross-site scripting
9417| [56625] Apache HTTP Server request header information disclosure
9418| [56624] Apache HTTP Server mod_isapi orphaned callback pointer code execution
9419| [56623] Apache HTTP Server mod_proxy_ajp denial of service
9420| [55941] mod_proxy module for Apache ap_proxy_send_fb() buffer overflow
9421| [55857] Apache Tomcat WAR files directory traversal
9422| [55856] Apache Tomcat autoDeploy attribute security bypass
9423| [55855] Apache Tomcat WAR directory traversal
9424| [55210] Intuit component for Joomla! Apache information disclosure
9425| [54533] Apache Tomcat 404 error page cross-site scripting
9426| [54182] Apache Tomcat admin default password
9427| [53878] Apache Solr Search (solr) extension for TYPO3 unspecified cross-site scripting
9428| [53666] Apache HTTP Server Solaris pollset support denial of service
9429| [53650] Apache HTTP Server HTTP basic-auth module security bypass
9430| [53124] mod_proxy_ftp module for Apache HTTP header security bypass
9431| [53041] mod_proxy_ftp module for Apache denial of service
9432| [52540] Apache Portable Runtime and Apache Portable Utility library multiple buffer overflow
9433| [51953] Apache Tomcat Path Disclosure
9434| [51952] Apache Tomcat Path Traversal
9435| [51951] Apache stronghold-status Information Disclosure
9436| [51950] Apache stronghold-info Information Disclosure
9437| [51949] Apache PHP Source Code Disclosure
9438| [51948] Apache Multiviews Attack
9439| [51946] Apache JServ Environment Status Information Disclosure
9440| [51945] Apache error_log Information Disclosure
9441| [51944] Apache Default Installation Page Pattern Found
9442| [51943] Apache AXIS XML Parser echoheaders.jws Sample Web Service Denial of Service
9443| [51942] Apache AXIS XML External Entity File Retrieval
9444| [51941] Apache AXIS Sample Servlet Information Leak
9445| [51940] Apache access_log Information Disclosure
9446| [51626] Apache mod_deflate denial of service
9447| [51532] mod_proxy module for the Apache HTTP Server stream_reqbody_cl denial of service
9448| [51365] Apache Tomcat RequestDispatcher security bypass
9449| [51273] Apache HTTP Server Incomplete Request denial of service
9450| [51195] Apache Tomcat XML information disclosure
9451| [50994] Apache APR-util xml/apr_xml.c denial of service
9452| [50993] Apache APR-util apr_brigade_vprintf denial of service
9453| [50964] Apache APR-util apr_strmatch_precompile() denial of service
9454| [50930] Apache Tomcat j_security_check information disclosure
9455| [50928] Apache Tomcat AJP denial of service
9456| [50884] Apache HTTP Server XML ENTITY denial of service
9457| [50808] Apache HTTP Server AllowOverride privilege escalation
9458| [50108] Apache Struts s:a tag and s:url tag cross-site scripting
9459| [50059] Apache mod_proxy_ajp information disclosure
9460| [49951] Apache Tiles Expression Language (EL) expressions cross-site scripting
9461| [49925] Apache Geronimo Web Administrative Console cross-site request forgery
9462| [49924] Apache Geronimo console/portal/Server/Monitoring cross-site scripting
9463| [49921] Apache ActiveMQ Web interface cross-site scripting
9464| [49898] Apache Geronimo Services/Repository directory traversal
9465| [49725] Apache Tomcat mod_jk module information disclosure
9466| [49715] Apache mod_perl Apache::Status and Apache2::Status modules cross-site scripting
9467| [49712] Apache Struts unspecified cross-site scripting
9468| [49213] Apache Tomcat cal2.jsp cross-site scripting
9469| [48934] Apache Tomcat POST doRead method information disclosure
9470| [48211] Apache Tomcat header HTTP request smuggling
9471| [48163] libapache2-mod-auth-mysql module for Debian multibyte encoding SQL injection
9472| [48110] Apache Jackrabbit search.jsp and swr.jsp cross-site scripting
9473| [47709] Apache Roller "
9474| [47104] Novell Netware ApacheAdmin console security bypass
9475| [47086] Apache HTTP Server OS fingerprinting unspecified
9476| [46329] Apache Struts FilterDispatcher and DefaultStaticContentLoader class directory traversal
9477| [45791] Apache Tomcat RemoteFilterValve security bypass
9478| [44435] Oracle WebLogic Apache Connector buffer overflow
9479| [44411] Apache Tomcat allowLinking UTF-8 directory traversal
9480| [44223] Apache HTTP Server mod_proxy_ftp cross-site scripting
9481| [44156] Apache Tomcat RequestDispatcher directory traversal
9482| [44155] Apache Tomcat HttpServletResponse.sendError() cross-site scripting
9483| [43885] Oracle WebLogic Server Apache Connector buffer overflow
9484| [42987] Apache HTTP Server mod_proxy module denial of service
9485| [42915] Apache Tomcat JSP files path disclosure
9486| [42914] Apache Tomcat MS-DOS path disclosure
9487| [42892] Apache Tomcat unspecified unauthorized access
9488| [42816] Apache Tomcat Host Manager cross-site scripting
9489| [42303] Apache 403 error cross-site scripting
9490| [41618] Apache-SSL ExpandCert() authentication bypass
9491| [40761] Apache Derby RDBNAM parameter and DatabaseMetaData.getURL information disclosure
9492| [40736] Apache Tomcat HTTP/1.1 connector information disclosure
9493| [40614] Apache mod_jk2 HTTP Host header buffer overflow
9494| [40562] Apache Geronimo init information disclosure
9495| [40478] Novell Web Manager webadmin-apache.conf security bypass
9496| [40411] Apache Tomcat exception handling information disclosure
9497| [40409] Apache Tomcat native (APR based) connector weak security
9498| [40403] Apache Tomcat quotes and %5C cookie information disclosure
9499| [40388] Sun Java Plug-In org.apache.crimson.tree.XmlDocument security bypass
9500| [39893] Apache HTTP Server mod_negotiation HTTP response splitting
9501| [39867] Apache HTTP Server mod_negotiation cross-site scripting
9502| [39804] Apache Tomcat SingleSignOn information disclosure
9503| [39615] Apache HTTP Server mod_proxy_ftp.c UTF-7 cross-site scripting
9504| [39612] Apache HTTP Server mod_proxy_balancer buffer overflow
9505| [39608] Apache HTTP Server balancer manager cross-site request forgery
9506| [39476] Apache mod_proxy_balancer balancer_handler function denial of service
9507| [39474] Apache HTTP Server mod_proxy_balancer cross-site scripting
9508| [39472] Apache HTTP Server mod_status cross-site scripting
9509| [39201] Apache Tomcat JULI logging weak security
9510| [39158] Apache HTTP Server Windows SMB shares information disclosure
9511| [39001] Apache HTTP Server mod_imap and mod_imagemap module cross-site scripting
9512| [38951] Apache::AuthCAS Perl module cookie SQL injection
9513| [38800] Apache HTTP Server 413 error page cross-site scripting
9514| [38211] Apache Geronimo SQLLoginModule authentication bypass
9515| [37243] Apache Tomcat WebDAV directory traversal
9516| [37178] RHSA update for Apache HTTP Server mod_status module cross-site scripting not installed
9517| [37177] RHSA update for Apache HTTP Server Apache child process denial of service not installed
9518| [37119] RHSA update for Apache mod_auth_kerb off-by-one buffer overflow not installed
9519| [37100] RHSA update for Apache and IBM HTTP Server Expect header cross-site scripting not installed
9520| [36782] Apache Geronimo MEJB unauthorized access
9521| [36586] Apache HTTP Server UTF-7 cross-site scripting
9522| [36468] Apache Geronimo LoginModule security bypass
9523| [36467] Apache Tomcat functions.jsp cross-site scripting
9524| [36402] Apache Tomcat calendar cross-site request forgery
9525| [36354] Apache HTTP Server mod_proxy module denial of service
9526| [36352] Apache HTTP Server ap_proxy_date_canon() denial of service
9527| [36336] Apache Derby lock table privilege escalation
9528| [36335] Apache Derby schema privilege escalation
9529| [36006] Apache Tomcat "
9530| [36001] Apache Tomcat Host Manager Servlet alias cross-site scripting
9531| [35999] Apache Tomcat \"
9532| [35795] Apache Tomcat CookieExample cross-site scripting
9533| [35536] Apache Tomcat SendMailServlet example cross-site scripting
9534| [35384] Apache HTTP Server mod_cache module denial of service
9535| [35097] Apache HTTP Server mod_status module cross-site scripting
9536| [35095] Apache HTTP Server Prefork MPM module denial of service
9537| [34984] Apache HTTP Server recall_headers information disclosure
9538| [34966] Apache HTTP Server MPM content spoofing
9539| [34965] Apache HTTP Server MPM information disclosure
9540| [34963] Apache HTTP Server MPM multiple denial of service
9541| [34872] Apache MyFaces Tomahawk autoscroll parameter cross-site scripting
9542| [34869] Apache Tomcat JSP example Web application cross-site scripting
9543| [34868] Apache Tomcat Manager and Host Manager cross-site scripting
9544| [34496] Apache Tomcat JK Connector security bypass
9545| [34377] Apache Tomcat hello.jsp cross-site scripting
9546| [34212] Apache Tomcat SSL configuration security bypass
9547| [34210] Apache Tomcat Accept-Language cross-site scripting
9548| [34209] Apache Tomcat calendar application cross-site scripting
9549| [34207] Apache Tomcat implicit-objects.jsp cross-site scripting
9550| [34167] Apache Axis WSDL file path disclosure
9551| [34068] Apache Tomcat AJP connector information disclosure
9552| [33584] Apache HTTP Server suEXEC privilege escalation
9553| [32988] Apache Tomcat proxy module directory traversal
9554| [32794] Apache Tomcat JK Web Server Connector map_uri_to_worker() buffer overflow
9555| [32708] Debian Apache tty privilege escalation
9556| [32441] ApacheStats extract() PHP call unspecified
9557| [32128] Apache Tomcat default account
9558| [31680] Apache Tomcat RequestParamExample cross-site scripting
9559| [31649] Apache Tomcat Sample Servlet TroubleShooter detected
9560| [31557] BEA WebLogic Server and WebLogic Express Apache proxy plug-in denial of service
9561| [31236] Apache HTTP Server htpasswd.c strcpy buffer overflow
9562| [30456] Apache mod_auth_kerb off-by-one buffer overflow
9563| [29550] Apache mod_tcl set_var() format string
9564| [28620] Apache and IBM HTTP Server Expect header cross-site scripting
9565| [28357] Apache HTTP Server mod_alias script source information disclosure
9566| [28063] Apache mod_rewrite off-by-one buffer overflow
9567| [27902] Apache Tomcat URL information disclosure
9568| [26786] Apache James SMTP server denial of service
9569| [25680] libapache2 /tmp/svn file upload
9570| [25614] Apache Struts lookupMap cross-site scripting
9571| [25613] Apache Struts ActionForm denial of service
9572| [25612] Apache Struts isCancelled() security bypass
9573| [24965] Apache mod_python FileSession command execution
9574| [24716] Apache James spooler memory leak denial of service
9575| [24159] Apache Geronimo Web-Access-Log Viewer cross-site scripting
9576| [24158] Apache Geronimo jsp-examples cross-site scripting
9577| [24030] Apache auth_ldap module multiple format strings
9578| [24008] Apache mod_ssl custom error message denial of service
9579| [24003] Apache mod_auth_pgsql module multiple syslog format strings
9580| [23612] Apache mod_imap referer field cross-site scripting
9581| [23173] Apache Struts error message cross-site scripting
9582| [22942] Apache Tomcat directory listing denial of service
9583| [22858] Apache Multi-Processing Module code allows denial of service
9584| [22602] RHSA-2005:582 updates for Apache httpd not installed
9585| [22520] Apache mod-auth-shadow "
9586| [22466] ApacheTop symlink
9587| [22109] Apache HTTP Server ssl_engine_kernel client certificate validation
9588| [22006] Apache HTTP Server byte-range filter denial of service
9589| [21567] Apache mod_ssl off-by-one buffer overflow
9590| [21195] Apache HTTP Server header HTTP request smuggling
9591| [20383] Apache HTTP Server htdigest buffer overflow
9592| [19681] Apache Tomcat AJP12 request denial of service
9593| [18993] Apache HTTP server check_forensic symlink attack
9594| [18790] Apache Tomcat Manager cross-site scripting
9595| [18349] Apache HTTP server Apple HFS+ filesystem obtain information
9596| [18348] Apache HTTP server Apple HFS+ filesystem .DS_Store and .ht file disclosure
9597| [18347] Apache HTTP server Apple Mac OS X Server mod_digest_apple module could allow an attacker to replay responses
9598| [17961] Apache Web server ServerTokens has not been set
9599| [17930] Apache HTTP Server HTTP GET request denial of service
9600| [17785] Apache mod_include module buffer overflow
9601| [17671] Apache HTTP Server SSLCipherSuite bypass restrictions
9602| [17473] Apache HTTP Server Satisfy directive allows access to resources
9603| [17413] Apache htpasswd buffer overflow
9604| [17384] Apache HTTP Server environment variable configuration file buffer overflow
9605| [17382] Apache HTTP Server IPv6 apr_util denial of service
9606| [17366] Apache HTTP Server mod_dav module LOCK denial of service
9607| [17273] Apache HTTP Server speculative mode denial of service
9608| [17200] Apache HTTP Server mod_ssl denial of service
9609| [16890] Apache HTTP Server server-info request has been detected
9610| [16889] Apache HTTP Server server-status request has been detected
9611| [16705] Apache mod_ssl format string attack
9612| [16524] Apache HTTP Server ap_get_mime_headers_core denial of service
9613| [16387] Apache HTTP Server mod_proxy Content-Length buffer overflow
9614| [16230] Apache HTTP Server PHP denial of service
9615| [16214] Apache mod_ssl ssl_util_uuencode_binary buffer overflow
9616| [15958] Apache HTTP Server authentication modules memory corruption
9617| [15547] Apache HTTP Server mod_disk_cache local information disclosure
9618| [15540] Apache HTTP Server socket starvation denial of service
9619| [15467] Novell GroupWise WebAccess using Apache Web server allows viewing of files on the server
9620| [15422] Apache HTTP Server mod_access information disclosure
9621| [15419] Apache HTTP Server mod_ssl plain HTTP request denial of service
9622| [15293] Apache for Cygwin "
9623| [15065] Apache-SSL has a default password
9624| [15041] Apache HTTP Server mod_digest module could allow an attacker to replay responses
9625| [15015] Apache httpd server httpd.conf could allow a local user to bypass restrictions
9626| [14751] Apache Mod_python output filter information disclosure
9627| [14125] Apache HTTP Server mod_userdir module information disclosure
9628| [14075] Apache HTTP Server mod_php file descriptor leak
9629| [13703] Apache HTTP Server account
9630| [13689] Apache HTTP Server configuration allows symlinks
9631| [13688] Apache HTTP Server configuration allows SSI
9632| [13687] Apache HTTP Server Server: header value
9633| [13685] Apache HTTP Server ServerTokens value
9634| [13684] Apache HTTP Server ServerSignature value
9635| [13672] Apache HTTP Server config allows directory autoindexing
9636| [13671] Apache HTTP Server default content
9637| [13670] Apache HTTP Server config file directive references outside content root
9638| [13668] Apache HTTP Server httpd not running in chroot environment
9639| [13666] Apache HTTP Server CGI directory contains possible command interpreter or compiler
9640| [13664] Apache HTTP Server config file contains ScriptAlias entry
9641| [13663] Apache HTTP Server CGI support modules loaded
9642| [13661] Apache HTTP Server config file contains AddHandler entry
9643| [13660] Apache HTTP Server 500 error page not CGI script
9644| [13659] Apache HTTP Server 413 error page not CGI script
9645| [13658] Apache HTTP Server 403 error page not CGI script
9646| [13657] Apache HTTP Server 401 error page not CGI script
9647| [13552] Apache HTTP Server mod_cgid module information disclosure
9648| [13550] Apache GET request directory traversal
9649| [13516] Apache Cocoon XMLForm and JXForm could allow execution of code
9650| [13499] Apache Cocoon directory traversal allows downloading of boot.ini file
9651| [13429] Apache Tomcat non-HTTP request denial of service
9652| [13400] Apache HTTP server mod_alias and mod_rewrite buffer overflow
9653| [13295] Apache weak password encryption
9654| [13254] Apache Tomcat .jsp cross-site scripting
9655| [13125] Apache::Gallery Inline::C could allow arbitrary code execution
9656| [13086] Apache Jakarta Tomcat mod_jk format string allows remote access
9657| [12681] Apache HTTP Server mod_proxy could allow mail relaying
9658| [12662] Apache HTTP Server rotatelogs denial of service
9659| [12554] Apache Tomcat stores password in plain text
9660| [12553] Apache HTTP Server redirects and subrequests denial of service
9661| [12552] Apache HTTP Server FTP proxy server denial of service
9662| [12551] Apache HTTP Server prefork MPM denial of service
9663| [12550] Apache HTTP Server weaker than expected encryption
9664| [12549] Apache HTTP Server type-map file denial of service
9665| [12206] Apache Tomcat /opt/tomcat directory insecure permissions
9666| [12102] Apache Jakarta Tomcat MS-DOS device name request denial of service
9667| [12091] Apache HTTP Server apr_password_validate denial of service
9668| [12090] Apache HTTP Server apr_psprintf code execution
9669| [11804] Apache HTTP Server mod_access_referer denial of service
9670| [11750] Apache HTTP Server could leak sensitive file descriptors
9671| [11730] Apache HTTP Server error log and access log terminal escape sequence injection
9672| [11703] Apache long slash path allows directory listing
9673| [11695] Apache HTTP Server LF (Line Feed) denial of service
9674| [11694] Apache HTTP Server filestat.c denial of service
9675| [11438] Apache HTTP Server MIME message boundaries information disclosure
9676| [11412] Apache HTTP Server error log terminal escape sequence injection
9677| [11196] Apache Tomcat examples and ROOT Web applications cross-site scripting
9678| [11195] Apache Tomcat web.xml could be used to read files
9679| [11194] Apache Tomcat URL appended with a null character could list directories
9680| [11139] Apache HTTP Server mass virtual hosting with mod_rewrite or mod_vhost_alias could allow an attacker to obtain files
9681| [11126] Apache HTTP Server illegal character file disclosure
9682| [11125] Apache HTTP Server DOS device name HTTP POST code execution
9683| [11124] Apache HTTP Server DOS device name denial of service
9684| [11088] Apache HTTP Server mod_vhost_alias CGI source disclosure
9685| [10938] Apache HTTP Server printenv test CGI cross-site scripting
9686| [10771] Apache Tomcat mod_jk module multiple HTTP GET request buffer overflow
9687| [10575] Apache mod_php module could allow an attacker to take over the httpd process
9688| [10499] Apache HTTP Server WebDAV HTTP POST view source
9689| [10457] Apache HTTP Server mod_ssl "
9690| [10415] Apache HTTP Server htdigest insecure system() call could allow command execution
9691| [10414] Apache HTTP Server htdigest multiple buffer overflows
9692| [10413] Apache HTTP Server htdigest temporary file race condition
9693| [10412] Apache HTTP Server htpasswd temporary file race condition
9694| [10376] Apache Tomcat invoker servlet used in conjunction with the default servlet reveals source code
9695| [10348] Apache Tomcat HTTP GET request DOS device reference could cause a denial of service
9696| [10281] Apache HTTP Server ab.c ApacheBench long response buffer overflow
9697| [10280] Apache HTTP Server shared memory scorecard overwrite
9698| [10263] Apache Tomcat mod_jk or mod_jserv connector directory disclosure
9699| [10241] Apache HTTP Server Host: header cross-site scripting
9700| [10230] Slapper worm variants A, B, and C target OpenSSL/Apache systems
9701| [10208] Apache HTTP Server mod_dav denial of service
9702| [10206] HP VVOS Apache mod_ssl denial of service
9703| [10200] Apache HTTP Server stderr denial of service
9704| [10175] Apache Tomcat org.apache.catalina.servlets.DefaultServlet reveals source code
9705| [10169] Slapper worm variant (Slapper.C) targets OpenSSL/Apache systems
9706| [10154] Slapper worm variant (Slapper.B) targets OpenSSL/Apache systems
9707| [10098] Slapper worm targets OpenSSL/Apache systems
9708| [9876] Apache HTTP Server cgi/cgid request could disclose the path to a requested script
9709| [9875] Apache HTTP Server .var file request could disclose installation path
9710| [9863] Apache Tomcat web.xml file could allow a remote attacker to bypass restrictions
9711| [9808] Apache HTTP Server non-Unix version URL encoded directory traversal
9712| [9623] Apache HTTP Server ap_log_rerror() path disclosure
9713| [9520] Apache Tomcat /servlet/ mapping cross-site scripting
9714| [9415] Apache HTTP Server mod_ssl .htaccess off-by-one buffer overflow
9715| [9396] Apache Tomcat null character to threads denial of service
9716| [9394] Apache Tomcat HTTP request for LPT9 reveals Web root path
9717| [9249] Apache HTTP Server chunked encoding heap buffer overflow
9718| [9208] Apache Tomcat sample file requests could reveal directory listing and path to Web root directory
9719| [8932] Apache Tomcat example class information disclosure
9720| [8633] Apache HTTP Server with mod_rewrite could allow an attacker to bypass directives
9721| [8629] Apache HTTP Server double-reverse DNS lookup spoofing
9722| [8589] Apache HTTP Server for Windows DOS batch file remote command execution
9723| [8457] Oracle9i Application Server Apache PL/SQL HTTP Location header buffer overflow
9724| [8455] Oracle9i Application Server default installation could allow an attacker to access certain Apache Services
9725| [8400] Apache HTTP Server mod_frontpage buffer overflows
9726| [8326] Apache HTTP Server multiple MIME headers (sioux) denial of service
9727| [8308] Apache "
9728| [8275] Apache HTTP Server with Multiviews enabled could disclose directory contents
9729| [8119] Apache and PHP OPTIONS request reveals "
9730| [8054] Apache is running on the system
9731| [8029] Mandrake Linux default Apache configuration could allow an attacker to browse files and directories
9732| [8027] Mandrake Linux default Apache configuration has remote management interface enabled
9733| [8026] Mandrake Linux Apache sample programs could disclose sensitive information about the server
9734| [7836] Apache HTTP Server log directory denial of service
9735| [7815] Apache for Windows "
9736| [7810] Apache HTTP request could result in unexpected behavior
9737| [7599] Apache Tomcat reveals installation path
9738| [7494] Apache "
9739| [7419] Apache Web Server could allow remote attackers to overwrite .log files
9740| [7363] Apache Web Server hidden HTTP requests
9741| [7249] Apache mod_proxy denial of service
9742| [7129] Linux with Apache Web server could allow an attacker to determine if a specified username exists
9743| [7103] Apple Mac OS X used with Apache Web server could disclose directory contents
9744| [7059] Apache "
9745| [7057] Apache "
9746| [7056] Apache "
9747| [7055] Apache "
9748| [7054] Apache "
9749| [6997] Apache Jakarta Tomcat error message may reveal information
9750| [6971] Apache Jakarta Tomcat may reveal JSP source code with missing HTTP protocol specification
9751| [6970] Apache crafted HTTP request could reveal the internal IP address
9752| [6921] Apache long slash path allows directory listing
9753| [6687] Apple Mac OS X used with Apache Web server could allow arbitrary file disclosure
9754| [6527] Apache Web Server for Windows and OS2 denial of service
9755| [6316] Apache Jakarta Tomcat may reveal JSP source code
9756| [6305] Apache Jakarta Tomcat directory traversal
9757| [5926] Linux Apache symbolic link
9758| [5659] Apache Web server discloses files when used with php script
9759| [5310] Apache mod_rewrite allows attacker to view arbitrary files
9760| [5204] Apache WebDAV directory listings
9761| [5197] Apache Web server reveals CGI script source code
9762| [5160] Apache Jakarta Tomcat default installation
9763| [5099] Trustix Secure Linux installs Apache with world writable access
9764| [4968] Apache Jakarta Tomcat snoop servlet gives out information which could be used in attack
9765| [4967] Apache Jakarta Tomcat 404 error reveals the pathname of the requested file
9766| [4931] Apache source.asp example file allows users to write to files
9767| [4575] IBM HTTP Server running Apache allows users to directory listing and file retrieval
9768| [4205] Apache Jakarta Tomcat delivers file contents
9769| [2084] Apache on Debian by default serves the /usr/doc directory
9770| [1630] MessageMedia UnityMail and Apache Web server MIME header flood denial of service
9771| [697] Apache HTTP server beck exploit
9772| [331] Apache cookies buffer overflow
9773|
9774| Exploit-DB - https://www.exploit-db.com:
9775| [31130] Apache Tomcat <= 6.0.15 Cookie Quote Handling Remote Information Disclosure Vulnerability
9776| [31052] Apache <= 2.2.6 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
9777| [30901] Apache HTTP Server 2.2.6 Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
9778| [30835] Apache HTTP Server <= 2.2.4 413 Error HTTP Request Method Cross-Site Scripting Weakness
9779| [30563] Apache Tomcat <= 5.5.15 Cal2.JSP Cross-Site Scripting Vulnerability
9780| [30496] Apache Tomcat <= 6.0.13 Cookie Handling Quote Delimiter Session ID Disclosure
9781| [30495] Apache Tomcat <= 6.0.13 Host Manager Servlet Cross Site Scripting Vulnerability
9782| [30191] Apache MyFaces Tomahawk JSF Framework 1.1.5 Autoscroll Parameter Cross Site Scripting Vulnerability
9783| [30189] Apache Tomcat <= 6.0.13 JSP Example Web Applications Cross Site Scripting Vulnerability
9784| [30052] Apache Tomcat 6.0.10 Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
9785| [29930] Apache AXIS 1.0 Non-Existent WSDL Path Information Disclosure Vulnerability
9786| [29859] Apache Roller OGNL Injection
9787| [29739] Apache HTTP Server Tomcat 5.x/6.0.x Directory Traversal Vulnerability
9788| [29435] Apache Tomcat 5.5.25 - CSRF Vulnerabilities
9789| [29316] Apache + PHP 5.x - Remote Code Execution (Multithreaded Scanner) (2)
9790| [29290] Apache / PHP 5.x Remote Code Execution Exploit
9791| [28713] Apache Tomcat/JBoss EJBInvokerServlet / JMXInvokerServlet (RMI over HTTP) Marshalled Object RCE
9792| [28424] Apache 2.x HTTP Server Arbitrary HTTP Request Headers Security Weakness
9793| [28365] Apache 2.2.2 CGI Script Source Code Information Disclosure Vulnerability
9794| [28254] Apache Tomcat 5 Information Disclosure Vulnerability
9795| [27915] Apache James 2.2 SMTP Denial of Service Vulnerability
9796| [27397] Apache suEXEC Privilege Elevation / Information Disclosure
9797| [27135] Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
9798| [27096] Apache Geronimo 1.0 Error Page XSS
9799| [27095] Apache Tomcat / Geronimo 1.0 Sample Script cal2.jsp time Parameter XSS
9800| [26710] Apache CXF prior to 2.5.10, 2.6.7 and 2.7.4 - Denial of Service
9801| [26542] Apache Struts 1.2.7 Error Response Cross-Site Scripting Vulnerability
9802| [25986] Plesk Apache Zeroday Remote Exploit
9803| [25980] Apache Struts includeParams Remote Code Execution
9804| [25625] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (2)
9805| [25624] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (1)
9806| [24874] Apache Struts ParametersInterceptor Remote Code Execution
9807| [24744] Apache Rave 0.11 - 0.20 - User Information Disclosure
9808| [24694] Apache 1.3.x mod_include Local Buffer Overflow Vulnerability
9809| [24590] Apache 2.0.x mod_ssl Remote Denial of Service Vulnerability
9810| [23751] Apache Cygwin 1.3.x/2.0.x Directory Traversal Vulnerability
9811| [23581] Apache 2.0.4x mod_perl Module File Descriptor Leakage Vulnerability
9812| [23482] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (2)
9813| [23481] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (1)
9814| [23296] Red Hat Apache 2.0.40 Directory Index Default Configuration Error
9815| [23282] apache cocoon 2.14/2.2 - Directory Traversal vulnerability
9816| [23245] Apache Tomcat 4.0.x Non-HTTP Request Denial of Service Vulnerability
9817| [23119] Apache::Gallery 0.4/0.5/0.6 Insecure Local File Storage Privilege Escalation Vulnerability
9818| [22505] Apache Mod_Access_Referer 1.0.2 NULL Pointer Dereference Denial of Service Vulnerability
9819| [22205] Apache Tomcat 3.x Null Byte Directory/File Disclosure Vulnerability
9820| [22191] Apache Web Server 2.0.x MS-DOS Device Name Denial of Service Vulnerability
9821| [22068] Apache 1.3.x,Tomcat 4.0.x/4.1.x Mod_JK Chunked Encoding Denial of Service Vulnerability
9822| [21885] Apache 1.3/2.0.x Server Side Include Cross Site Scripting Vulnerability
9823| [21882] Apache Tomcat 3.2 Directory Disclosure Vulnerability
9824| [21854] Apache 2.0.39/40 Oversized STDERR Buffer Denial of Service Vulnerability
9825| [21853] Apache Tomcat 3/4 DefaultServlet File Disclosure Vulnerability
9826| [21734] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
9827| [21719] Apache 2.0 Path Disclosure Vulnerability
9828| [21697] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
9829| [21605] Apache Tomcat 4.0.3 DoS Device Name Cross Site Scripting Vulnerability
9830| [21604] Apache Tomcat 4.0.3 Servlet Mapping Cross Site Scripting Vulnerability
9831| [21560] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (2)
9832| [21559] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (1)
9833| [21534] Apache Tomcat 3/4 JSP Engine Denial of Service Vulnerability
9834| [21492] Apache Tomcat 3.2.3/3.2.4 RealPath.JSP Malformed Request Information Disclosure
9835| [21491] Apache Tomcat 3.2.3/3.2.4 Example Files Web Root Path Disclosure
9836| [21490] Apache Tomcat 3.2.3/3.2.4 Source.JSP Malformed Request Information Disclosure
9837| [21412] Apache Tomcat 4.0/4.1 Servlet Path Disclosure Vulnerability
9838| [21350] Apache Win32 1.3.x/2.0.x Batch File Remote Command Execution Vulnerability
9839| [21204] Apache 1.3.20 Win32 PHP.EXE Remote File Disclosure Vulnerability
9840| [21112] Red Hat Linux 7.0 Apache Remote Username Enumeration Vulnerability
9841| [21067] Apache 1.0/1.2/1.3 Server Address Disclosure Vulnerability
9842| [21002] Apache 1.3 Possible Directory Index Disclosure Vulnerability
9843| [20911] Apache 1.3.14 Mac File Protection Bypass Vulnerability
9844| [20716] apache tomcat 3.0 - Directory Traversal vulnerability
9845| [20695] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (4)
9846| [20694] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (3)
9847| [20693] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (2)
9848| [20692] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (1)
9849| [20595] NCSA 1.3/1.4.x/1.5,Apache httpd 0.8.11/0.8.14 ScriptAlias Source Retrieval Vulnerability
9850| [20558] Apache 1.2 Web Server DoS Vulnerability
9851| [20466] Apache 1.3 Web Server with Php 3 File Disclosure Vulnerability
9852| [20435] Apache 0.8.x/1.0.x,NCSA httpd 1.x test-cgi Directory Listing Vulnerability
9853| [20272] Apache 1.2.5/1.3.1,UnityMail 2.0 MIME Header DoS Vulnerability
9854| [20210] Apache 1.3.12 WebDAV Directory Listings Vulnerability
9855| [20131] Apache Tomcat 3.1 Path Revealing Vulnerability
9856| [19975] Apache 1.3.6/1.3.9/1.3.11/1.3.12/1.3.20 Root Directory Access Vulnerability
9857| [19828] Cobalt RaQ 2.0/3.0 Apache .htaccess Disclosure Vulnerability
9858| [19536] Apache <= 1.1,NCSA httpd <= 1.5.2,Netscape Server 1.12/1.1/2.0 a nph-test-cgi Vulnerability
9859| [19231] PHP apache_request_headers Function Buffer Overflow
9860| [18984] Apache Struts <= 2.2.1.1 - Remote Command Execution
9861| [18897] Oracle Weblogic Apache Connector POST Request Buffer Overflow
9862| [18619] Apache Tomcat Remote Exploit (PUT Request) and Account Scanner
9863| [18452] Apache Struts Multiple Persistent Cross-Site Scripting Vulnerabilities
9864| [18442] Apache httpOnly Cookie Disclosure
9865| [18329] Apache Struts2 <= 2.3.1 - Multiple Vulnerabilities
9866| [18221] Apache HTTP Server Denial of Service
9867| [17969] Apache mod_proxy Reverse Proxy Exposure Vulnerability PoC
9868| [17696] Apache httpd Remote Denial of Service (memory exhaustion)
9869| [17691] Apache Struts < 2.2.0 - Remote Command Execution
9870| [16798] Apache mod_jk 1.2.20 Buffer Overflow
9871| [16782] Apache Win32 Chunked Encoding
9872| [16752] Apache module mod_rewrite LDAP protocol Buffer Overflow
9873| [16317] Apache Tomcat Manager Application Deployer Authenticated Code Execution
9874| [15710] Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability
9875| [15319] Apache 2.2 (Windows) Local Denial of Service
9876| [14617] Apache JackRabbit 2.0.0 webapp XPath Injection
9877| [14489] Apache Tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
9878| [12721] Apache Axis2 1.4.1 - Local File Inclusion Vulnerability
9879| [12689] Authenticated Cross-Site Scripting Vulnerability (XSS) within Apache Axis2 administration console
9880| [12343] Apache Tomcat 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 - Information Disclosure Vulnerability
9881| [12330] Apache OFBiz - Multiple XSS
9882| [12264] Apache OFBiz - FULLADMIN Creator PoC Payload
9883| [12263] Apache OFBiz - SQL Remote Execution PoC Payload
9884| [11662] Apache Spamassassin Milter Plugin Remote Root Command Execution
9885| [11650] Apache 2.2.14 mod_isapi Dangling Pointer Remote SYSTEM Exploit
9886| [10811] Joomla.Tutorials GHDB: Apache directory listing Download Vulnerability
9887| [10292] Apache Tomcat 3.2.1 - 404 Error Page Cross Site Scripting Vulnerability
9888| [9995] Apache Tomcat Form Authentication Username Enumeration Weakness
9889| [9994] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
9890| [9993] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
9891| [8842] Apache mod_dav / svn Remote Denial of Service Exploit
9892| [8458] Apache Geronimo <= 2.1.3 - Multiple Directory Traversal Vulnerabilities
9893| [7264] Apache Tomcat runtime.getRuntime().exec() Privilege Escalation (win)
9894| [6229] apache tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
9895| [6100] Apache mod_jk 1.2.19 Remote Buffer Overflow Exploit (win32)
9896| [6089] Bea Weblogic Apache Connector Code Exec / Denial of Service Exploit
9897| [5386] Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit
9898| [5330] Apache 2.0 mod_jk2 2.0.2 - Remote Buffer Overflow Exploit (win32)
9899| [4552] Apache Tomcat (webdav) Remote File Disclosure Exploit (ssl support)
9900| [4530] Apache Tomcat (webdav) Remote File Disclosure Exploit
9901| [4162] Apache Tomcat Connector (mod_jk) Remote Exploit (exec-shield)
9902| [4093] Apache mod_jk 1.2.19/1.2.20 Remote Buffer Overflow Exploit
9903| [3996] Apache 2.0.58 mod_rewrite Remote Overflow Exploit (win2k3)
9904| [3680] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
9905| [3384] Ubuntu/Debian Apache 1.3.33/1.3.34 (CGI TTY) Local Root Exploit
9906| [2237] Apache < 1.3.37, 2.0.59, 2.2.3 (mod_rewrite) Remote Overflow PoC
9907| [2061] Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
9908| [1056] Apache <= 2.0.49 Arbitrary Long HTTP Headers Denial of Service
9909| [855] Apache <= 2.0.52 HTTP GET request Denial of Service Exploit
9910| [764] Apache OpenSSL - Remote Exploit (Multiple Targets) (OpenFuckV2.c)
9911| [587] Apache <= 1.3.31 mod_include Local Buffer Overflow Exploit
9912| [466] htpasswd Apache 1.3.31 - Local Exploit
9913| [371] Apache HTTPd Arbitrary Long HTTP Headers DoS (c version)
9914| [360] Apache HTTPd Arbitrary Long HTTP Headers DoS
9915| [132] Apache 1.3.x - 2.0.48 - mod_userdir Remote Users Disclosure Exploit
9916| [126] Apache mod_gzip (with debug_mode) <= 1.2.26.1a Remote Exploit
9917| [67] Apache 1.3.x mod_mylo Remote Code Execution Exploit
9918| [38] Apache <= 2.0.45 APR Remote Exploit -Apache-Knacker.pl
9919| [34] Webfroot Shoutbox < 2.32 (Apache) Remote Exploit
9920| [11] Apache <= 2.0.44 Linux Remote Denial of Service Exploit
9921| [9] Apache HTTP Server 2.x Memory Leak Exploit
9922|
9923| OpenVAS (Nessus) - http://www.openvas.org:
9924| [902924] Apache Struts2 Showcase Skill Name Remote Code Execution Vulnerability
9925| [902837] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability (Windows)
9926| [902830] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
9927| [902664] Apache Traffic Server HTTP Host Header Denial of Service Vulnerability
9928| [901203] Apache httpd Web Server Range Header Denial of Service Vulnerability
9929| [901110] Apache ActiveMQ Source Code Information Disclosure Vulnerability
9930| [901105] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
9931| [900842] Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux)
9932| [900841] Apache 'mod_proxy_ftp' Module Denial Of Service Vulnerability (Linux)
9933| [900573] Apache APR-Utils XML Parser Denial of Service Vulnerability
9934| [900572] Apache APR-Utils Multiple Denial of Service Vulnerabilities
9935| [900571] Apache APR-Utils Version Detection
9936| [900499] Apache mod_proxy_ajp Information Disclosure Vulnerability
9937| [900496] Apache Tiles Multiple XSS Vulnerability
9938| [900493] Apache Tiles Version Detection
9939| [900107] Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability
9940| [900021] Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities
9941| [880086] CentOS Update for apache CESA-2008:0004-01 centos2 i386
9942| [870175] RedHat Update for apache RHSA-2008:0004-01
9943| [864591] Fedora Update for apache-poi FEDORA-2012-10835
9944| [864383] Fedora Update for apache-commons-compress FEDORA-2012-8428
9945| [864280] Fedora Update for apache-commons-compress FEDORA-2012-8465
9946| [864250] Fedora Update for apache-poi FEDORA-2012-7683
9947| [864249] Fedora Update for apache-poi FEDORA-2012-7686
9948| [863993] Fedora Update for apache-commons-daemon FEDORA-2011-10880
9949| [863466] Fedora Update for apache-commons-daemon FEDORA-2011-10936
9950| [855821] Solaris Update for Apache 1.3 122912-19
9951| [855812] Solaris Update for Apache 1.3 122911-19
9952| [855737] Solaris Update for Apache 1.3 122911-17
9953| [855731] Solaris Update for Apache 1.3 122912-17
9954| [855695] Solaris Update for Apache 1.3 122911-16
9955| [855645] Solaris Update for Apache 1.3 122912-16
9956| [855587] Solaris Update for kernel update and Apache 108529-29
9957| [855566] Solaris Update for Apache 116973-07
9958| [855531] Solaris Update for Apache 116974-07
9959| [855524] Solaris Update for Apache 2 120544-14
9960| [855494] Solaris Update for Apache 1.3 122911-15
9961| [855478] Solaris Update for Apache Security 114145-11
9962| [855472] Solaris Update for Apache Security 113146-12
9963| [855179] Solaris Update for Apache 1.3 122912-15
9964| [855147] Solaris Update for kernel update and Apache 108528-29
9965| [855077] Solaris Update for Apache 2 120543-14
9966| [850196] SuSE Update for apache2 openSUSE-SU-2012:0314-1 (apache2)
9967| [850088] SuSE Update for apache2 SUSE-SA:2007:061
9968| [850009] SuSE Update for apache2,apache SUSE-SA:2008:021
9969| [841209] Ubuntu Update for apache2 USN-1627-1
9970| [840900] Ubuntu Update for apache2 USN-1368-1
9971| [840798] Ubuntu Update for apache2 USN-1259-1
9972| [840734] Ubuntu Update for apache2 USN-1199-1
9973| [840542] Ubuntu Update for apache2 vulnerabilities USN-1021-1
9974| [840504] Ubuntu Update for apache2 vulnerability USN-990-2
9975| [840399] Ubuntu Update for apache2 vulnerabilities USN-908-1
9976| [840304] Ubuntu Update for apache2 vulnerabilities USN-575-1
9977| [840118] Ubuntu Update for libapache2-mod-perl2 vulnerability USN-488-1
9978| [840092] Ubuntu Update for apache2 vulnerabilities USN-499-1
9979| [840039] Ubuntu Update for libapache2-mod-python vulnerability USN-430-1
9980| [835253] HP-UX Update for Apache Web Server HPSBUX02645
9981| [835247] HP-UX Update for Apache-based Web Server HPSBUX02612
9982| [835243] HP-UX Update for Apache Running Tomcat Servlet Engine HPSBUX02579
9983| [835236] HP-UX Update for Apache with PHP HPSBUX02543
9984| [835233] HP-UX Update for Apache-based Web Server HPSBUX02531
9985| [835224] HP-UX Update for Apache-based Web Server HPSBUX02465
9986| [835200] HP-UX Update for Apache Web Server Suite HPSBUX02431
9987| [835190] HP-UX Update for Apache Web Server Suite HPSBUX02401
9988| [835188] HP-UX Update for Apache HPSBUX02308
9989| [835181] HP-UX Update for Apache With PHP HPSBUX02332
9990| [835180] HP-UX Update for Apache with PHP HPSBUX02342
9991| [835172] HP-UX Update for Apache HPSBUX02365
9992| [835168] HP-UX Update for Apache HPSBUX02313
9993| [835148] HP-UX Update for Apache HPSBUX01064
9994| [835139] HP-UX Update for Apache with PHP HPSBUX01090
9995| [835131] HP-UX Update for Apache HPSBUX00256
9996| [835119] HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186
9997| [835104] HP-UX Update for Apache HPSBUX00224
9998| [835103] HP-UX Update for Apache mod_cgid HPSBUX00301
9999| [835101] HP-UX Update for Apache HPSBUX01232
10000| [835080] HP-UX Update for Apache HPSBUX02273
10001| [835078] HP-UX Update for ApacheStrong HPSBUX00255
10002| [835044] HP-UX Update for Apache HPSBUX01019
10003| [835040] HP-UX Update for Apache PHP HPSBUX00207
10004| [835025] HP-UX Update for Apache HPSBUX00197
10005| [835023] HP-UX Update for Apache HPSBUX01022
10006| [835022] HP-UX Update for Apache HPSBUX02292
10007| [835005] HP-UX Update for Apache HPSBUX02262
10008| [831759] Mandriva Update for apache-mod_security MDVSA-2012:182 (apache-mod_security)
10009| [831737] Mandriva Update for apache MDVSA-2012:154-1 (apache)
10010| [831534] Mandriva Update for apache MDVSA-2012:012 (apache)
10011| [831523] Mandriva Update for apache MDVSA-2012:003 (apache)
10012| [831491] Mandriva Update for apache MDVSA-2011:168 (apache)
10013| [831460] Mandriva Update for apache MDVSA-2011:144 (apache)
10014| [831449] Mandriva Update for apache MDVSA-2011:130 (apache)
10015| [831357] Mandriva Update for apache MDVSA-2011:057 (apache)
10016| [831132] Mandriva Update for apache MDVSA-2010:153 (apache)
10017| [831131] Mandriva Update for apache MDVSA-2010:152 (apache)
10018| [830989] Mandriva Update for apache-mod_auth_shadow MDVSA-2010:081 (apache-mod_auth_shadow)
10019| [830931] Mandriva Update for apache MDVSA-2010:057 (apache)
10020| [830926] Mandriva Update for apache MDVSA-2010:053 (apache)
10021| [830918] Mandriva Update for apache-mod_security MDVSA-2010:050 (apache-mod_security)
10022| [830799] Mandriva Update for apache-conf MDVSA-2009:300-2 (apache-conf)
10023| [830797] Mandriva Update for apache-conf MDVSA-2009:300-1 (apache-conf)
10024| [830791] Mandriva Update for apache-conf MDVA-2010:011 (apache-conf)
10025| [830652] Mandriva Update for apache MDVSA-2008:195 (apache)
10026| [830621] Mandriva Update for apache-conf MDVA-2008:129 (apache-conf)
10027| [830581] Mandriva Update for apache MDVSA-2008:016 (apache)
10028| [830294] Mandriva Update for apache MDKSA-2007:140 (apache)
10029| [830196] Mandriva Update for apache MDKSA-2007:235 (apache)
10030| [830112] Mandriva Update for apache MDKSA-2007:127 (apache)
10031| [830109] Mandriva Update for apache-mod_perl MDKSA-2007:083 (apache-mod_perl)
10032| [802425] Apache Struts2 Showcase Arbitrary Java Method Execution vulnerability
10033| [802423] Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities
10034| [802422] Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities
10035| [802415] Apache Tomcat Multiple Security Bypass Vulnerabilities (Win)
10036| [802385] Apache Tomcat Request Object Security Bypass Vulnerability (Win)
10037| [802384] Apache Tomcat Parameter Handling Denial of Service Vulnerability (Win)
10038| [802378] Apache Tomcat Hash Collision Denial Of Service Vulnerability
10039| [801942] Apache Archiva Multiple Vulnerabilities
10040| [801940] Apache Struts2 'XWork' Information Disclosure Vulnerability
10041| [801663] Apache Struts2/XWork Remote Command Execution Vulnerability
10042| [801521] Apache APR-util 'buckets/apr_brigade.c' Denial Of Service Vulnerability
10043| [801284] Apache Derby Information Disclosure Vulnerability
10044| [801203] Apache ActiveMQ Persistent Cross-Site Scripting Vulnerability
10045| [800837] Apache 'mod_deflate' Denial Of Service Vulnerability - July09
10046| [800827] Apache 'mod_proxy_http.c' Denial Of Service Vulnerability
10047| [800680] Apache APR Version Detection
10048| [800679] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
10049| [800678] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
10050| [800677] Apache Roller Version Detection
10051| [800279] Apache mod_jk Module Version Detection
10052| [800278] Apache Struts Cross Site Scripting Vulnerability
10053| [800277] Apache Tomcat mod_jk Information Disclosure Vulnerability
10054| [800276] Apache Struts Version Detection
10055| [800271] Apache Struts Directory Traversal Vulnerability
10056| [800024] Apache Tomcat RemoteFilterValve Security Bypass Vulnerability
10057| [103333] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
10058| [103293] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
10059| [103122] Apache Web Server ETag Header Information Disclosure Weakness
10060| [103074] Apache Continuum Cross Site Scripting Vulnerability
10061| [103073] Apache Continuum Detection
10062| [103053] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
10063| [101023] Apache Open For Business Weak Password security check
10064| [101020] Apache Open For Business HTML injection vulnerability
10065| [101019] Apache Open For Business service detection
10066| [100924] Apache Archiva Cross Site Request Forgery Vulnerability
10067| [100923] Apache Archiva Detection
10068| [100858] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
10069| [100814] Apache Axis2 Document Type Declaration Processing Security Vulnerability
10070| [100813] Apache Axis2 Detection
10071| [100797] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
10072| [100795] Apache Derby Detection
10073| [100762] Apache CouchDB Cross Site Request Forgery Vulnerability
10074| [100725] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
10075| [100613] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
10076| [100514] Apache Multiple Security Vulnerabilities
10077| [100211] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
10078| [100172] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
10079| [100171] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
10080| [100130] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
10081| [72626] Debian Security Advisory DSA 2579-1 (apache2)
10082| [72612] FreeBSD Ports: apache22
10083| [71551] Gentoo Security Advisory GLSA 201206-25 (apache)
10084| [71550] Gentoo Security Advisory GLSA 201206-24 (apache tomcat)
10085| [71512] FreeBSD Ports: apache
10086| [71485] Debian Security Advisory DSA 2506-1 (libapache-mod-security)
10087| [71256] Debian Security Advisory DSA 2452-1 (apache2)
10088| [71238] Debian Security Advisory DSA 2436-1 (libapache2-mod-fcgid)
10089| [70737] FreeBSD Ports: apache
10090| [70724] Debian Security Advisory DSA 2405-1 (apache2)
10091| [70600] FreeBSD Ports: apache
10092| [70253] FreeBSD Ports: apache, apache-event, apache-itk, apache-peruser, apache-worker
10093| [70235] Debian Security Advisory DSA 2298-2 (apache2)
10094| [70233] Debian Security Advisory DSA 2298-1 (apache2)
10095| [69988] Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)
10096| [69338] Debian Security Advisory DSA 2202-1 (apache2)
10097| [67868] FreeBSD Ports: apache
10098| [66816] FreeBSD Ports: apache
10099| [66553] Mandriva Security Advisory MDVSA-2009:189-1 (apache-mod_auth_mysql)
10100| [66414] Mandriva Security Advisory MDVSA-2009:323 (apache)
10101| [66106] SuSE Security Advisory SUSE-SA:2009:050 (apache2,libapr1)
10102| [66081] SLES11: Security update for Apache 2
10103| [66074] SLES10: Security update for Apache 2
10104| [66070] SLES9: Security update for Apache 2
10105| [65998] SLES10: Security update for apache2-mod_python
10106| [65893] SLES10: Security update for Apache 2
10107| [65888] SLES10: Security update for Apache 2
10108| [65575] SLES9: Security update for apache2,apache2-prefork,apache2-worker
10109| [65510] SLES9: Security update for Apache 2
10110| [65472] SLES9: Security update for Apache
10111| [65467] SLES9: Security update for Apache
10112| [65450] SLES9: Security update for apache2
10113| [65390] SLES9: Security update for Apache2
10114| [65363] SLES9: Security update for Apache2
10115| [65309] SLES9: Security update for Apache and mod_ssl
10116| [65296] SLES9: Security update for webdav apache module
10117| [65283] SLES9: Security update for Apache2
10118| [65249] SLES9: Security update for Apache 2
10119| [65230] SLES9: Security update for Apache 2
10120| [65228] SLES9: Security update for Apache 2
10121| [65212] SLES9: Security update for apache2-mod_python
10122| [65209] SLES9: Security update for apache2-worker
10123| [65207] SLES9: Security update for Apache 2
10124| [65168] SLES9: Security update for apache2-mod_python
10125| [65142] SLES9: Security update for Apache2
10126| [65136] SLES9: Security update for Apache 2
10127| [65132] SLES9: Security update for apache
10128| [65131] SLES9: Security update for Apache 2 oes/CORE
10129| [65113] SLES9: Security update for apache2
10130| [65072] SLES9: Security update for apache and mod_ssl
10131| [65017] SLES9: Security update for Apache 2
10132| [64950] Mandrake Security Advisory MDVSA-2009:240 (apache)
10133| [64783] FreeBSD Ports: apache
10134| [64774] Ubuntu USN-802-2 (apache2)
10135| [64653] Ubuntu USN-813-2 (apache2)
10136| [64559] Debian Security Advisory DSA 1834-2 (apache2)
10137| [64532] Mandrake Security Advisory MDVSA-2009:189 (apache-mod_auth_mysql)
10138| [64527] Mandrake Security Advisory MDVSA-2009:184 (apache-mod_security)
10139| [64526] Mandrake Security Advisory MDVSA-2009:183 (apache-mod_security)
10140| [64500] Mandrake Security Advisory MDVSA-2009:168 (apache)
10141| [64443] Ubuntu USN-802-1 (apache2)
10142| [64426] Gentoo Security Advisory GLSA 200907-04 (apache)
10143| [64423] Debian Security Advisory DSA 1834-1 (apache2)
10144| [64391] Mandrake Security Advisory MDVSA-2009:149 (apache)
10145| [64377] Mandrake Security Advisory MDVSA-2009:124-1 (apache)
10146| [64251] Debian Security Advisory DSA 1816-1 (apache2)
10147| [64201] Ubuntu USN-787-1 (apache2)
10148| [64140] Mandrake Security Advisory MDVSA-2009:124 (apache)
10149| [64136] Mandrake Security Advisory MDVSA-2009:102 (apache)
10150| [63565] FreeBSD Ports: apache
10151| [63562] Ubuntu USN-731-1 (apache2)
10152| [61381] Gentoo Security Advisory GLSA 200807-06 (apache)
10153| [61185] FreeBSD Ports: apache
10154| [60582] Gentoo Security Advisory GLSA 200803-19 (apache)
10155| [60387] Slackware Advisory SSA:2008-045-02 apache
10156| [58826] FreeBSD Ports: apache-tomcat
10157| [58825] FreeBSD Ports: apache-tomcat
10158| [58804] FreeBSD Ports: apache
10159| [58745] Gentoo Security Advisory GLSA 200711-06 (apache)
10160| [58360] Debian Security Advisory DSA 1312-1 (libapache-mod-jk)
10161| [57851] Gentoo Security Advisory GLSA 200608-01 (apache)
10162| [57788] Debian Security Advisory DSA 1247-1 (libapache-mod-auth-kerb)
10163| [57335] Debian Security Advisory DSA 1167-1 (apache)
10164| [57201] Debian Security Advisory DSA 1131-1 (apache)
10165| [57200] Debian Security Advisory DSA 1132-1 (apache2)
10166| [57168] Slackware Advisory SSA:2006-209-01 Apache httpd
10167| [57145] FreeBSD Ports: apache
10168| [56731] Slackware Advisory SSA:2006-129-01 Apache httpd
10169| [56729] Slackware Advisory SSA:2006-130-01 Apache httpd redux
10170| [56246] Gentoo Security Advisory GLSA 200602-03 (Apache)
10171| [56212] Debian Security Advisory DSA 952-1 (libapache-auth-ldap)
10172| [56115] Debian Security Advisory DSA 935-1 (libapache2-mod-auth-pgsql)
10173| [56067] FreeBSD Ports: apache
10174| [55803] Slackware Advisory SSA:2005-310-04 apache
10175| [55519] Debian Security Advisory DSA 839-1 (apachetop)
10176| [55392] Gentoo Security Advisory GLSA 200509-12 (Apache)
10177| [55355] FreeBSD Ports: apache
10178| [55284] Debian Security Advisory DSA 807-1 (libapache-mod-ssl)
10179| [55261] Debian Security Advisory DSA 805-1 (apache2)
10180| [55259] Debian Security Advisory DSA 803-1 (apache)
10181| [55129] Gentoo Security Advisory GLSA 200508-15 (apache)
10182| [54739] Gentoo Security Advisory GLSA 200411-18 (apache)
10183| [54724] Gentoo Security Advisory GLSA 200411-03 (apache)
10184| [54712] Gentoo Security Advisory GLSA 200410-21 (apache)
10185| [54689] Gentoo Security Advisory GLSA 200409-33 (net=www/apache)
10186| [54677] Gentoo Security Advisory GLSA 200409-21 (apache)
10187| [54610] Gentoo Security Advisory GLSA 200407-03 (Apache)
10188| [54601] Gentoo Security Advisory GLSA 200406-16 (Apache)
10189| [54590] Gentoo Security Advisory GLSA 200406-05 (Apache)
10190| [54582] Gentoo Security Advisory GLSA 200405-22 (Apache)
10191| [54529] Gentoo Security Advisory GLSA 200403-04 (Apache)
10192| [54499] Gentoo Security Advisory GLSA 200310-04 (Apache)
10193| [54498] Gentoo Security Advisory GLSA 200310-03 (Apache)
10194| [54439] FreeBSD Ports: apache
10195| [53931] Slackware Advisory SSA:2004-133-01 apache
10196| [53903] Slackware Advisory SSA:2004-299-01 apache, mod_ssl, php
10197| [53902] Slackware Advisory SSA:2004-305-01 apache+mod_ssl
10198| [53878] Slackware Advisory SSA:2003-308-01 apache security update
10199| [53851] Debian Security Advisory DSA 135-1 (libapache-mod-ssl)
10200| [53849] Debian Security Advisory DSA 132-1 (apache-ssl)
10201| [53848] Debian Security Advisory DSA 131-1 (apache)
10202| [53784] Debian Security Advisory DSA 021-1 (apache)
10203| [53738] Debian Security Advisory DSA 195-1 (apache-perl)
10204| [53737] Debian Security Advisory DSA 188-1 (apache-ssl)
10205| [53735] Debian Security Advisory DSA 187-1 (apache)
10206| [53703] Debian Security Advisory DSA 532-1 (libapache-mod-ssl)
10207| [53577] Debian Security Advisory DSA 120-1 (libapache-mod-ssl, apache-ssl)
10208| [53568] Debian Security Advisory DSA 067-1 (apache,apache-ssl)
10209| [53519] Debian Security Advisory DSA 689-1 (libapache-mod-python)
10210| [53433] Debian Security Advisory DSA 181-1 (libapache-mod-ssl)
10211| [53282] Debian Security Advisory DSA 594-1 (apache)
10212| [53248] Debian Security Advisory DSA 558-1 (libapache-mod-dav)
10213| [53224] Debian Security Advisory DSA 532-2 (libapache-mod-ssl)
10214| [53215] Debian Security Advisory DSA 525-1 (apache)
10215| [53151] Debian Security Advisory DSA 452-1 (libapache-mod-python)
10216| [52529] FreeBSD Ports: apache+ssl
10217| [52501] FreeBSD Ports: apache
10218| [52461] FreeBSD Ports: apache
10219| [52390] FreeBSD Ports: apache
10220| [52389] FreeBSD Ports: apache
10221| [52388] FreeBSD Ports: apache
10222| [52383] FreeBSD Ports: apache
10223| [52339] FreeBSD Ports: apache+mod_ssl
10224| [52331] FreeBSD Ports: apache
10225| [52329] FreeBSD Ports: ru-apache+mod_ssl
10226| [52314] FreeBSD Ports: apache
10227| [52310] FreeBSD Ports: apache
10228| [15588] Detect Apache HTTPS
10229| [15555] Apache mod_proxy content-length buffer overflow
10230| [15554] Apache mod_include priviledge escalation
10231| [14771] Apache <= 1.3.33 htpasswd local overflow
10232| [14177] Apache mod_access rule bypass
10233| [13644] Apache mod_rootme Backdoor
10234| [12293] Apache Input Header Folding and mod_ssl ssl_io_filter_cleanup DoS Vulnerabilities
10235| [12280] Apache Connection Blocking Denial of Service
10236| [12239] Apache Error Log Escape Sequence Injection
10237| [12123] Apache Tomcat source.jsp malformed request information disclosure
10238| [12085] Apache Tomcat servlet/JSP container default files
10239| [11438] Apache Tomcat Directory Listing and File disclosure
10240| [11204] Apache Tomcat Default Accounts
10241| [11092] Apache 2.0.39 Win32 directory traversal
10242| [11046] Apache Tomcat TroubleShooter Servlet Installed
10243| [11042] Apache Tomcat DOS Device Name XSS
10244| [11041] Apache Tomcat /servlet Cross Site Scripting
10245| [10938] Apache Remote Command Execution via .bat files
10246| [10839] PHP.EXE / Apache Win32 Arbitrary File Reading Vulnerability
10247| [10773] MacOS X Finder reveals contents of Apache Web files
10248| [10766] Apache UserDir Sensitive Information Disclosure
10249| [10756] MacOS X Finder reveals contents of Apache Web directories
10250| [10752] Apache Auth Module SQL Insertion Attack
10251| [10704] Apache Directory Listing
10252| [10678] Apache /server-info accessible
10253| [10677] Apache /server-status accessible
10254| [10440] Check for Apache Multiple / vulnerability
10255|
10256| SecurityTracker - https://www.securitytracker.com:
10257| [1028865] Apache Struts Bugs Permit Remote Code Execution and URL Redirection Attacks
10258| [1028864] Apache Struts Wildcard Matching and Expression Evaluation Bugs Let Remote Users Execute Arbitrary Code
10259| [1028824] Apache mod_dav_svn URI Processing Flaw Lets Remote Users Deny Service
10260| [1028823] Apache Unspecified Flaw in mod_session_dbd Has Unspecified Impact
10261| [1028724] (HP Issues Fix for HP-UX) Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
10262| [1028722] (Red Hat Issues Fix for JBoss) Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
10263| [1028693] (Red Hat Issues Fix) Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
10264| [1028622] Apache Struts 'includeParams' Bugs Permit Remote Command Execution and Cross-Site Scripting Attacks
10265| [1028621] Apache Subversion Bugs Let Remote Authenticated Users Execute Arbitrary Commands and Deny Service
10266| [1028540] Apache mod_rewrite Input Validation Flaw Lets Remote Users Execute Arbitrary Commands
10267| [1028534] Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
10268| [1028533] Apache Tomcat Lack of Chunked Transfer Encoding Extension Size Limit Lets Remote Users Deny Service
10269| [1028532] Apache Tomcat AsyncListeners Bug May Disclose Information from One Request to Another User
10270| [1028515] Apache VCL Input Validation Flaw Lets Remote Authenticated Users Gain Elevated Privileges
10271| [1028457] Apache ActiveMQ Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Deny Service, and Obtain Potentially Sensitive Information
10272| [1028287] Apache CXF WSS4JInInterceptor Grants Service Access to Remote Users
10273| [1028286] Apache CXF WS-Security UsernameToken Processing Flaw Lets Remote Users Bypass Authentication
10274| [1028252] Apache Commons FileUpload Unsafe Temporary File Lets Local Users Gain Elevated Privileges
10275| [1028207] Apache Input Validation Bugs Permit Cross-Site Scripting Attacks
10276| [1027836] Apache Tomcat Connection Processing Bug Lets Remote Users Deny Service
10277| [1027834] Apache Tomcat Bug Lets Remote Users Bypass Cross-Site Request Forgery Prevention Filter
10278| [1027833] Apache Tomcat Bug Lets Remote Users Bypass Security Constraints
10279| [1027729] Apache Tomcat Header Processing Bug Lets Remote Users Deny Service
10280| [1027728] Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
10281| [1027554] Apache CXF Lets Remote Authenticated Users Execute Unauthorized SOAP Actions
10282| [1027508] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
10283| [1027421] Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
10284| [1027096] Apache Commons Compress BZip2CompressorOutputStream() Sorting Algorithm Lets Remote or Local Users Deny Service
10285| [1026932] Apache LD_LIBRARY_PATH Processing Lets Local Users Gain Elevated Privileges
10286| [1026928] Apache OFBiz Unspecified Flaw Lets Remote Users Execute Arbitrary Code
10287| [1026927] Apache OFBiz Input Validation Flaws Permit Cross-Site Scripting Attacks
10288| [1026847] Apache Traffic Server Host Header Processing Flaw Lets Remote Users Deny Service
10289| [1026846] Apache Wicket Discloses Hidden Application Files to Remote Users
10290| [1026839] Apache Wicket Input Validation Flaw in 'wicket:pageMapName' Parameter Permits Cross-Site Scripting Attacks
10291| [1026616] Apache Bugs Let Remote Users Deny Service and Obtain Cookie Data
10292| [1026575] Apache Struts ParameterInterceptor() Flaw Lets Remote Users Execute Arbitrary Commands
10293| [1026484] Apache Struts Bug Lets Remote Users Overwrite Files and Execute Arbitrary Code
10294| [1026477] Apache Tomcat Hash Table Collision Bug Lets Remote Users Deny Service
10295| [1026402] Apache Struts Conversion Error Lets Remote Users Inject Arbitrary Commands
10296| [1026353] Apache mod_proxy/mod_rewrite Bug Lets Remote Users Access Internal Servers
10297| [1026295] Apache Tomcat Lets Untrusted Web Applications Gain Elevated Privileges
10298| [1026267] Apache .htaccess File Integer Overflow Lets Local Users Execute Arbitrary Code
10299| [1026144] Apache mod_proxy Pattern Matching Bug Lets Remote Users Access Internal Servers
10300| [1026095] Apache Tomcat HTTP DIGEST Authentication Weaknesses Let Remote Users Conduct Bypass Attacks
10301| [1026054] Apache mod_proxy_ajp HTTP Processing Error Lets Remote Users Deny Service
10302| [1025993] Apache Tomcat AJP Protocol Processing Bug Lets Remote Users Bypass Authentication or Obtain Information
10303| [1025976] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
10304| [1025960] Apache httpd Byterange Filter Processing Error Lets Remote Users Deny Service
10305| [1025925] Apache Tomcat Commons Daemon jsvc Lets Local Users Gain Elevated Privileges
10306| [1025924] Apache Tomcat XML Validation Flaw Lets Applications Obtain Potentially Sensitive Information
10307| [1025788] Apache Tomcat Lets Malicious Applications Obtain Information and Deny Service
10308| [1025755] Apache Santuario Buffer Overflow Lets Remote Users Deny Service
10309| [1025712] Apache Tomcat Discloses Passwords to Local Users in Certain Cases
10310| [1025577] Apache Archiva Input Validation Hole Permits Cross-Site Scripting Attacks
10311| [1025576] Apache Archiva Request Validation Flaw Permits Cross-Site Request Forgery Attacks
10312| [1025527] Apache APR Library apr_fnmatch() Flaw Lets Remote Users Execute Arbitrary Code
10313| [1025303] Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
10314| [1025215] Apache Tomcat May Ignore @ServletSecurity Annotation Protections
10315| [1025066] Apache Continuum Input Validation Flaw Permits Cross-Site Request Forgery Attacks
10316| [1025065] Apache Continuum Input Validation Hole Permits Cross-Site Scripting Attacks
10317| [1025027] Apache Tomcat maxHttpHeaderSize Parsing Error Lets Remote Users Deny Service
10318| [1025026] Apache Tomcat Manager Input Validation Hole Permits Cross-Site Scripting Attacks
10319| [1025025] Apache Tomcat Security Manager Lets Local Users Bypass File Permissions
10320| [1024764] Apache Tomcat Manager Input Validation Hole in 'sessionList.jsp' Permits Cross-Site Scripting Attacks
10321| [1024417] Apache Traffic Server Insufficient Randomization Lets Remote Users Poison the DNS Cache
10322| [1024332] Apache mod_cache and mod_dav Request Processing Flaw Lets Remote Users Deny Service
10323| [1024180] Apache Tomcat 'Transfer-Encoding' Header Processing Flaw Lets Remote Users Deny Service and Obtain Potentially Sensitive Information
10324| [1024096] Apache mod_proxy_http May Return Results for a Different Request
10325| [1023942] Apache mod_proxy_ajp Error Condition Lets Remote Users Deny Service
10326| [1023941] Apache ap_read_request() Memory Error May Let Remote Users Access Potentially Sensitive Information
10327| [1023778] Apache ActiveMQ Input Validation Flaw Permits Cross-Site Scripting Attacks
10328| [1023701] Apache mod_isapi Error Processing Flaw May Let Remote Users Deny Service
10329| [1023533] Apache mod_proxy Integer Overflow May Let Remote Users Execute Arbitrary Code
10330| [1022988] Apache Solaris Support Code Bug Lets Remote Users Deny Service
10331| [1022529] Apache mod_deflate Connection State Bug Lets Remote Users Deny Service
10332| [1022509] Apache mod_proxy stream_reqbody_cl() Infinite Loop Lets Remote Users Deny Service
10333| [1022296] Apache IncludesNoExec Options Restrictions Can Be Bypass By Local Users
10334| [1022264] Apache mod_proxy_ajp Bug May Disclose Another User's Response Data
10335| [1022001] Apache Tomcat mod_jk May Disclose Responses to the Wrong User
10336| [1021988] mod_perl Input Validation Flaw in Apache::Status and Apache2::Status Permits Cross-Site Scripting Attacks
10337| [1021350] NetWare Bug Lets Remote Users Access the ApacheAdmin Console
10338| [1020635] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
10339| [1020520] Oracle WebLogic Apache Connector Lets Remote Users Execute Arbitrary Code
10340| [1020267] Apache mod_proxy Interim Response Process Bug Lets Remote Users Deny Service
10341| [1019784] Apache-SSL Certificate Processing Bug May Let Remote Users View Portions of Kernel Memory
10342| [1019256] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks
10343| [1019194] Apache Input Validation Hole in Mod_AutoIndex When the Character Set is Undefined May Permit Cross-Site Scripting Attacks
10344| [1019185] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
10345| [1019154] Apache Input Validation Hole in mod_status Permits Cross-Site Scripting Attacks
10346| [1019093] Apache Input Validation Hole in mod_imap Permits Cross-Site Scripting Attacks
10347| [1019030] Apache Input Validation Hole in Default HTTP 413 Error Page Permits Cross-Site Scripting Attacks
10348| [1018633] Apache mod_proxy Bug Lets Remote Users Deny Service
10349| [1018304] Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
10350| [1018303] Apache HTTPD mod_cache May Let Remote Users Deny Service
10351| [1018302] Apache mod_status Input Validation Hole Permits Cross-Site Scripting Attacks
10352| [1018269] Apache Tomcat Input Validation Hole in Processing Accept-Language Header Permits Cross-Site Scripting Attacks
10353| [1017904] Apache suEXEC Bugs May Let Local Users Gain Elevated Privileges
10354| [1017719] Apache Tomcat JK Web Server Connector Buffer Overflow in map_uri_to_worker() Lets Remote Users Execute Arbitrary Code
10355| [1017062] Apache mod_tcl Format String Bug in set_var() Function May Let Remote Users Execute Arbitrary Code
10356| [1016601] Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code
10357| [1016576] Apache Tomcat Discloses Directory Listings to Remote Users
10358| [1015447] Apache mod_ssl Null Pointer Dereference May Let Remote Users Deny Service
10359| [1015344] Apache mod_imap Input Validation Flaw in Referer Field Lets Remote Users Conduct Cross-Site Scripting Attacks
10360| [1015093] Apache Memory Leak in MPM 'worker.c' Code May Let Remote Users Deny Service
10361| [1014996] ApacheTop Unsafe Temporary File May Let Local Users Gain Elevated Privileges
10362| [1014833] Apache ssl_hook_Access() Function May Fail to Verify Client Certificates
10363| [1014826] Apache Memory Leak in 'byterange filter' Lets Remote Users Deny Service
10364| [1014575] Apache mod_ssl Off-by-one Buffer Overflow in Processing CRLs May Let Remote Users Deny Service
10365| [1014323] Apache Chunked Transfer-Encoding and Content-Length Processing Lets Remote Users Smuggle HTTP Requests
10366| [1013156] Apache mod_python Publisher Handler Discloses Information to Remote Users
10367| [1012829] Apache mod_auth_radius radcpy() Integer Overflow Lets Remote Users Deny Service in Certain Cases
10368| [1012416] Apache on Apple OS X Lets Remote Users Bypass Apache File Handlers and Directly Access Files
10369| [1012415] Apache on Apple HFS+ Filesystems May Disclose '.DS_Store' Files to Remote Users
10370| [1012414] Apache mod_digest_apple Lets Remote Users Replay Authentication Credentials
10371| [1012083] Apache Web Server Error in Processing Requests With Many Space Characters Lets Remote Users Deny Service
10372| [1011783] Apache mod_include Buffer Overflow Lets Local Users Execute Arbitrary Code
10373| [1011557] Apache mod_ssl SSLCipherSuite Directive Can By Bypassed in Certain Cases
10374| [1011385] Apache Satsify Directive Error May Let Remote Users Access Restricted Resources
10375| [1011340] Apache SSL Connection Abort State Error Lets Remote Users Deny Service
10376| [1011303] Apache ap_resolve_env() Buffer Overflow in Reading Configuration Files May Let Local Users Gain Elevated Privileges
10377| [1011299] Apache IPv6 Address Parsing Flaw May Let Remote Users Deny Service
10378| [1011248] Apache mod_dav LOCK Method Error May Let Remote Users Deny Service
10379| [1011213] Apache mod_ssl Can Be Crashed By Remote Users When Reverse Proxying SSL Connections
10380| [1010674] Apache Can Be Crashed By PHP Code Invoking Nested Remote Sockets
10381| [1010599] Apache httpd Header Line Memory Allocation Lets Remote Users Crash the Server
10382| [1010462] Apache mod_proxy Buffer Overflow May Let Remote Users Execute Arbitrary Code
10383| [1010322] Apache mod_ssl Stack Overflow in ssl_util_uuencode_binary() May Let Remote Users Execute Arbitrary Code
10384| [1010270] cPanel Apache mod_phpsuexec Options Let Local Users Gain Elevated Privileges
10385| [1009934] Apache Web Server Has Buffer Overflow in ebcdic2ascii() on Older Processor Architectures
10386| [1009516] Apache mod_survey HTML Report Format Lets Remote Users Conduct Cross-Site Scripting Attacks
10387| [1009509] Apache mod_disk_cache Stores Authentication Credentials on Disk
10388| [1009495] Apache Web Server Socket Starvation Flaw May Let Remote Users Deny Service
10389| [1009417] GroupWise WebAccess With Apache on NetWare Has Configuration Flaw That May Grant Web Access to Remote Users
10390| [1009338] Apache mod_access Parsing Flaw May Fail to Enforce Allow/Deny Rules
10391| [1009337] Apache mod_ssl Memory Leak Lets Remote Users Crash the Daemon
10392| [1009182] Apache for Cygwin '..%5C' Input Validation Flaw Discloses Files to Remote Users
10393| [1008973] PHP May Apply Incorrect php_admin_* Settings To Requests for Apache Virtual Hosts
10394| [1008967] Apache-SSL 'SSLFakeBasicAuth' Lets Remote Users Forge Client Certificates to Be Authenticated
10395| [1008920] Apache mod_digest May Validate Replayed Client Responses
10396| [1008828] Apache mod_python String Processing Bug Still Lets Remote Users Crash the Web Server
10397| [1008822] Apache mod_perl File Descriptor Leak May Let Local Users Hijack the http and https Services
10398| [1008675] mod_auth_shadow Apache Module Authenticates Expired Passwords
10399| [1008559] Apache mod_php File Descriptor Leak May Let Local Users Hijack the https Service
10400| [1008335] Apache mod_python String Processing Bug Lets Remote Users Crash the Web Server
10401| [1008196] Apache 2.x on Windows May Return Unexpected Files For URLs Ending With Certain Characters
10402| [1008030] Apache mod_rewrite Contains a Buffer Overflow
10403| [1008029] Apache mod_alias Contains a Buffer Overflow
10404| [1008028] Apache mod_cgid May Disclose CGI Output to Another Client
10405| [1007995] Apache Cocoon Forms May Let Remote Users Execute Arbitrary Java Code on the System
10406| [1007993] Apache Cocoon 'view-source' Sample Script Discloses Files to Remote Users
10407| [1007823] Apache Web Server mod_cgi Error May Let Malicious CGI Scripts Crash the Web Service
10408| [1007664] Apache::Gallery Unsafe Temporary Files May Let Local Users Gain Apache Web Server Privileges
10409| [1007557] Apache Web Server Does Not Filter Terminal Escape Sequences From Log Files
10410| [1007230] Apache HTTP Server 'rotatelogs' Bug on Win32 and OS/2 May Cause the Logging to Stop
10411| [1007146] Apache HTTP Server FTP Proxy Bug May Cause Denial of Service Conditions
10412| [1007145] Apache 'accept()' Errors May Cause Denial of Service Conditions
10413| [1007144] Apache Web Server 'type-map' File Error Permits Local Denial of Service Attacks
10414| [1007143] Apache 2.0 Web Server May Use a Weaker Encryption Implementation Than Specified in Some Cases
10415| [1006864] Apache Web Server Can Be Crashed By Remote Users Via mod_dav Flaws and Also Via Basic Authentication
10416| [1006709] Apache mod_survey Input Validation Flaw Lets Remote Users Fill Up Disk Space
10417| [1006614] Apache mod_ntlm Buffer Overflow and Format String Flaw Let Remote Users Execute Arbitary Code
10418| [1006591] Apache mod_access_referer Module Null Pointer Dereference May Faciliate Denial of Service Attacks
10419| [1006444] Apache 2.0 Web Server Line Feed Buffer Allocation Flaw Lets Remote Users Deny Service
10420| [1006021] Apache Tomcat Server URL Parsing Error May Disclose Otherwise Inaccessible Web Directory Listings and Files to Remote Users
10421| [1005963] Apache Web Server 2.x Windows Device Access Flaw Lets Remote Users Crash the Server or Possibly Execute Arbitrary Code
10422| [1005962] Apache Web Server Path Parsing Flaw May Allow Remote Users to Execute Code in Certain Configurations
10423| [1005848] Apache 'printenv' Script Input Validation Bugs in Older Versions May Let Remote Users Conduct Cross-Site Scripting Attacks
10424| [1005765] Apache mod_jk Module Processing Bug When Used With Tomcat May Disclose Information to Remote Users or Crash
10425| [1005548] Apache mod_php Module May Allow Local Users to Gain Control of the Web Port
10426| [1005499] Apache Web Server (2.0.42) May Disclose CGI Source Code to Remote Users When Used With WebDAV
10427| [1005410] Apache Tomcat Java Servlet Engine Can Be Crashed Via Multiple Requests for DOS Device Names
10428| [1005351] Apache Web Server (1.3.x) Shared Memory Scoreboard Bug Lets Certain Local Users Issue Signals With Root Privileges
10429| [1005331] Apache Web Server (2.x) SSI Server Signature Filtering Hole Lets Remote Users Conduct Cross-Site Scripting Attacks
10430| [1005290] Apache Tomcat Java Server Default Servlet Returns JSP Source Code to Remote Users
10431| [1005285] Apache Web Server 'mod_dav' Has Null Pointer Bug That May Allow Remote Users to Cause Denial of Service Conditions
10432| [1005010] Apache Web Server (2.0) Has Unspecified Flaw That Allows Remote Users to Obtain Sensitive Data and Cause Denial of Service Conditions
10433| [1004770] Apache 2.x Web Server ap_log_rerror() Function May Disclose Full Installation Path to Remote Users
10434| [1004745] Apache Tomcat Java Server Allows Cross-Site Scripting Attacks
10435| [1004636] Apache mod_ssl 'Off-by-One' Bug May Let Local Users Crash the Web Server or Possibly Execute Arbitrary Code
10436| [1004602] Apache Tomcat Java Server for Windows Can Be Crashed By Remote Users Sending Malicious Requests to Hang All Available Working Threads
10437| [1004586] Apache Tomcat Java Server May Disclose the Installation Path to Remote Users
10438| [1004555] Apache Web Server Chunked Encoding Flaw May Let Remote Users Execute Arbitrary Code on the Server
10439| [1004209] Apache 'mod_python' Python Language Interpreter Bug in Publisher Handler May Allow Remote Users to Modify Files on the System
10440| [1003874] Apache Web Server for Windows Has Batch File Processing Hole That Lets Remote Users Execute Commands on the System
10441| [1003767] 'mod_frontpage' Module for Apache Web Server Has Buffer Overlow in 'fpexec.c' That Allows Remote Users to Execute Arbitrary Code on the System with Root Privileges
10442| [1003723] Apache-SSL for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
10443| [1003664] 'mod_ssl' Security Package for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
10444| [1003602] GNUJSP Java Server Pages Implementation Discloses Web Files and Source Code to Remote Users and Bypasses Apache Access Control Restrictions
10445| [1003465] PHP for Apache Web Server May Disclose Installation Path Information to Remote Users Making 'OPTIONS' Requests
10446| [1003451] Oracle Application Server PL/SQL Module for Apache Has Buffer Overflows That Allow Remote Users to Execute Arbitrary Code and Gain Access to the Server
10447| [1003131] Apache Web Server in Virtual Hosting Mode Can Be Crashed By a Local User Removing a Log Directory
10448| [1003104] PHP.EXE Windows CGI for Apache Web Server May Let Remote Users View Files on the Server Due to Configuration Error
10449| [1003008] Apache 'mod_bf' Module Lets Remote Users Execute Arbitrary Code
10450| [1002629] Apache suEXEC Wrapper Fails to Observe Minimum Group ID Security Settings in Certain Situations
10451| [1002542] Apache Web Server Virtual Hosting Split-Logfile Function Lets Remote Users Write Log Entries to Arbitrary Files on the System
10452| [1002400] Apache mod_gzip Module Has Buffer Overflow That Can Be Exploited By Local Users to Gain Elevated Privileges
10453| [1002303] Several 3rd Party Apache Authentication Modules Allow Remote Users to Execute Arbitrary Code to Gain Access to the System or Execute Stored Procedures to Obtain Arbitrary Database Information
10454| [1002188] Apache Web Server Discloses Internal IP Addresses to Remote Users in Certain Configurations
10455| [1001989] Apache Web Server May Disclose Directory Contents Even If an Index.html File is Present in the Directory
10456| [1001719] Apache Web Server on Mac OS X Client Fails to Enforce File and Directory Access Protections, Giving Remote Users Access to Restricted Pages
10457| [1001572] Apache Web Server on Microsoft Windows Platforms Allows Remote Users to Crash the Web Server
10458| [1001304] Apache Web Server for Windows Lets Remote Users Crash the Web Server Application
10459| [1001083] Apache Web Server May Display Directory Index Listings Even if Directory Listings Are Disabled
10460|
10461| OSVDB - http://www.osvdb.org:
10462| [96078] Apache CloudStack Infrastructure Menu Setup Network Multiple Field XSS
10463| [96077] Apache CloudStack Global Settings Multiple Field XSS
10464| [96076] Apache CloudStack Instances Menu Display Name Field XSS
10465| [96075] Apache CloudStack Instances Menu Add Instances Network Name Field XSS
10466| [96074] Apache CloudStack Instances Menu Add Instances Review Step Multiple Field XSS
10467| [96031] Apache HTTP Server suEXEC Symlink Arbitrary File Access
10468| [95888] Apache Archiva Single / Double Quote Character Handling XSS Weakness
10469| [95885] Apache Subversion mod_dav_svn Module Crafted HTTP Request Handling Remote DoS
10470| [95706] Apache OpenOffice.org (OOo) OOXML Document File XML Element Handling Memory Corruption
10471| [95704] Apache OpenOffice.org (OOo) DOC File PLCF Data Handling Memory Corruption
10472| [95603] Apache Continuum web/util/GenerateRecipentNotifier.java recipient Parameter XSS
10473| [95602] Apache Continuum web/action/notifier/JabberProjectNotifierEditAction-jabberProjectNotifierSave-validation.xml Multiple Parameter XSS
10474| [95601] Apache Continuum web/action/notifier/JabberGroupNotifierEditAction-jabberProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
10475| [95600] Apache Continuum web/action/ScheduleAction-saveSchedule-validation.xml Multiple Parameter XSS
10476| [95599] Apache Continuumweb/action/BuildDefinitionAction-saveBuildDefinition-validation.xml Multiple Parameter XSS
10477| [95598] Apache Continuum web/action/AddProjectAction-addProject-validation.xml Multiple Parameter XSS
10478| [95597] Apache Continuum web/action/ProjectEditAction-projectSave-validation.xml Multiple Parameter XSS
10479| [95596] Apache Continuum web/action/notifier/IrcGroupNotifierEditAction-ircProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
10480| [95595] Apache Continuum web/action/notifier/IrcProjectNotifierEditAction-ircProjectNotifierSave-validation.xml Multiple Parameter XSS
10481| [95594] Apache Continuum web/action/ProjectGroupAction.java Multiple Parameter XSS
10482| [95593] Apache Continuum web/action/AddProjectGroupAction.java Multiple Parameter XSS
10483| [95592] Apache Continuum web/action/AddProjectAction.java Multiple Parameter XSS
10484| [95523] Apache OFBiz Webtools Application View Log Screen Unspecified XSS
10485| [95522] Apache OFBiz Nested Expression Evaluation Arbitrary UEL Function Execution
10486| [95521] Apache HTTP Server mod_session_dbd Session Saving Unspecified Issue
10487| [95498] Apache HTTP Server mod_dav.c Crafted MERGE Request Remote DoS
10488| [95406] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Arbitrary Site Redirect
10489| [95405] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Remote Code Execution
10490| [95011] Apache CXF XML Parser SOAP Message Handling CPU Resource Exhaustion Remote DoS
10491| [94705] Apache Geronimo RMI Classloader Exposure Serialized Object Handling Remote Code Execution
10492| [94651] Apache Santuario (XML Security for C++) XML Signature CanonicalizationMethod Parameter Spoofing Weakness
10493| [94636] Apache Continuum workingCopy.action userDirectory Traversal Arbitrary File Access
10494| [94635] Apache Maven SCM SvnCommandlineUtils Process Listing Local Password Disclosure
10495| [94632] Apache Maven Wagon SSH (wagon-ssh) Host Verification Failure MitM Weakness
10496| [94625] Apache Santuario (XML Security for C++) XML Signature Reference Crafted XPointer Expression Handling Heap Buffer Overflow
10497| [94618] Apache Archiva /archiva/security/useredit.action username Parameter XSS
10498| [94617] Apache Archiva /archiva/security/roleedit.action name Parameter XSS
10499| [94616] Apache Archiva /archiva/security/userlist!show.action roleName Parameter XSS
10500| [94615] Apache Archiva /archiva/deleteArtifact!doDelete.action groupId Parameter XSS
10501| [94614] Apache Archiva /archiva/admin/addLegacyArtifactPath!commit.action legacyArtifactPath.path Parameter XSS
10502| [94613] Apache Archiva /archiva/admin/addRepository.action Multiple Parameter XSS
10503| [94612] Apache Archiva /archiva/admin/editAppearance.action Multiple Parameter XSS
10504| [94611] Apache Archiva /archiva/admin/addLegacyArtifactPath.action Multiple Parameter XSS
10505| [94610] Apache Archiva /archiva/admin/addNetworkProxy.action Multiple Parameter XSS
10506| [94403] Apache Santuario (XML Security for C++) InclusiveNamespace PrefixList Processing Heap Overflow
10507| [94402] Apache Santuario (XML Security for C++) HMAC-based XML Signature Processing DoS
10508| [94401] Apache Santuario (XML Security for C++) XPointer Evaluation Stack Overflow
10509| [94400] Apache Santuario (XML Security for C++) HMAC-Based XML Signature Reference Element Validation Spoofing Weakness
10510| [94279] Apache Qpid CA Certificate Validation Bypass
10511| [94275] Apache Solr JettySolrRunner.java Can Not Find Error Message XSS
10512| [94233] Apache OpenJPA Object Deserialization Arbitrary Executable Creation
10513| [94042] Apache Axis JAX-WS Java Unspecified Exposure
10514| [93969] Apache Struts OGNL Expression Handling Double Evaluation Error Remote Command Execution
10515| [93796] Apache Subversion Filename Handling FSFS Repository Corruption Remote DoS
10516| [93795] Apache Subversion svnserve Server Aborted Connection Message Handling Remote DoS
10517| [93794] Apache Subversion contrib/hook-scripts/check-mime-type.pl svnlook Hyphenated argv Argument Handling Remote DoS
10518| [93793] Apache Subversion contrib/hook-scripts/svn-keyword-check.pl Filename Handling Remote Command Execution
10519| [93646] Apache Struts Crafted Parameter Arbitrary OGNL Code Execution
10520| [93645] Apache Struts URL / Anchor Tag includeParams Attribute Remote Command Execution
10521| [93636] Apache Pig Multiple Physical Operator Memory Exhaustion Remote Remote DoS
10522| [93635] Apache Wink DTD (Document Type Definition) Expansion Data Parsing Information Disclosure
10523| [93605] RT Apache::Session::File Session Replay Reuse Information Disclosure
10524| [93599] Apache Derby SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY Boot Password Manipulation Re-encryption Failure Password Corruption
10525| [93555] Apache Commons Codec Invalid Base32 String Information Tunneling Weakness
10526| [93554] Apache HBase bulkLoadHFiles() Method ACL Bypass
10527| [93543] JBoss Enterprise Application Platform org.apache.catalina.connector.Response.encodeURL() Method MitM jsessionid Disclosure
10528| [93542] Apache ManifoldCF (Connectors Framework) org.apache.manifoldcf.crawler.ExportConfiguration Class Configuration Export Password Disclosure
10529| [93541] Apache Solr json.wrf Callback XSS
10530| [93524] Apache Hadoop GetSecurityDescriptorControl() Function Absolute Security Descriptor Handling NULL Descriptor Weakness
10531| [93521] Apache jUDDI Security API Token Session Persistence Weakness
10532| [93520] Apache CloudStack Default SSL Key Weakness
10533| [93519] Apache Shindig /ifr Cross-site Arbitrary Gadget Invocation
10534| [93518] Apache Solr /admin/analysis.jsp name Parameter XSS
10535| [93517] Apache CloudStack setup-cloud-management /etc/sudoers Modification Local Privilege Escalation
10536| [93516] Apache CXF UsernameTokenInterceptor Nonce Caching Replay Weakness
10537| [93515] Apache HBase table.jsp name Parameter XSS
10538| [93514] Apache CloudStack Management Server Unauthenticated Remote JMX Connection Default Setting Weakness
10539| [93463] Apache Struts EL / OGNL Interpretation Unspecified Remote Code Execution
10540| [93462] Apache CXF WS-SecurityPolicy AlgorithmSuite Arbitrary Ciphertext Decryption Weakness
10541| [93401] Apache Hadoop core-site.xml Permission Weakness Local Alfredo Secret Disclosure
10542| [93400] Apache Hadoop Map/Reduce Job Log Directory Symlink Arbitrary File Mode Manipulation
10543| [93397] Apache Wicket Referrer HTTP Header Session ID Disclosure
10544| [93366] Apache HTTP Server modules/mappers/mod_rewrite.c do_rewritelog() Function Log File Terminal Escape Sequence Filtering Remote Command Execution
10545| [93254] Apache Tomcat AsyncListener Method Cross-session Information Disclosure
10546| [93253] Apache Tomcat Chunked Transfer Encoding Data Saturation Remote DoS
10547| [93252] Apache Tomcat FORM Authenticator Session Fixation
10548| [93172] Apache Camel camel/endpoints/ Endpoint XSS
10549| [93171] Apache Sling HtmlResponse Error Message XSS
10550| [93170] Apache Directory DelegatingAuthenticator MitM Spoofing Weakness
10551| [93169] Apache Wave AuthenticationServlet.java Session Fixation Weakness
10552| [93168] Apache Click ErrorReport.java id Parameter XSS
10553| [93167] Apache ActiveMQ JMSXUserId Spoofing Weakness
10554| [93166] Apache CXF Crafted Message Element Count Handling System Resource Exhaustion Remote DoS
10555| [93165] Apache CXF Crafted Message Element Level Handling System Resource Exhaustion Remote DoS
10556| [93164] Apache Harmony DatagramSocket Class connect Method CheckAccept() IP Blacklist Bypass
10557| [93163] Apache Hadoop Map/Reduce Daemon Symlink Arbitrary File Overwrite
10558| [93162] Apache VelocityStruts struts/ErrorsTool.getMsgs Error Message XSS
10559| [93161] Apache CouchDB Rewriter VM Atom Table Memory Exhaustion Remote DoS
10560| [93158] Apache Wicket BookmarkablePageLink Feature XSS CSRF
10561| [93157] Apache Struts UrlHelper.java s:url includeParams Functionality XSS
10562| [93156] Apache Tapestry Calendar Component datefield.js datefield Parameter XSS
10563| [93155] Apache Struts fielderror.ftl fielderror Parameter Error Message XSS
10564| [93154] Apache JSPWiki Edit.jsp createPages WikiPermission Bypass
10565| [93153] Apache PDFBox PDFXrefStreamParser Missing Element Handling PDF Parsing DoS
10566| [93152] Apache Hadoop HttpServer.java Multiple Function XSS
10567| [93151] Apache Shiro Search Filter userName Parameter LDAP Code Injection Weakness
10568| [93150] Apache Harmony java.net.SocketPermission Class boolean equals Function checkConnect() Weakness Host Name Retrieval
10569| [93149] Apache Harmony java.security.Provider Class void load Function checkSecurityAccess() Weakness
10570| [93148] Apache Harmony java.security.ProtectionDomain Class java.lang.String.toString() Function checkPermission() Weakness
10571| [93147] Apache Harmony java.net.URLConnection openConnection Function checkConnect Weakness Proxy Connection Permission Bypass
10572| [93146] Apache Harmony java.net.ServerSocket Class void implAccept Function checkAccept() Weakness SerSocket Subclass Creation
10573| [93145] Apache Qpid JMS Client Detached Session Frame Handling NULL Pointer Dereference Remote DoS
10574| [93144] Apache Solr Admin Command Execution CSRF
10575| [93009] Apache VCL XMLRPC API Unspecified Function Remote Privilege Escalation
10576| [93008] Apache VCL Web GUI Unspecified Remote Privilege Escalation
10577| [92997] Apache Commons Codec org.apache.commons.codec.net.URLCodec Fields Missing 'final' Thread-safety Unspecified Issue
10578| [92976] Apache ActiveMQ scheduled.jsp crontab Command XSS
10579| [92947] Apache Commons Codec org.apache.commons.codec.language.Soundex.US_ENGLISH_MAPPING Missing MS_PKGPROTECT Field Manipulation Unspecified Issue
10580| [92749] Apache CloudStack Predictable Hash Virtual Machine Console Console Access URL Generation
10581| [92748] Apache CloudStack VM Console Access Restriction Bypass
10582| [92709] Apache ActiveMQ Web Console Unauthenticated Remote Access
10583| [92708] Apache ActiveMQ Sample Web Application Broker Resource Consumption Remote DoS
10584| [92707] Apache ActiveMQ webapp/websocket/chat.js Subscribe Message XSS
10585| [92706] Apache ActiveMQ Debug Log Rendering XSS
10586| [92705] Apache ActiveMQ PortfolioPublishServlet.java refresh Parameter XSS
10587| [92270] Apache Tomcat Unspecified CSRF
10588| [92094] Apache Subversion mod_dav_svn Module Nonexistent URL Lock Request Handling NULL Pointer Dereference Remote DoS
10589| [92093] Apache Subversion mod_dav_svn Module Activity URL PROPFIND Request Handling NULL Pointer Dereference Remote DoS
10590| [92092] Apache Subversion mod_dav_svn Module Log REPORT Request Handling NULL Pointer Dereference Remote DoS
10591| [92091] Apache Subversion mod_dav_svn Module Node Property Handling Resource Exhaustion Remote DoS
10592| [92090] Apache Subversion mod_dav_svn Module Activity URL Lock Request Handling NULL Pointer Dereference Remote DoS
10593| [91774] Apache Commons Codec Unspecified Non-private Field Manipulation Weakness
10594| [91628] mod_ruid2 for Apache HTTP Server fchdir() Inherited File Descriptor chroot Restriction Bypass
10595| [91328] Apache Wicket $up$ Traversal Arbitrary File Access
10596| [91295] Apple Mac OS X Apache Unicode Character URI Handling Authentication Bypass
10597| [91235] Apache Rave /app/api/rpc/users/get User Object Hashed Password Remote Disclosure
10598| [91185] Munin Default Apache Configuration Permission Weakness Remote Information Disclosure
10599| [91173] Apache Wicket WebApplicationPath Constructor Bypass /WEB-INF/ Directory File Access
10600| [91172] Apache Wicket PackageResourceGuard File Extension Filter Bypass
10601| [91025] Apache Qpid qpid::framing::Buffer Class Multiple Method Out-of-bounds Access Remote DoS
10602| [91024] Apache Qpid federation_tag Attribute Handling Federated Interbroker Link Access Restriction Bypass
10603| [91023] Apache Qpid AMQP Type Decoder Exposure Array Size Value Handling Memory Consumption Remote DoS
10604| [91022] Apache Qpid qpid/cpp/include/qpid/framing/Buffer.h qpid::framing::Buffer::checkAvailable() Function Integer Overflow
10605| [90986] Apache Jena ARQ INSERT DATA Request Handling Overflow
10606| [90907] Apache Subversion mod_dav_svn / libsvn_fs svn_fs_file_length() Function MKACTIVITY / PROPFIND Option Request Handling Remote DoS
10607| [90906] Apache Commons FileUpload /tmp Storage Symlink Arbitrary File Overwrite
10608| [90864] Apache Batik 1xx Redirect Script Origin Restriction Bypass
10609| [90858] Apache Ant Malformed TAR File Handling Infinite Loop DoS
10610| [90852] Apache HTTP Server for Debian apachectl /var/lock Permission Weakness Symlink Directory Permission Manipulation
10611| [90804] Apache Commons CLI Path Subversion Local Privilege Escalation
10612| [90802] Apache Avro Recursive Schema Handling Infinite Recursion DoS
10613| [90592] Apache Batik ApplicationSecurityEnforcer.java Multiple Method Security Restriction Bypass
10614| [90591] Apache Batik XML External Entity (XXE) Data Parsing Arbitrary File Disclosure
10615| [90565] Apache Tomcat Log Directory Permission Weakness Local Information Disclosure
10616| [90564] Apache Maven / Maven Wagon SSL Certificate Validation MitM Spoofing Weakness
10617| [90557] Apache HTTP Server mod_proxy_balancer balancer-manager Interface Multiple Parameter XSS
10618| [90556] Apache HTTP Server Multiple Module Multiple Parameter XSS
10619| [90276] Apache Axis2 axis2.xml Plaintext Password Local Disclosure
10620| [90249] Apache Axiom ClassLoader XMLInputFactory / XMLOutputFactory Construction Unspecified Issue
10621| [90235] Apache Commons HttpClient Certificate Wildcard Matching Weakness
10622| [90079] Apache CXF WSS4JInInterceptor URIMappingInterceptor WS-Security SOAP Service Access Restriction Bypass
10623| [90078] Apache CXF WS-SecurityPolicy Enabled Plaintext UsernameTokens Handling Authentication Bypass
10624| [89453] Apache Open For Business Project (OFBiz) Screenlet.title Widget Attribute XSS
10625| [89452] Apache Open For Business Project (OFBiz) Image.alt Widget Attribute XSS
10626| [89294] Apache CouchDB Futon UI Browser-based Test Suite Query Parameter XSS
10627| [89293] Apache CouchDB Unspecified Traversal Arbitrary File Access
10628| [89275] Apache HTTP Server mod_proxy_ajp Module Expensive Request Parsing Remote DoS
10629| [89267] Apache CouchDB JSONP Callback Handling Unspecified XSS
10630| [89146] Apache CloudStack Master Server log4j.conf SSH Private Key / Plaintext Password Disclosure
10631| [88603] Apache OpenOffice.org (OOo) Unspecified Information Disclosure
10632| [88602] Apache OpenOffice.org (OOo) Unspecified Manifest-processing Issue
10633| [88601] Apache OpenOffice.org (OOo) Unspecified PowerPoint File Handling Issue
10634| [88285] Apache Tomcat Partial HTTP Request Saturation Remote DoS
10635| [88095] Apache Tomcat NIO Connector Terminated Connection Infinte Loop DoS
10636| [88094] Apache Tomcat FORM Authentication Crafted j_security_check Request Security Constraint Bypass
10637| [88093] Apache Tomcat Null Session Requst CSRF Prevention Filter Bypass
10638| [88043] IBM Tivoli Netcool/Reporter Apache CGI Unspecified Remote Command Execution
10639| [87580] Apache Tomcat DIGEST Authentication Session State Caching Authentication Bypass Weakness
10640| [87579] Apache Tomcat DIGEST Authentication Stale Nonce Verification Authentication Bypass Weakness
10641| [87477] Apache Tomcat Project Woodstock Service Error Page UTF-7 XSS Weakness
10642| [87227] Apache Tomcat InternalNioInputBuffer.java parseHeaders() Function Request Header Size Parsing Remote DoS
10643| [87223] Apache Tomcat DIGEST Authentication replay-countermeasure Functionality cnonce / cn Verification Authentication Bypass Weakness
10644| [87160] Apache Commons HttpClient X.509 Certificate Domain Name Matching MiTM Weakness
10645| [87159] Apache CXF X.509 Certificate Domain Name Matching MiTM Weakness
10646| [87150] Apache Axis / Axis2 X.509 Certificate Domain Name Matching MiTM Weakness
10647| [86902] Apache HTTP Server 3xx Redirect Internal IP Address Remote Disclosure
10648| [86901] Apache Tomcat Error Message Path Disclosure
10649| [86684] Apache CloudStack Unauthorized Arbitrary API Call Invocation
10650| [86556] Apache Open For Business Project (OFBiz) Unspecified Issue
10651| [86503] Visual Tools VS home/apache/DiskManager/cron/init_diskmgr Local Command Execution
10652| [86401] Apache ActiveMQ ResourceHandler Traversal Arbitrary File Access
10653| [86225] Apache Axis2 XML Signature Wrapping (XSW) Authentication Bypass
10654| [86206] Apache Axis2 Crafted SAML Assertion Signature Exclusion Attack Authentication Bypass
10655| [85722] Apache CXF SOAP Request Parsing Access Restriction Bypass
10656| [85704] Apache Qpid Incoming Client Connection Saturation Remote DoS
10657| [85474] Eucalyptus Apache Santuario (XML Security for Java) Library XML Signature Transform Handling DoS
10658| [85430] Apache mod_pagespeed Module Unspecified XSS
10659| [85429] Apache mod_pagespeed Module Hostname Verification Cross-host Resource Disclosure
10660| [85249] Apache Wicket Unspecified XSS
10661| [85236] Apache Hadoop conf/hadoop-env.sh Temporary File Symlink Arbitrary File Manipulation
10662| [85090] Apache HTTP Server mod_proxy_ajp.c mod_proxy_ajp Module Proxy Functionality Cross-client Information Disclosure
10663| [85089] Apache HTTP Server mod_proxy_http.c mod_proxy_http Module Cross-client Information Disclosure
10664| [85062] Apache Solr Autocomplete Module for Drupal Autocomplete Results XSS
10665| [85010] Apache Struts Token Handling Mechanism Token Name Configuration Parameter CSRF Weakness
10666| [85009] Apache Struts Request Parameter OGNL Expression Parsing Remote DoS
10667| [84911] libapache2-mod-rpaf X-Forward-For HTTP Header Parsing Remote DoS
10668| [84823] Apache HTTP Server Multiple Module Back End Server Error Handling HTTP Request Parsing Remote Information Disclosure
10669| [84818] Apache HTTP Server mod_negotiation Module mod_negotiation.c make_variant_list Function XSS
10670| [84562] Apache Qpid Broker Authentication Mechanism AMQP Client Shadow Connection NullAuthenticator Request Parsing Authentication Bypass
10671| [84458] Apache Libcloud SSL Certificate Validation MitM Spoofing Weakness
10672| [84279] PHP on Apache php_default_post_reader POST Request Handling Overflow DoS
10673| [84278] PHP w/ Apache PDO::ATTR_DEFAULT_FETCH_MODE / PDO::FETCH_CLASS DoS
10674| [84231] Apache Hadoop DataNodes Client BlockTokens Arbitrary Block Access
10675| [83943] Oracle Solaris Cluster Apache Tomcat Agent Subcomponent Unspecified Local Privilege Escalation
10676| [83939] Oracle Solaris Apache HTTP Server Subcomponent Unspecified Remote Information Disclosure
10677| [83685] svnauthcheck Apache HTTP Configuration File Permission Revocation Weakness
10678| [83682] Apache Sling POST Servlet @CopyFrom Operation HTTP Request Parsing Infinite Loop Remote DoS
10679| [83339] Apache Roller Blogger Roll Unspecified XSS
10680| [83270] Apache Roller Unspecified Admin Action CSRF
10681| [82782] Apache CXF WS-SecurityPolicy 1.1 SupportingToken Policy Bypass
10682| [82781] Apache CXF WS-SecurityPolicy Supporting Token Children Specification Token Signing Verification Weakness
10683| [82611] cPanel Apache Piped Log Configuration Log Message Formatting Traversal Arbitrary File Creation
10684| [82436] MapServer for Windows Bundled Apache / PHP Configuration Local File Inclusion
10685| [82215] PHP sapi/cgi/cgi_main.c apache_request_headers Function HTTP Header Handling Remote Overflow
10686| [82161] Apache Commons Compress bzip2 File Compression BZip2CompressorOutputStream Class File Handling Remote DoS
10687| [81965] Apache Batik Squiggle SVG Browser JAR File Arbitrary Code Execution
10688| [81790] Apache POI src/org/apache/poi/hwpf/model/UnhandledDataStructure.java UnhandledDataStructure() constructor Length Attribute CDF / CFBF File Handling Remote DoS
10689| [81660] Apache Qpid Credential Checking Cluster Authentication Bypass
10690| [81511] Apache for Debian /usr/share/doc HTTP Request Parsing Local Script Execution
10691| [81359] Apache HTTP Server LD_LIBRARY_PATH Variable Local Privilege Escalation
10692| [81349] Apache Open For Business Project (OFBiz) Webslinger Component Unspecified XSS
10693| [81348] Apache Open For Business Project (OFBiz) Content IDs / Map-Keys Unspecified XSS
10694| [81347] Apache Open For Business Project (OFBiz) Parameter Arrays Unspecified XSS
10695| [81346] Apache Open For Business Project (OFBiz) checkoutProcess.js getServerError() Function Unspecified XSS
10696| [81196] Apache Open For Business Project (OFBiz) FlexibleStringExpander Nested Script String Parsing Remote Code Execution
10697| [80981] Apache Hadoop Kerberos/MapReduce Security Feature User Impersonation Weakness
10698| [80571] Apache Traffic Server Host HTTP Header Parsing Remote Overflow
10699| [80547] Apache Struts XSLTResult.java File Upload Arbitrary Command Execution
10700| [80360] AskApache Password Protector Plugin for WordPress Error Page $_SERVER Superglobal XSS
10701| [80349] Apache HTTP Server mod_fcgid Module fcgid_spawn_ctl.c FcgidMaxProcessesPerClass Virtual Host Directive HTTP Request Parsing Remote DoS
10702| [80301] Apache Wicket /resources/ Absolute Path Arbitrary File Access
10703| [80300] Apache Wicket wicket:pageMapName Parameter XSS
10704| [79478] Apache Solr Extension for TYPO3 Unspecified XSS
10705| [79002] Apache MyFaces javax.faces.resource In Parameter Traversal Arbitrary File Access
10706| [78994] Apache Struts struts-examples/upload/upload-submit.do name Parameter XSS
10707| [78993] Apache Struts struts-cookbook/processDyna.do message Parameter XSS
10708| [78992] Apache Struts struts-cookbook/processSimple.do message Parameter XSS
10709| [78991] Apache Struts struts2-rest-showcase/orders clientName Parameter XSS
10710| [78990] Apache Struts struts2-showcase/person/editPerson.action Multiple Parameter XSS
10711| [78932] Apache APR Hash Collision Form Parameter Parsing Remote DoS
10712| [78903] Apache CXF SOAP Request Parsing WS-Security UsernameToken Policy Bypass
10713| [78600] Apache Tomcat HTTP DIGEST Authentication DigestAuthenticator.java Catalina Weakness Security Bypass
10714| [78599] Apache Tomcat HTTP DIGEST Authentication Realm Value Parsing Security Bypass
10715| [78598] Apache Tomcat HTTP DIGEST Authentication qop Value Parsing Security Bypass
10716| [78573] Apache Tomcat Parameter Saturation CPU Consumption Remote DoS
10717| [78556] Apache HTTP Server Status Code 400 Default Error Response httpOnly Cookie Disclosure
10718| [78555] Apache HTTP Server Threaded MPM %{cookiename}C Log Format String Cookie Handling Remote DoS
10719| [78501] Apache Struts ParameterInterceptor Class OGNL Expression Parsing Remote Command Execution
10720| [78331] Apache Tomcat Request Object Recycling Information Disclosure
10721| [78293] Apache HTTP Server Scoreboard Invalid Free Operation Local Security Bypass
10722| [78277] Apache Struts ExceptionDelegator Component Parameter Parsing Remote Code Execution
10723| [78276] Apache Struts DebuggingInterceptor Component Developer Mode Unspecified Remote Command Execution
10724| [78113] Apache Tomcat Hash Collision Form Parameter Parsing Remote DoS
10725| [78112] Apache Geronimo Hash Collision Form Parameter Parsing Remote DoS
10726| [78109] Apache Struts ParameterInterceptor Traversal Arbitrary File Overwrite
10727| [78108] Apache Struts CookieInterceptor Cookie Name Handling Remote Command Execution
10728| [77593] Apache Struts Conversion Error OGNL Expression Injection
10729| [77496] Apache ActiveMQ Failover Mechanism Openwire Request Parsing Remote DoS
10730| [77444] Apache HTTP Server mod_proxy Mdule Web Request HTTP/0.9 Protocol URL Parsing Proxy Remote Security Bypass
10731| [77374] Apache MyFaces Java Bean includeViewParameters Parsing EL Expression Security Weakness
10732| [77310] Apache HTTP Server mod_proxy Reverse Proxy Mode Security Bypass Weakness (2011-4317)
10733| [77234] Apache HTTP Server on cygwin Encoded Traversal Arbitrary File Access
10734| [77012] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Memory Consumption DoS
10735| [76944] Apache Tomcat Manager Application Servlets Access Restriction Bypass
10736| [76744] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Overflow
10737| [76189] Apache Tomcat HTTP DIGEST Authentication Weakness
10738| [76079] Apache HTTP Server mod_proxy Mdule Web Request URL Parsing Proxy Remote Security Bypass (2011-3368)
10739| [76072] Apache JServ jserv.conf jserv-status Handler jserv/ URI Request Parsing Local Information Disclosure
10740| [75807] Apache HTTP Server Incomplete Header Connection Saturation Remote DoS
10741| [75647] Apache HTTP Server mod_proxy_ajp Module mod_proxy_balancer HTTP Request Remote DoS
10742| [75376] Apache Libcloud SSL Certificate Validation MitM Server Spoofing Weakness
10743| [74853] Domain Technologie Control /etc/apache2/apache2.conf File Permissions Weakness dtcdaemons User Password Disclosure
10744| [74818] Apache Tomcat AJP Message Injection Authentication Bypass
10745| [74725] Apache Wicket Multi Window Support Unspecified XSS
10746| [74721] Apache HTTP Server ByteRange Filter Memory Exhaustion Remote DoS
10747| [74541] Apache Commons Daemon Jsvc Permissions Weakness Arbitrary File Access
10748| [74535] Apache Tomcat XML Parser Cross-application Multiple File Manipulation
10749| [74447] Apache Struts XWork Nonexistent Method s:submit Element Internal Java Class Remote Path Disclosure
10750| [74262] Apache HTTP Server Multi-Processing Module itk.c Configuration Merger mpm-itk root UID / GID Remote Privilege Escalation
10751| [74120] Apache HTTP Server mod_authnz_external mysql/mysql-auth.pl user Field SQL Injection
10752| [73920] Oracle Secure Backup /apache/htdocts/php/common.php username Parameter Remote Code Execution
10753| [73798] Apache Tomcat sendfile Request Start / Endpoint Parsing Local DoS
10754| [73797] Apache Tomcat sendfile Request Attribute Validation Weakness Local Access Restriction Bypass
10755| [73776] Apache Tomcat HTTP BIO Connector HTTP Pipelining Cross-user Remote Response Access
10756| [73644] Apache XML Security Signature Key Parsing Overflow DoS
10757| [73600] Apache Struts javatemplates Plugin Component Handlers .action URI Multiple Parameter XSS
10758| [73462] Apache Rampart/C util/rampart_timestamp_token.c rampart_timestamp_token_validate Function Expired Token Remote Access Restriction Bypass
10759| [73429] Apache Tomcat JMX MemoryUserDatabase Local Password Disclosure
10760| [73384] Apache HTTP Server mod_rewrite PCRE Resource Exhaustion DoS
10761| [73383] Apache HTTP Server Portable Runtime (APR) Library apr_fnmatch() Infinite Loop Remote DoS
10762| [73378] IBM WebSphere Application Server (WAS) JavaServer Pages org.apache.jasper.runtime.JspWriterImpl.response JSP Page Application Restart Remote DoS
10763| [73247] Apache Subversion mod_dav_svn File Permission Weakness Information Disclosure
10764| [73246] Apache Subversion mod_dav_svn Path-based Access Control Rule Handling Remote DoS
10765| [73245] Apache Subversion mod_dav_svn Baselined Resource Request Handling Remote DoS
10766| [73154] Apache Archiva Multiple Unspecified CSRF
10767| [73153] Apache Archiva /archiva/admin/deleteNetworkProxy!confirm.action proxyid Parameter XSS
10768| [72407] Apache Tomcat @ServletSecurity Initial Load Annotation Security Constraint Bypass Information Disclosure
10769| [72238] Apache Struts Action / Method Names <
10770| [71647] Apache HttpComponents HttpClient Proxy-Authorization Credentials Remote Disclosure
10771| [71558] Apache Tomcat SecurityManager ServletContext Attribute Traversal Arbitrary File Manipulation
10772| [71557] Apache Tomcat HTML Manager Multiple XSS
10773| [71075] Apache Archiva User Management Page XSS
10774| [71027] Apache Tomcat @ServletSecurity Annotation Security Constraint Bypass Information Disclosure
10775| [70925] Apache Continuum Project Pages Unspecified XSS (2011-0533)
10776| [70924] Apache Continuum Multiple Admin Function CSRF
10777| [70809] Apache Tomcat NIO HTTP Connector Request Line Processing DoS
10778| [70734] Apache CouchDB Request / Cookie Handling Unspecified XSS
10779| [70585] Oracle Fusion Middleware Oracle HTTP Server Apache Plugin Unspecified Remote Issue
10780| [70333] Apache Subversion rev_hunt.c blame Command Multiple Memory Leak Remote DoS
10781| [70332] Apache Subversion Apache HTTP Server mod_dav_svn repos.c walk FunctionSVNParentPath Collection Remote DoS
10782| [69659] Apache Archiva Admin Authentication Weakness Privilege Escalation
10783| [69520] Apache Archiva Administrator Credential Manipulation CSRF
10784| [69512] Apache Tomcat Set-Cookie Header HTTPOnly Flag Session Hijacking Weakness
10785| [69456] Apache Tomcat Manager manager/html/sessions Multiple Parameter XSS
10786| [69275] Apache mod_fcgid Module fcgid_bucket.c fcgid_header_bucket_read() Function Remote Overflow
10787| [69067] Apache Shiro URI Path Security Traversal Information Disclosure
10788| [68815] Apache MyFaces shared/util/StateUtils.java View State MAC Weakness Cryptographic Padding Remote View State Modification
10789| [68670] Apache Qpid C++ Broker Component broker/SessionAdapter.cpp SessionAdapter::ExchangeHandlerImpl::checkAlternate Function Exchange Alternate Remote DoS
10790| [68669] Apache Qpid cluster/Cluster.cpp Cluster::deliveredEvent Function Invalid AMQP Data Remote DoS
10791| [68662] Apache Axis2 dswsbobje.war Module Admin Account Default Password
10792| [68531] Apache Qpid qpidd sys/ssl/SslSocket.cpp Incomplete SSL Handshake Remote DoS
10793| [68327] Apache APR-util buckets/apr_brigade.c apr_brigade_split_line() Function Memory Consumption DoS
10794| [68314] Apache XML-RPC SAX Parser External Entity Information Disclosure
10795| [67964] Apache Traffic Server Transaction ID / Source Port Randomization Weakness DNS Cache Poisoning
10796| [67846] SUSE Lifecycle Management Server on SUSE Linux Enterprise apache2-slms Parameter Quoting CSRF
10797| [67294] Apache CXF XML SOAP Message Crafted Document Type Declaration Remote DoS
10798| [67240] Apache CouchDB Installation Page Direct Request Arbitrary JavaScript Code Execution CSRF
10799| [67205] Apache Derby BUILTIN Authentication Password Hash Generation Algorithm SHA-1 Transformation Password Substitution
10800| [66745] Apache HTTP Server Multiple Modules Pathless Request Remote DoS
10801| [66319] Apache Tomcat Crafted Transfer-Encoding Header Handling Buffer Recycling Remote DoS
10802| [66280] Apache Struts XWork ParameterInterceptor Server-Side Object Remote Code Execution
10803| [66226] Apache Axis2 Admin Interface Cookie Session Fixation
10804| [65697] Apache Axis2 / Java SOAP Message DTD Rejection Weakness Arbitrary File Access
10805| [65654] Apache HTTP Server mod_proxy_http mod_proxy_http.c Timeout Detection Weakness HTTP Request Response Disclosure
10806| [65429] Apache MyFaces Unencrypted ViewState Serialized View Object Manipulation Arbitrary Expression Language (EL) Statement Execution
10807| [65054] Apache ActiveMQ Jetty Error Handler XSS
10808| [64844] Apache Axis2/Java axis2/axis2-admin/engagingglobally modules Parameter XSS
10809| [64522] Apache Open For Business Project (OFBiz) ecommerce/control/contactus Multiple Parameter XSS
10810| [64521] Apache Open For Business Project (OFBiz) Web Tools Section entityName Parameter XSS
10811| [64520] Apache Open For Business Project (OFBiz) ecommerce/control/ViewBlogArticle contentId Parameter XSS
10812| [64519] Apache Open For Business Project (OFBiz) Control Servlet URI XSS
10813| [64518] Apache Open For Business Project (OFBiz) Show Portal Page Section start Parameter XSS
10814| [64517] Apache Open For Business Project (OFBiz) View Profile Section partyId Parameter XSS
10815| [64516] Apache Open For Business Project (OFBiz) Export Product Listing Section productStoreId Parameter XSS
10816| [64307] Apache Tomcat Web Application Manager/Host Manager CSRF
10817| [64056] mod_auth_shadow for Apache HTTP Server wait() Function Authentication Bypass
10818| [64023] Apache Tomcat WWW-Authenticate Header Local Host Information Disclosure
10819| [64020] Apache ActiveMQ Jetty ResourceHandler Crafted Request JSP File Source Disclosure
10820| [63895] Apache HTTP Server mod_headers Unspecified Issue
10821| [63368] Apache ActiveMQ createDestination.action JMSDestination Parameter CSRF
10822| [63367] Apache ActiveMQ createDestination.action JMSDestination Parameter XSS
10823| [63350] Apache CouchDB Hash Verification Algorithm Predictable Execution Time Weakness
10824| [63140] Apache Thrift Service Malformed Data Remote DoS
10825| [62676] Apache HTTP Server mod_proxy_ajp Module Crafted Request Remote DoS
10826| [62675] Apache HTTP Server Multi-Processing Module (MPM) Subrequest Header Handling Cross-thread Information Disclosure
10827| [62674] Apache HTTP Server mod_isapi Module Unloading Crafted Request Remote DoS
10828| [62231] Apache HTTP Server Logging Format Weakness Crafted DNS Response IP Address Spoofing
10829| [62230] Apache HTTP Server Crafted DNS Response Inverse Lookup Log Corruption XSS
10830| [62054] Apache Tomcat WAR Filename Traversal Work-directory File Deletion
10831| [62053] Apache Tomcat Autodeployment Process appBase File HTTP Request Authentication Bypass
10832| [62052] Apache Tomcat WAR File Traversal Arbitrary File Overwrite
10833| [62009] Apache HTTP Server src/modules/proxy/proxy_util.c mod_proxy ap_proxy_send_fb() Function Overflow
10834| [61379] Apache River Outrigger Entry Storage Saturation Memory Exhaustion DoS
10835| [61378] Apache Hadoop Map/Reduce JobTracker Memory Consumption DoS
10836| [61377] Apache Commons Modeler Multiple Mutable Static Fields Weakness
10837| [61376] Apache Rampart wsse:security Tag Signature Value Checking Weakness
10838| [60687] Apache C++ Standard Library (STDCXX) strxfrm() Function Overflow
10839| [60680] Apache Hadoop JobHistory Job Name Manipulation Weakness
10840| [60679] Apache ODE DeploymentWebService OMElement zipPart CRLF Injection
10841| [60678] Apache Roller Comment Email Notification Manipulation DoS
10842| [60677] Apache CouchDB Unspecified Document Handling Remote DoS
10843| [60428] Sun Java Plug-in org.apache.crimson.tree.XmlDocument Class reateXmlDocument Method Floppy Drive Access Bypass
10844| [60413] mod_throttle for Apache Shared Memory File Manipulation Local Privilege Escalation
10845| [60412] Sun Java Plug-in org.apache.xalan.processor.XSLProcessorVersion Class Unsigned Applet Variable Sharing Privilege Escalation
10846| [60396] Apache HTTP Server on OpenBSD Multipart MIME Boundary Remote Information Disclosure
10847| [60395] Apache HTTP Server on OpenBSD ETag HTTP Header Remote Information Disclosure
10848| [60232] PHP on Apache php.exe Direct Request Remote DoS
10849| [60176] Apache Tomcat Windows Installer Admin Default Password
10850| [60016] Apache HTTP Server on HP Secure OS for Linux HTTP Request Handling Unspecified Issue
10851| [59979] Apache HTTP Server on Apple Mac OS X HTTP TRACE Method Unspecified Client XSS
10852| [59969] Apache HTTP Server mod_ssl SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection
10853| [59944] Apache Hadoop jobhistory.jsp XSS
10854| [59374] Apache Solr Search Extension for TYPO3 Unspecified XSS
10855| [59022] Apache Shindig ConcatProxyServlet HTTP Header Response Splitting
10856| [59021] Apache Cocoon X-Cocoon-Version Header Remote Information Disclosure
10857| [59020] Apache Tapestry HTTPS Session Cookie Secure Flag Weakness
10858| [59019] Apache mod_python Cookie Salting Weakness
10859| [59018] Apache Harmony Error Message Handling Overflow
10860| [59013] Apache Derby SYSCS_EXPORT_TABLE Arbitrary File Overwrite
10861| [59012] Apache Derby Driver Auto-loading Non-deterministic Startup Weakness
10862| [59011] Apache JSPWiki Page Attachment Change Note Function XSS
10863| [59010] Apache Solr get-file.jsp XSS
10864| [59009] Apache Solr action.jsp XSS
10865| [59008] Apache Solr analysis.jsp XSS
10866| [59007] Apache Solr schema.jsp Multiple Parameter XSS
10867| [59006] Apache Beehive select / checkbox Tag XSS
10868| [59005] Apache Beehive jpfScopeID Global Parameter XSS
10869| [59004] Apache Beehive Error Message XSS
10870| [59003] Apache HttpClient POST Request Handling Memory Consumption DoS
10871| [59002] Apache Jetspeed default-page.psml URI XSS
10872| [59001] Apache Axis2 xsd Parameter Traversal Arbitrary File Disclosure
10873| [59000] Apache CXF Unsigned Message Policy Bypass
10874| [58999] Apache WSS4J CallbackHandler Plaintext Password Validation Weakness
10875| [58998] Apache OpenJPA persistence.xml Cleartext Password Local Disclosure
10876| [58997] Apache OpenEJB openejb.xml Cleartext Password Local Disclosure
10877| [58996] Apache Hadoop Map/Reduce LinuxTaskController File Group Ownership Weakness
10878| [58995] Apache Hadoop Map/Reduce Task Ownership Weakness
10879| [58994] Apache Hadoop Map/Reduce DistributedCache Localized File Permission Weakness
10880| [58993] Apache Hadoop browseBlock.jsp XSS
10881| [58991] Apache Hadoop browseDirectory.jsp XSS
10882| [58990] Apache Hadoop Map/Reduce HTTP TaskTrackers User Data Remote Disclosure
10883| [58989] Apache Hadoop Sqoop Process Listing Local Cleartext Password Disclosure
10884| [58988] Apache Hadoop Chukwa HICC Portal Unspecified XSS
10885| [58987] Apache Hadoop Map/Reduce TaskTracker User File Permission Weakness
10886| [58986] Apache Qpid Encrypted Message Handling Remote Overflow DoS
10887| [58985] Apache Qpid Process Listing Local Cleartext Password Disclosure
10888| [58984] Apache Jackrabbit Content Repository (JCR) Default Account Privilege Access Weakness
10889| [58983] Apache Jackrabbit Content Repository (JCR) NamespaceRegistry API Registration Method Race Condition
10890| [58982] Apache Synapse Proxy Service Security Policy Mismatch Weakness
10891| [58981] Apache Geronimo TomcatGeronimoRealm Security Context Persistence Weakness
10892| [58980] Apache Geronimo LDAP Realm Configuration Restart Reversion Weakness
10893| [58979] Apache MyFaces Tomahawk ExtensionsPhaseListener HTML Injection Information Disclosure
10894| [58978] Apache MyFaces Trinidad LocaleInfoScriptlet XSS
10895| [58977] Apache Open For Business Project (OFBiz) Multiple Default Accounts
10896| [58976] Apache Open For Business Project (OFBiz) URI passThru Parameter XSS
10897| [58975] Apache Open For Business Project (OFBiz) PARTYMGR_CREATE/UPDATE Permission Arbitrary User Password Modification
10898| [58974] Apache Sling /apps Script User Session Management Access Weakness
10899| [58973] Apache Tuscany Crafted SOAP Request Access Restriction Bypass
10900| [58931] Apache Geronimo Cookie Parameters Validation Weakness
10901| [58930] Apache Xalan-C++ XPath Handling Remote DoS
10902| [58879] Apache Portable Runtime (APR-util) poll/unix/port.c Event Port Backend Pollset Feature Remote DoS
10903| [58837] Apache Commons Net FTPSClient CipherSuites / Protocols Mutable Object Unspecified Data Security Issue
10904| [58813] Apache MyFaces Trinidad tr:table / HTML Comment Handling DoS
10905| [58812] Apache Open For Business Project (OFBiz) JSESSIONID Session Hijacking Weakness
10906| [58811] Apache Open For Business Project (OFBiz) /catalog/control/EditProductConfigItem configItemId Parameter XSS
10907| [58810] Apache Open For Business Project (OFBiz) /catalog/control/EditProdCatalo prodCatalogId Parameter XSS
10908| [58809] Apache Open For Business Project (OFBiz) /partymgr/control/viewprofile partyId Parameter XSS
10909| [58808] Apache Open For Business Project (OFBiz) /catalog/control/createProduct internalName Parameter XSS
10910| [58807] Apache Open For Business Project (OFBiz) Multiple Unspecified CSRF
10911| [58806] Apache FtpServer MINA Logging Filter Cleartext Credential Local Disclosure
10912| [58805] Apache Derby Unauthenticated Database / Admin Access
10913| [58804] Apache Wicket Header Contribution Unspecified Issue
10914| [58803] Apache Wicket Session Fixation
10915| [58802] Apache Directory Server (ApacheDS) userPassword Attribute Search Password Disclosure
10916| [58801] Apache ActiveMQ Stomp Client Credential Validation Bypass
10917| [58800] Apache Tapestry (context)/servicestatus Internal Service Information Disclosure
10918| [58799] Apache Tapestry Logging Cleartext Password Disclosure
10919| [58798] Apache Jetspeed pipeline Parameter pipeline-map Policy Bypass
10920| [58797] Apache Jetspeed Password Policy Multiple Weaknesses
10921| [58796] Apache Jetspeed Unsalted Password Storage Weakness
10922| [58795] Apache Rampart Crafted SOAP Header Authentication Bypass
10923| [58794] Apache Roller Admin Protocol (RAP) Malformed Header Authentication Bypass
10924| [58793] Apache Hadoop Map/Reduce mapred.system.dir Permission Weakness Job Manipulation
10925| [58792] Apache Shindig gadgets.rpc iframe RPC Call Validation Weakness
10926| [58791] Apache Synapse synapse.properties Cleartext Credential Local Disclosure
10927| [58790] Apache WSS4J SOAP Message UsernameToken Remote Password Disclosure
10928| [58789] Apache WSS4J SOAP Header Malformed UsernameToken Authentication Bypass
10929| [58776] Apache JSPWiki PreviewContent.jsp Edited Text XSS
10930| [58775] Apache JSPWiki preview.jsp action Parameter XSS
10931| [58774] Apache JSPWiki Edit.jsp Multiple Parameter XSS
10932| [58773] Apache JSPWiki Accept-Language Header Multiple Script language Parameter XSS
10933| [58772] Apache JSPWiki EditorManager.java editor Parameter XSS
10934| [58771] Apache JSPWiki GroupContent.jsp Multiple Parameter XSS
10935| [58770] Apache JSPWiki Group.jsp group Parameter XSS
10936| [58769] Apache JSPWiki Database Connection Termination DoS Weakness
10937| [58768] Apache JSPWiki Attachment Servlet nextpage Parameter Arbitrary Site Redirect
10938| [58766] Apache JSPWiki /admin/SecurityConfig.jsp Direct Request Information Disclosure
10939| [58765] Apache JSPWiki Spam Filter UniqueID RNG Weakness
10940| [58764] Apache JSPWiki Edit.jsp Multiple Parameter XSS
10941| [58763] Apache JSPWiki Include Tag Multiple Script XSS
10942| [58762] Apache JSPWiki Multiple .java Tags pageContext Parameter XSS
10943| [58761] Apache JSPWiki Wiki.jsp skin Parameter XSS
10944| [58760] Apache Commons VFS Exception Error Message Cleartext Credential Disclosure
10945| [58759] Apache Jackrabbit Content Repository (JCR) UUID System.currentTimeMillis() RNG Weakness
10946| [58758] Apache River GrantPermission Policy Manipulation Privilege Escalation
10947| [58757] Apache WS-Commons Java2 StaXUtils Multiple Unspecified Minor Issues
10948| [58756] Apache WSS4J WSHandler Client Certificate Signature Validation Weakness
10949| [58755] Apache Harmony DRLVM Non-public Class Member Access
10950| [58754] Apache Harmony File.createTempFile() Temporary File Creation Prediction Weakness
10951| [58751] Apache Geronimo GeronimoIdentityResolver Subject Handling Multiple Issues
10952| [58750] Apache MyFaces Trinidad Generated HTML Information Disclosure
10953| [58749] Apache MyFaces Trinidad Database Access Error Message Information Disclosure
10954| [58748] Apache MyFaces Trinidad Image Resource Loader Traversal Arbitrary Image Access
10955| [58747] Apache MyFaces Trinidad Error Message User Entered Data Disclosure Weakness
10956| [58746] Apache Axis2 JAX-WS Java2 WSDL4J Unspecified Issue
10957| [58744] Apache Wicket Crafted File Upload Disk Space Exhaustion DoS
10958| [58743] Apache Wicket wicket.util.crypt.SunJceCrypt Encryption Reversion Weakness
10959| [58742] Apache Rampart PolicyBasedValiadtor HttpsToken Endpoint Connection Weakness
10960| [58741] Apache Rampart WSSecSignature / WSSecEncryptedKey KeyIdentifierType Validation Weakness
10961| [58740] Apache Rampart TransportBinding Message Payload Cleartext Disclosure
10962| [58739] Apache Open For Business Project (OFBiz) Unsalted Password Storage Weakness
10963| [58738] Apache Open For Business Project (OFBiz) orderId Parameter Arbitrary Order Access
10964| [58737] Apache mod_python w/ mod_python.publisher index.py Underscore Prefixed Variable Disclosure
10965| [58735] Apache Open For Business Project (OFBiz) /ecommerce/control/keywordsearch SEARCH_STRING Parameter XSS
10966| [58734] Apache Torque Log File Cleartext Credential Local Disclosure
10967| [58733] Apache Axis2 doGet Implementation Authentication Bypass Service State Manipulation
10968| [58732] Apache MyFaces UIInput.validate() Null Value Validation Bypass Weakness
10969| [58731] Apache MyFaces /faces/* Prefix Mapping Authentication Bypass
10970| [58725] Apache Tapestry Basic String ACL Bypass Weakness
10971| [58724] Apache Roller Logout Functionality Failure Session Persistence
10972| [58723] Apache Roller User Profile / Admin Page Cleartext Password Disclosure
10973| [58722] Apache Derby Connection URL Encryption Method Reversion Weakness
10974| [58721] Apache Geronimo on Tomcat Security-constraint Resource ACL Bypass
10975| [58720] Apache Geronimo Explicit Servlet Mapping Access Bypass Weakness
10976| [58719] Apache Geronimo Keystore Unprivileged Service Disable DoS
10977| [58718] Apache Geronimo Deployment Plans Remote Password Disclosure
10978| [58717] Apache Jetspeed Portlet Application Edit Access Restriction Bypass
10979| [58716] Apache Jetspeed PSML Management Cached Constraint Authentication Weakness
10980| [58707] Apache WSS4J Crafted PasswordDigest Request Authentication Bypass
10981| [58706] Apache HttpClient Pre-emptive Authorization Remote Credential Disclosure
10982| [58705] Apache Directory Server (ApacheDS) User Passwords Cleartext Disclosure
10983| [58704] Apache Directory Server (ApacheDS) Non-existent User LDAP Bind Remote DoS
10984| [58703] Apache Geronimo Debug Console Unauthenticated Remote Information Disclosure
10985| [58702] Apache Directory Server (ApacheDS) Persistent LDAP Anonymous Bind Weakness
10986| [58701] Apache Jetspeed User Admin Portlet Unpassworded Account Creation Weakness
10987| [58700] Apache MyFaces /faces/* Path Handling Remote Overflow DoS
10988| [58699] Apache MyFaces Disable Property Client Side Manipulation Privilege Escalation
10989| [58698] Apache Roller Remember Me Functionality Cleartext Password Disclosure
10990| [58697] Apache XalanJ2 org.apache.xalan.xsltc.runtime.CallFunction Class Unspecified Issue
10991| [58696] Apache Tapestry Encoded Traversal Arbitrary File Access
10992| [58695] Apache Jetspeed Unauthenticated PSML Tags / Admin Folder Access
10993| [58694] Apache Geronimo Deploy Tool Process List Local Credential Disclosure
10994| [58693] Apache Derby service.properties File Encryption Key Information Disclosure
10995| [58692] Apache Geronimo Default Security Realm Login Brute Force Weakness
10996| [58689] Apache Roller Retrieve Last 5 Post Feature Unauthorized Blog Post Manipulation
10997| [58688] Apache Xalan-Java (XalanJ2) Static Variables Multiple Unspecified Issues
10998| [58687] Apache Axis Invalid wsdl Request XSS
10999| [58686] Apache Cocoon Temporary File Creation Unspecified Race Condition
11000| [58685] Apache Velocity Template Designer Privileged Code Execution
11001| [58684] Apache Jetspeed controls.Customize Action Security Check Bypass
11002| [58675] Apache Open For Business Project (OFBiz) eCommerce/ordermgr Multiple Field XSS
11003| [58674] Apache Open For Business Project (OFBiz) ecommerce/control/login Multiple Field XSS
11004| [58673] Apache Open For Business Project (OFBiz) ecommerce/control/viewprofile Multiple Field XSS
11005| [58672] Apache Open For Business Project (OFBiz) POS Input Panel Cleartext Password Disclosure
11006| [58671] Apache Axis2 JMS Signed Message Crafted WS-Security Header Security Bypass
11007| [58670] Apache Jetspeed JetspeedTool.getPortletFromRegistry Portlet Security Validation Failure
11008| [58669] Apache Jetspeed LDAP Cleartext Passwords Disclosure
11009| [58668] Apache Axis External Entity (XXE) Data Parsing Privilege Escalation
11010| [58667] Apache Roller Database Cleartext Passwords Disclosure
11011| [58666] Apache Xerces-C++ UTF-8 Transcoder Overlong Code Handling Unspecified Issue
11012| [58665] Apache Jetspeed Turbine: Cross-user Privileged Action Execution
11013| [58664] Apache Jetspeed EditAccount.vm Password Modification Weakness
11014| [58663] Apache Jetspeed Role Parameter Arbitrary Portlet Disclosure
11015| [58662] Apache Axis JWS Page Generated .class File Direct Request Information Disclosure
11016| [58661] Apache Jetspeed user-form.vm Password Reset Cleartext Disclosure
11017| [58660] Apache WSS4J checkReceiverResults Function Crafted SOAP Request Authentication Bypass
11018| [58658] Apache Rampart Crafted SOAP Request Security Verification Bypass
11019| [57882] Apache HTTP Server mod_proxy_ftp Authorization HTTP Header Arbitrary FTP Command Injection
11020| [57851] Apache HTTP Server mod_proxy_ftp EPSV Command NULL Dereference Remote DoS
11021| [56984] Apache Xerces2 Java Malformed XML Input DoS
11022| [56903] Apache ODE (Orchestration Director Engine) Process Deployment Web Service Traversal Arbitrary File Manipulation
11023| [56859] Apache Xerces-C++ Multiple Sub-project XML Nested DTD Structures Parsing Recursion Error DoS
11024| [56766] Apache Portable Runtime (APR-util) memory/unix/apr_pools.c Relocatable Memory Block Aligning Overflow
11025| [56765] Apache Portable Runtime (APR-util) misc/apr_rmm.c Multiple Function Overflows
11026| [56517] Apache HTTP Server File Descriptor Leak Arbitrary Local File Append
11027| [56443] PTK Unspecified Apache Sub-process Arbitrary Command Execution
11028| [56414] Apache Tiles Duplicate Expression Language (EL) Expression Evaluation XSS
11029| [55814] mod_NTLM for Apache HTTP Server ap_log_rerror() Function Remote Format String
11030| [55813] mod_NTLM for Apache HTTP Server log() Function Remote Overflow
11031| [55782] Apache HTTP Server mod_deflate Module Aborted Connection DoS
11032| [55553] Apache HTTP Server mod_proxy Module mod_proxy_http.c stream_reqbody_cl Function CPU Consumption DoS
11033| [55059] Apache APR-util strmatch/apr_strmatch.c apr_strmatch_precompile Function Crafted Input Remote DoS
11034| [55058] Apache APR-util apr_brigade_vprintf Function Crafted Input Off-by-one Remote DoS
11035| [55057] Apache APR-util xml/apr_xml.c apr_xml_* Interface Expat XML Parser Crafted XML Document Remote DoS
11036| [55056] Apache Tomcat Cross-application TLD File Manipulation
11037| [55055] Apache Tomcat Illegal URL Encoded Password Request Username Enumeration
11038| [55054] Apache Tomcat Java AJP Connector mod_jk Load Balancing Worker Malformed Header Remote DoS
11039| [55053] Apache Tomcat Crafted Request Security Restraint Bypass Arbitrary Content Access
11040| [54733] Apache HTTP Server AllowOverride Directive .htaccess Options Bypass
11041| [54713] razorCMS Security Manager apache User Account Unspecified File Permission Weakness Issue
11042| [54589] Apache Jserv Nonexistent JSP Request XSS
11043| [54122] Apache Struts s:a / s:url Tag href Element XSS
11044| [54093] Apache ActiveMQ Web Console JMS Message XSS
11045| [53932] Apache Geronimo Multiple Admin Function CSRF
11046| [53931] Apache Geronimo /console/portal/Server/Monitoring Multiple Parameter XSS
11047| [53930] Apache Geronimo /console/portal/ URI XSS
11048| [53929] Apache Geronimo on Windows Security/Keystores Portlet Traversal Arbitrary File Upload
11049| [53928] Apache Geronimo on Windows Embedded DB/DB Manager Portlet Traversal Arbitrary File Upload
11050| [53927] Apache Geronimo on Windows Services/Repository Portlet Traversal Arbitrary File Upload
11051| [53921] Apache HTTP Server mod_proxy_ajp Cross Thread/Session Information Disclosure
11052| [53766] Oracle BEA WebLogic Server Plug-ins for Apache Certificate Handling Remote Overflow
11053| [53574] PHP on Apache .htaccess mbstring.func_overload Setting Cross Hosted Site Behavior Modification
11054| [53381] Apache Tomcat JK Connector Content-Length Header Cross-user Information Disclosure
11055| [53380] Apache Struts Unspecified XSS
11056| [53289] Apache mod_perl Apache::Status /perl-status Unspecified XSS
11057| [53186] Apache HTTP Server htpasswd Predictable Salt Weakness
11058| [52899] Apache Tomcat Examples Web Application Calendar Application jsp/cal/cal2.jsp time Parameter XSS
11059| [52407] Apache Tomcat doRead Method POST Content Information Disclosure
11060| [51923] Apache HTTP Server mod-auth-mysql Module mod_auth_mysql.c Multibyte Character Encoding SQL Injection
11061| [51613] Apache HTTP Server Third-party Module Child Process File Descriptor Leak
11062| [51612] Apache HTTP Server Internal Redirect Handling Infinite Loop DoS
11063| [51468] Apache Jackrabbit Content Repository (JCR) swr.jsp q Parameter XSS
11064| [51467] Apache Jackrabbit Content Repository (JCR) search.jsp q Parameter XSS
11065| [51151] Apache Roller Search Function q Parameter XSS
11066| [50482] PHP with Apache php_value Order Unspecified Issue
11067| [50475] Novell NetWare ApacheAdmin Console Unauthenticated Access
11068| [49734] Apache Struts DefaultStaticContentLoader Class Traversal Arbitrary File Access
11069| [49733] Apache Struts FilterDispatcher Class Traversal Arbitrary File Access
11070| [49283] Oracle BEA WebLogic Server Plugins for Apache Remote Transfer-Encoding Overflow
11071| [49062] Apache Tomcat Cross-thread Concurrent Request Variable Overwrite Information Disclosure
11072| [48847] ModSecurity (mod_security) Transformation Caching Unspecified Apache DoS
11073| [48788] Apache Xerces-C++ XML Schema maxOccurs Value XML File Handling DoS
11074| [47474] Apache HTTP Server mod_proxy_ftp Directory Component Wildcard Character XSS
11075| [47464] Apache Tomcat allowLinking / UTF-8 Traversal Arbitrary File Access
11076| [47463] Apache Tomcat RequestDispatcher Traversal Arbitrary File Access
11077| [47462] Apache Tomcat HttpServletResponse.sendError Method Message Argument XSS
11078| [47096] Oracle Weblogic Apache Connector POST Request Overflow
11079| [46382] Frontend Filemanager (air_filemanager) Extension for TYPO3 on Apache Unspecified Arbitrary Code Execution
11080| [46285] TYPO3 on Apache Crafted Filename Upload Arbitrary Command Execution
11081| [46085] Apache HTTP Server mod_proxy ap_proxy_http_process_response() Function Interim Response Forwarding Remote DoS
11082| [45905] Apache Tomcat Host Manager host-manager/html/add name Parameter XSS
11083| [45879] Ragnarok Online Control Panel on Apache Crafted Traversal Authentication Bypass
11084| [45742] Apache HTTP Server on Novell Unspecified Request Directive Internal IP Disclosure
11085| [45740] Apache Derby DropSchemaNode Bind Phase Arbitrary Scheme Statement Dropping
11086| [45599] Apache Derby Lock Table Statement Privilege Requirement Bypass Arbitrary Table Lock
11087| [45585] Apache Derby ACCSEC Command RDBNAM Parameter Cleartext Credential Disclosure
11088| [45584] Apache Derby DatabaseMetaData.getURL Function Cleartext Credential Disclosure
11089| [45420] Apache HTTP Server 403 Error Page UTF-7 Encoded XSS
11090| [44728] PHP Toolkit on Gentoo Linux Interpretation Conflict Apache HTTP Server Local DoS
11091| [44618] Oracle JSP Apache/Jserv Path Translation Traversal Arbitrary JSP File Execution
11092| [44159] Apache HTTP Server Remote Virtual Host Name Disclosure
11093| [43997] Apache-SSL ExpandCert() Function Certificate Handling Arbitrary Environment Variables Manipulation
11094| [43994] suPHP for Apache (mod_suphp) Directory Symlink Local Privilege Escalation
11095| [43993] suPHP for Apache (mod_suphp) Owner Mode Race Condition Symlink Local Privilege Escalation
11096| [43663] Apache HTTP Server Mixed Platform AddType Directive Crafted Request PHP Source Disclosure
11097| [43658] AuthCAS Module (AuthCAS.pm) for Apache HTTP Server SESSION_COOKIE_NAME SQL Injection
11098| [43452] Apache Tomcat HTTP Request Smuggling
11099| [43309] Apache Geronimo LoginModule Login Method Bypass
11100| [43290] Apache JSPWiki Entry Page Attachment Unrestricted File Upload
11101| [43259] Apache HTTP Server on Windows mod_proxy_balancer URL Handling Remote Memory Corruption
11102| [43224] Apache Geronimo on SuSE Linux init Script Symlink Unspecified File/Directory Access
11103| [43189] Apache mod_jk2 Host Header Multiple Fields Remote Overflow
11104| [42937] Apache HTTP Server mod_proxy_balancer balancer-manager Unspecified CSRF
11105| [42341] MOD_PLSQL for Apache Unspecified URL SQL Injection
11106| [42340] MOD_PLSQL for Apache CGI Environment Handling Unspecified Overflow
11107| [42214] Apache HTTP Server mod_proxy_ftp UTF-7 Encoded XSS
11108| [42091] Apache Maven Site Plugin Installation Permission Weakness
11109| [42089] Apache Maven .m2/settings.xml Cleartext Password Disclosure
11110| [42088] Apache Maven Defined Repo Process Listing Password Disclosure
11111| [42087] Apache Maven Site Plugin SSH Deployment Permission Setting Weakness
11112| [42036] Apache HTTP Server MS-DOS Device Request Host OS Disclosure
11113| [41891] BEA WebLogic Apache Beehive NetUI Page Flow Unspecified XSS
11114| [41436] Apache Tomcat Native APR Connector Duplicate Request Issue
11115| [41435] Apache Tomcat %5C Cookie Handling Session ID Disclosure
11116| [41434] Apache Tomcat Exception Handling Subsequent Request Information Disclosure
11117| [41400] LimeSurvey save.php Apache Log File PHP Code Injection
11118| [41029] Apache Tomcat Calendar Examples Application cal2.jsp Multiple Parameter CSRF
11119| [41019] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload XSS
11120| [41018] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload CRLF
11121| [40853] Apache Tomcat SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) JSESSIONIDSSO Cookie Security Weakness
11122| [40264] Apache HTTP Server mod_proxy_balancer balancer_handler Function bb Variable Remote DoS
11123| [40263] Apache HTTP Server mod_proxy_balancer balancer-manager Multiple Parameter XSS
11124| [40262] Apache HTTP Server mod_status refresh XSS
11125| [39833] Apache Tomcat JULI Logging Component catalina.policy Security Bypass
11126| [39251] Coppermine Photo Gallery on Apache Multiple File Extension Upload Arbitrary Code Execution
11127| [39166] Apache Tomcat on Windows caseSensitive Attribute Mixed Case Request JSP Source Disclosure
11128| [39134] Apache mod_imagemap Module Imagemap Unspecified XSS
11129| [39133] Apache mod_imap Module Imagemap File Unspecified XSS
11130| [39035] Apache Tomcat examples/servlet/CookieExample Multiple Parameter XSS
11131| [39003] Apache HTTP Server HTTP Method Header Request Entity Too Large XSS
11132| [39000] Apache Tomcat SendMailServlet sendmail.jsp mailfrom Parameter XSS
11133| [38939] Apache HTTP Server Prefork MPM Module Array Modification Local DoS
11134| [38673] Apache Jakarta Slide WebDAV SYSTEM Request Traversal Arbitrary File Access
11135| [38662] Apache Geronimo SQLLoginModule Nonexistent User Authentication Bypass
11136| [38661] Apache Geronimo MEJB Unspecified Authentication Bypass
11137| [38641] Apache HTTP Server mod_mem_cache recall_headers Function Information Disclosure
11138| [38640] Apache HTTP Server suexec Document Root Unauthorized Operations
11139| [38639] Apache HTTP Server suexec Multiple Symlink Privilege Escalation
11140| [38636] Apache HTTP Server mod_autoindex.c P Variable UTF-7 Charset XSS
11141| [38513] BEA WebLogic Server Proxy Plug-in for Apache Protocol Error Handling Remote DoS
11142| [38187] Apache Geronimo / Tomcat WebDAV XML SYSTEM Tag Arbitrary File Access
11143| [37079] Apache HTTP Server mod_cache cache_util.c Malformed Cache-Control Header DoS
11144| [37071] Apache Tomcat Cookie Handling Session ID Disclosure
11145| [37070] Apache Tomcat Cookie Handling Quote Delimiter Session ID Disclosure
11146| [37052] Apache HTTP Server mod_status mod_status.c Unspecified XSS
11147| [37051] Apache HTTP Server mod_proxy modules/proxy/proxy_util.c Crafted Header Remote DoS
11148| [37050] Apache HTTP Server Prefork MPM Module Crafted Code Sequence Local DoS
11149| [36417] Apache Tomcat Host Manager Servlet html/add Action aliases Parameter XSS
11150| [36377] Apache MyFaces Tomahawk JSF Application autoscroll Multiple Script XSS
11151| [36080] Apache Tomcat JSP Examples Crafted URI XSS
11152| [36079] Apache Tomcat Manager Uploaded Filename XSS
11153| [34888] Apache Tomcat Example Calendar Application cal2.jsp time Parameter XSS
11154| [34887] Apache Tomcat implicit-objects.jsp Crafted Header XSS
11155| [34885] Apache Tomcat on IIS Servlet Engine MS-DOS Device Request DoS
11156| [34884] Apache Tomcat on Windows Nonexistent Resource Request Path Disclosure
11157| [34883] Apache Tomcat Crafted JSP File Request Path Disclosure
11158| [34882] Apache Tomcat Default SSL Ciphersuite Configuration Weakness
11159| [34881] Apache Tomcat Malformed Accept-Language Header XSS
11160| [34880] Apache Tomcat HTTP/1.1 Connector NULL Byte Request JSP Source Disclosure
11161| [34879] Apache Tomcat examples/jsp2/jspx/textRotate.jspx XSS
11162| [34878] Apache Tomcat examples/jsp2/el/implicit-objects.jsp XSS
11163| [34877] Apache Tomcat JK Web Server Connector (mod_jk) Double Encoded Traversal Arbitrary File Access
11164| [34876] Apache HTTP Server ScriptAlias CGI Source Disclosure
11165| [34875] Apache Tomcat appdev/sample/web/hello.jsp Multiple Parameter XSS
11166| [34874] Apache Tomcat AJP Connector mod_jk ajp_process_callback Remote Memory Disclosure
11167| [34873] Apache Stats Variable Extraction _REQUEST Ssuperglobal Array Overwrite
11168| [34872] Apache HTTP Server suexec User/Group Combination Weakness Local Privilege Escalation
11169| [34769] Apache Tomcat w/ Proxy Module Double Encoded Traversal Arbitrary File Access
11170| [34541] mod_perl for Apache HTTP Server RegistryCooker.pm PATH_INFO Crafted URI Remote DoS
11171| [34540] mod_perl for Apache HTTP Server PerlRun.pm PATH_INFO Crafted URI Remote DoS
11172| [34398] Apache Tomcat mod_jk Invalid Chunked Encoded Body Information Disclosure
11173| [34154] Apache Axis Nonexistent Java Web Service Path Disclosure
11174| [33855] Apache Tomcat JK Web Server Connector mod_jk.so Long URI Worker Map Remote Overflow
11175| [33816] Apache HTTP Server on Debian Linux TTY Local Privilege Escalation
11176| [33456] Apache HTTP Server Crafted TCP Connection Range Header DoS
11177| [33346] Avaya Multiple Products Apache Tomcat Port Weakness
11178| [32979] Apache Java Mail Enterprise Server (JAMES) Phoenix/MX4J Interface Arbitrary User Creation
11179| [32978] Apache Java Mail Enterprise Server (JAMES) POP3Server Log File Plaintext Password Disclosure
11180| [32724] Apache mod_python _filter_read Freed Memory Disclosure
11181| [32723] Apache Tomcat semicolon Crafted Filename Request Forced Directory Listing
11182| [32396] Apache Open For Business Project (OFBiz) Ecommerce Component Forum Implementation Message Body XSS
11183| [32395] Apache Open For Business Project (OFBiz) Ecommerce Component Form Field Manipulation Privilege Escalation
11184| [30354] Linux Subversion libapache2-svn Search Path Subversion Local Privilege Escalation
11185| [29603] PHP ini_restore() Apache httpd.conf Options Bypass
11186| [29536] Apache Tcl mod_tcl set_var Function Remote Format String
11187| [28919] Apache Roller Weblogger Blog Comment Multiple Field XSS
11188| [28130] PHP with Apache Mixed Case Method Limit Directive Bypass
11189| [27913] Apache HTTP Server on Windows mod_alias URL Validation Canonicalization CGI Source Disclosure
11190| [27588] Apache HTTP Server mod_rewrite LDAP Protocol URL Handling Overflow
11191| [27487] Apache HTTP Server Crafted Expect Header Cross Domain HTML Injection
11192| [26935] FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
11193| [26572] Apache Java Mail Enterprise Server (JAMES) MAIL Command Overflow DoS
11194| [25909] Drupal on Apache files Directory File Upload Arbitrary Code Execution
11195| [24825] Oracle ModPL/SQL for Apache Unspecified Remote HTTP Issue
11196| [24365] Apache Struts Multiple Function Error Message XSS
11197| [24364] Apache Struts getMultipartRequestHandler() Function Crafted Request DoS
11198| [24363] Apache Struts org.apache.struts.taglib.html.Constants.CANCEL Validation Bypass
11199| [24103] Pubcookie Apache mod_pubcookie Unspecified XSS
11200| [23906] Apache mod_python for Apache HTTP Server FileSession Privileged Local Command Execution
11201| [23905] Apache Log4net LocalSyslogAppender Format String Memory Corruption DoS
11202| [23198] Apache WSS4J Library SOAP Signature Verification Bypass
11203| [23124] Generic Apache Request Library (libapreq) apreq_parse_* Functions Remote DoS
11204| [22652] mod_php for Apache HTTP Server Crafted import_request_variables Function DoS
11205| [22475] PHP w/ Apache PDO::FETCH_CLASS __set() Function DoS
11206| [22473] PHP w/ Apache2 Crafted PDOStatement DoS
11207| [22459] Apache Geronimo Error Page XSS
11208| [22458] Apache Tomcat / Geronimo Sample Script cal2.jsp time Parameter XSS
11209| [22301] auth_ldap for Apache HTTP Server auth_ldap_log_reason() Function Remote Format String
11210| [22261] Apache HTTP Server mod_ssl ssl_hook_Access Error Handling DoS
11211| [22259] mod_auth_pgsql for Apache HTTP Server Log Function Format String
11212| [21736] Apache Java Mail Enterprise Server (JAMES) Spooler retrieve Function DoS
11213| [21705] Apache HTTP Server mod_imap Image Map Referer XSS
11214| [21021] Apache Struts Error Message XSS
11215| [20897] PHP w/ Apache 2 SAPI virtual() Function Unspecified INI Setting Disclosure
11216| [20491] PHP mod_php apache2handler SAPI Crafted .htaccess DoS
11217| [20462] Apache HTTP Server worker.c MPM Memory Exhaustion DoS
11218| [20439] Apache Tomcat Directory Listing Saturation DoS
11219| [20373] Apache Tomcat on HP Secure OS for Linux Unspecified Servlet Access Issue
11220| [20285] Apache HTTP Server Log File Control Character Injection
11221| [20242] Apache HTTP Server mod_usertrack Predictable Session ID Generation
11222| [20209] Brainf*ck Module (mod_bf) for Apache HTTP Server Local Overflow
11223| [20033] Apache Tomcat MS-DOS Device Request Error Message Path Disclosure
11224| [19883] apachetop atop.debug Symlink Arbitrary File Overwrite
11225| [19863] mod_auth_shadow for Apache HTTP Server require group Authentication Bypass
11226| [19855] Apache HTTP Server ErrorDocument Directive .htaccess Bypass
11227| [19821] Apache Tomcat Malformed Post Request Information Disclosure
11228| [19769] Apache HTTP Server Double-reverse DNS Lookup Spoofing
11229| [19188] Apache HTTP Server mod_ssl SSLVerifyClient Per-location Context Restriction Bypass
11230| [19137] Apache HTTP Server on Red Hat Linux Double Slash GET Request Forced Directory Listing
11231| [19136] Apache on Mandrake Linux Arbitrary Directory Forced Listing
11232| [18977] Apache HTTP Server Crafted HTTP Range Header DoS
11233| [18389] Ragnarok Online Control Panel Apache Authentication Bypass
11234| [18286] Apache HTTP Server mod_ssl ssl_callback_SSLVerify_CRL( ) Function Overflow
11235| [18233] Apache HTTP Server htdigest user Variable Overfow
11236| [17738] Apache HTTP Server HTTP Request Smuggling
11237| [16586] Apache HTTP Server Win32 GET Overflow DoS
11238| [15889] Apache HTTP Server mod_cgid Threaded MPM CGI Output Misdirection
11239| [14896] mod_dav for Apache HTTP Server Remote Null Dereference Child Process Termination
11240| [14879] Apache HTTP Server ap_log_rerror Function Error Message Path Disclosure
11241| [14770] Apache Tomcat AJP12 Protocol Malformed Packet Remote DoS
11242| [14597] Apache Tomcat IntegerOverflow.jsp Test JSP Script Path Disclosure
11243| [14596] Apache Tomcat pageSession.jsp Test JSP Script Path Disclosure
11244| [14595] Apache Tomcat pageLanguage.jsp Test JSP Script Path Disclosure
11245| [14594] Apache Tomcat pageIsThreadSafe.jsp Test JSP Script Path Disclosure
11246| [14593] Apache Tomcat pageIsErrorPage.jsp Test JSP Script Path Disclosure
11247| [14592] Apache Tomcat pageInvalid.jsp Test JSP Script Path Disclosure
11248| [14591] Apache Tomcat pageExtends.jsp Test JSP Script Path Disclosure
11249| [14590] Apache Tomcat pageDouble.jsp Test JSP Script Path Disclosure
11250| [14589] Apache Tomcat pageAutoFlush.jsp Test JSP Script Path Disclosure
11251| [14588] Apache Tomcat extends2.jsp Test JSP Script Path Disclosure
11252| [14587] Apache Tomcat extends1.jsp Test JSP Script Path Disclosure
11253| [14586] Apache Tomcat comments.jsp Test JSP Script Path Disclosure
11254| [14585] Apache Tomcat buffer4.jsp Test JSP Script Path Disclosure
11255| [14584] Apache Tomcat buffer3.jsp Test JSP Script Path Disclosure
11256| [14583] Apache Tomcat buffer2.jsp Test JSP Script Path Disclosure
11257| [14582] Apache Tomcat buffer1.jsp Test JSP Script Path Disclosure
11258| [14581] Apache Tomcat pageImport2.jsp Test JSP Script Path Disclosure
11259| [14580] Apache Tomcat pageInfo.jsp Test JSP Script Path Disclosure
11260| [14410] mod_frontpage for Apache HTTP Server fpexec Remote Overflow
11261| [14044] Apache Batik Squiggle Browser with Rhino Scripting Engine Unspecified File System Access
11262| [13737] mod_access_referer for Apache HTTP Server Malformed Referer DoS
11263| [13711] Apache mod_python publisher.py Traversal Arbitrary Object Information Disclosure
11264| [13640] mod_auth_any for Apache HTTP Server on Red Hat Linux Metacharacter Command Execution
11265| [13304] Apache Tomcat realPath.jsp Path Disclosure
11266| [13303] Apache Tomcat source.jsp Arbitrary Directory Listing
11267| [13087] Apache HTTP Server mod_log_forensic check_forensic Symlink Arbitrary File Creation / Overwrite
11268| [12849] mod_auth_radius for Apache HTTP Server radcpy() Function Overflow DoS
11269| [12848] Apache HTTP Server htdigest realm Variable Overflow
11270| [12721] Apache Tomcat examples/jsp2/el/functions.jsp XSS
11271| [12720] mod_dosevasive for Apache HTTP Server Symlink Arbitrary File Create/Overwrite
11272| [12558] Apache HTTP Server IPv6 FTP Proxy Socket Failure DoS
11273| [12557] Apache HTTP Server prefork MPM accept Error DoS
11274| [12233] Apache Tomcat MS-DOS Device Name Request DoS
11275| [12232] Apache Tomcat with JDK Arbitrary Directory/Source Disclosure
11276| [12231] Apache Tomcat web.xml Arbitrary File Access
11277| [12193] Apache HTTP Server on Mac OS X File Handler Bypass
11278| [12192] Apache HTTP Server on Mac OS X Unauthorized .ht and .DS_Store File Access
11279| [12178] Apache Jakarta Lucene results.jsp XSS
11280| [12176] mod_digest_apple for Apache HTTP Server on Mac OS X Authentication Replay
11281| [11391] Apache HTTP Server Header Parsing Space Saturation DoS
11282| [11003] Apache HTTP Server mod_include get_tag() Function Local Overflow
11283| [10976] mod_mylo for Apache HTTP Server mylo_log Logging Function HTTP GET Overflow
11284| [10637] Apache HTTP Server mod_ssl SSLCipherSuite Access Restriction Bypass
11285| [10546] Macromedia JRun4 mod_jrun Apache Module Remote Overflow
11286| [10471] Apache Xerces-C++ XML Parser DoS
11287| [10218] Apache HTTP Server Satisfy Directive Access Control Bypass
11288| [10068] Apache HTTP Server htpasswd Local Overflow
11289| [10049] mod_cplusplus For Apache HTTP Server Unspecified Overflow
11290| [9994] Apache HTTP Server apr-util IPV6 Parsing DoS
11291| [9991] Apache HTTP Server ap_resolve_env Environment Variable Local Overflow
11292| [9948] mod_dav for Apache HTTP Server LOCK Request DoS
11293| [9742] Apache HTTP Server mod_ssl char_buffer_read Function Reverse Proxy DoS
11294| [9718] Apache HTTP Server Win32 Single Dot Append Arbitrary File Access
11295| [9717] Apache HTTP Server mod_cookies Cookie Overflow
11296| [9716] Apache::Gallery Gallery.pm Inline::C Predictable Filename Code Execution
11297| [9715] Apache HTTP Server rotatelogs Control Characters Over Pipe DoS
11298| [9714] Apache Authentication Module Threaded MPM DoS
11299| [9713] Apache HTTP Server on OS2 filestat.c Device Name Request DoS
11300| [9712] Apache HTTP Server Multiple Linefeed Request Memory Consumption DoS
11301| [9711] Apache HTTP Server Access Log Terminal Escape Sequence Injection
11302| [9710] Apache HTTP Server on Windows Illegal Character Default Script Mapping Bypass
11303| [9709] Apache HTTP Server on Windows MS-DOS Device Name HTTP Post Code Execution
11304| [9708] Apache HTTP Server on Windows MS-DOS Device Name DoS
11305| [9707] Apache HTTP Server Duplicate MIME Header Saturation DoS
11306| [9706] Apache Web Server Multiple MIME Header Saturation Remote DoS
11307| [9705] Apache Tomcat Invoker/Default Servlet Source Disclosure
11308| [9702] Apache HTTP Server CGI/WebDAV HTTP POST Request Source Disclosure
11309| [9701] Apache HTTP Server for Windows Multiple Slash Forced Directory Listing
11310| [9700] Apache HTTP Server mod_autoindex Multiple Slash Request Forced Directory Listing
11311| [9699] Apache HTTP Server mod_dir Multiple Slash Request Forced Directory Listing
11312| [9698] Apache HTTP Server mod_negotiation Multiple Slash Request Forced Directory Listing
11313| [9697] Apache HTTP Server htdigest Local Symlink Arbitrary File Overwrite
11314| [9696] Apache HTTP Server htpasswd Local Symlink Arbitrary File Overwrite
11315| [9695] Apache Tomcat SnoopServlet Servlet Information Disclosure
11316| [9694] PHP3 on Apache HTTP Server Encoded Traversal Arbitrary File Access
11317| [9693] mod_auth_pgsql_sys for Apache HTTP Server User Name SQL Injection
11318| [9692] Apache HTTP Server mod_vhost_alias Mass Virtual Hosting Arbitrary File Access
11319| [9691] Apache HTTP Server mod_rewrite Mass Virtual Hosting Arbitrary File Access
11320| [9690] Apache HTTP Server mod_vhost_alias CGI Program Source Disclosure
11321| [9689] Trustix httpsd for Apache-SSL Permission Weakness Privilege Escalation
11322| [9688] Apache HTTP Server mod_proxy Malformed FTP Command DoS
11323| [9687] Apache::AuthenSmb smbval SMB Authentication Library Multiple Overflows
11324| [9686] Apache::AuthenSmb smbvalid SMB Authentication Library Multiple Overflows
11325| [9523] Apache HTTP Server mod_ssl Aborted Connection DoS
11326| [9459] Oracle PL/SQL (mod_plsql) Apache Module Help Page Request Remote Overflow
11327| [9208] Apache Tomcat .jsp Encoded Newline XSS
11328| [9204] Apache Tomcat ROOT Application XSS
11329| [9203] Apache Tomcat examples Application XSS
11330| [9068] Apache HTTP Server mod_userdir User Account Information Disclosure
11331| [8773] Apache Tomcat Catalina org.apache.catalina.servlets.DefaultServlet Source Code Disclosure
11332| [8772] Apache Tomcat Catalina org.apache.catalina.connector.http DoS
11333| [7943] Apache HTTP Server mod_ssl sslkeys File Disclosure
11334| [7942] Apache HTTP Server mod_ssl Default Pass Phrase
11335| [7941] Apache HTTP Server mod_ssl Encrypted Private Key File Descriptor Leak
11336| [7935] Apache HTTP Server mod_ssl ssl_gcache Race Conditions
11337| [7934] Apache HTTP Server mod_ssl SSLSessionCache File Content Disclosure
11338| [7933] Apache HTTP Server mod_ssl SSLMutex File Content Disclosure
11339| [7932] Apache HTTP Server mod_ssl mkcert.sh File Creation Permission Weakness
11340| [7931] Apache HTTP Server mod_ssl X.509 Client Certificate Authentication Bypass
11341| [7930] Apache HTTP Server mod_ssl ssl_expr_eval_func_file() Overflow
11342| [7929] Apache HTTP Server mod_ssl ssl_engine_log.c mod_proxy Hook Function Remote Format String
11343| [7611] Apache HTTP Server mod_alias Local Overflow
11344| [7394] Apache Tomcat mod_jk Invalid Transfer-Encoding Chunked Field DoS
11345| [7203] Apache Tomcat source.jsp Traversal Arbitrary File Access
11346| [7039] Apache HTTP Server on Mac OS X HFS+ File System Access Bypass
11347| [6882] Apache mod_python Malformed Query String Variant DoS
11348| [6839] Apache HTTP Server mod_proxy Content-Length Overflow
11349| [6630] Apache Tomcat Java Server Pages (JSP) Engine WPrinterJob() DoS
11350| [6472] Apache HTTP Server mod_ssl ssl_util_uuencode_binary Remote Overflow
11351| [5821] Apache HTTP Server Multiple / GET Remote Overflow DoS
11352| [5580] Apache Tomcat Servlet Malformed URL JSP Source Disclosure
11353| [5552] Apache HTTP Server split-logfile Arbitrary .log File Overwrite
11354| [5526] Apache Tomcat Long .JSP URI Path Disclosure
11355| [5278] Apache Tomcat web.xml Restriction Bypass
11356| [5051] Apache Tomcat Null Character DoS
11357| [4973] Apache Tomcat servlet Mapping XSS
11358| [4650] mod_gzip for Apache HTTP Server Debug Mode Printf Stack Overflow
11359| [4649] mod_gzip for Apache HTTP Server Debug Mode Format String Overflow
11360| [4648] mod_gzip for Apache HTTP Server Debug Mode Race Condition
11361| [4568] mod_survey For Apache ENV Tags SQL Injection
11362| [4553] Apache HTTP Server ApacheBench Overflow DoS
11363| [4552] Apache HTTP Server Shared Memory Scoreboard DoS
11364| [4446] Apache HTTP Server mod_disk_cache Stores Credentials
11365| [4383] Apache HTTP Server Socket Race Condition DoS
11366| [4382] Apache HTTP Server Log Entry Terminal Escape Sequence Injection
11367| [4340] Apache Portable Runtime (APR) apr_psprintf DoS
11368| [4232] Apache Cocoon DatabaseAuthenticatorAction SQL Injection
11369| [4231] Apache Cocoon Error Page Server Path Disclosure
11370| [4182] Apache HTTP Server mod_ssl Plain HTTP Request DoS
11371| [4181] Apache HTTP Server mod_access IP Address Netmask Rule Bypass
11372| [4075] Apache HTTP Sever on Windows .var File Request Path Disclosure
11373| [4037] Apache HTTP Server on Cygwin Encoded GET Request Arbitrary File Access
11374| [3877] Apache-SSL SSLVerifyClient SSLFakeBasicAuth Client Certificate Forgery
11375| [3819] Apache HTTP Server mod_digest Cross Realm Credential Replay
11376| [3322] mod_php for Apache HTTP Server Process Hijack
11377| [3215] mod_php for Apache HTTP Server File Descriptor Leakage
11378| [2885] Apache mod_python Malformed Query String DoS
11379| [2749] Apache Cocoon view-source Sample File Traversal Arbitrary File Access
11380| [2733] Apache HTTP Server mod_rewrite Local Overflow
11381| [2672] Apache HTTP Server mod_ssl SSLCipherSuite Ciphersuite Downgrade Weakness
11382| [2613] Apache HTTP Server mod_cgi stderr Output Handling Local DoS
11383| [2149] Apache::Gallery Privilege Escalation
11384| [2107] Apache HTTP Server mod_ssl Host: Header XSS
11385| [1926] Apache HTTP Server mod_rewrite Crafted URI Rule Bypass
11386| [1833] Apache HTTP Server Multiple Slash GET Request DoS
11387| [1577] Apache HTTP Server mod_rewrite RewriteRule Expansion Arbitrary File Access
11388| [872] Apache Tomcat Multiple Default Accounts
11389| [862] Apache HTTP Server SSI Error Page XSS
11390| [859] Apache HTTP Server Win32 Crafted Traversal Arbitrary File Access
11391| [849] Apache Tomcat TroubleShooter Servlet Information Disclosure
11392| [845] Apache Tomcat MSDOS Device XSS
11393| [844] Apache Tomcat Java Servlet Error Page XSS
11394| [842] Apache HTTP Server mod_ssl ssl_compat_directive Function Overflow
11395| [838] Apache HTTP Server Chunked Encoding Remote Overflow
11396| [827] PHP4 for Apache on Windows php.exe Malformed Request Path Disclosure
11397| [775] Apache mod_python Module Importing Privilege Function Execution
11398| [769] Apache HTTP Server Win32 DOS Batch File Arbitrary Command Execution
11399| [756] Apache HTTP Server mod_ssl i2d_SSL_SESSION Function SSL Client Certificate Overflow
11400| [701] Apache HTTP Server Win32 ScriptAlias php.exe Arbitrary File Access
11401| [674] Apache Tomcat Nonexistent File Error Message Path Disclosure
11402| [637] Apache HTTP Server UserDir Directive Username Enumeration
11403| [623] mod_auth_pgsql for Apache HTTP Server User Name SQL Injection
11404| [582] Apache HTTP Server Multiviews Feature Arbitrary Directory Listing
11405| [562] Apache HTTP Server mod_info /server-info Information Disclosure
11406| [561] Apache Web Servers mod_status /server-status Information Disclosure
11407| [417] Apache HTTP Server on SuSE Linux /doc/packages Remote Information Disclosure
11408| [410] mod_perl for Apache HTTP Server /perl/ Directory Listing
11409| [404] Apache HTTP Server on SuSE Linux WebDAV PROPFIND Arbitrary Directory Listing
11410| [402] Apache HTTP Server on SuSE Linux cgi-bin-sdb Request Script Source Disclosure
11411| [379] Apache ASP module Apache::ASP source.asp Example File Arbitrary File Creation
11412| [377] Apache Tomcat Snoop Servlet Remote Information Disclosure
11413| [376] Apache Tomcat contextAdmin Arbitrary File Access
11414| [342] Apache HTTP Server for Windows Multiple Forward Slash Directory Listing
11415| [222] Apache HTTP Server test-cgi Arbitrary File Access
11416| [143] Apache HTTP Server printenv.pl Multiple Method CGI XSS
11417| [48] Apache HTTP Server on Debian /usr/doc Directory Information Disclosure
11418|_
11419Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
11420OS fingerprint not ideal because: Timing level 5 (Insane) used
11421No OS matches for host
11422Network Distance: 19 hops
11423
11424TRACEROUTE (using port 443/tcp)
11425HOP RTT ADDRESS
114261 185.26 ms 10.244.200.1
114272 186.70 ms 213.184.122.97
114283 185.37 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
114294 247.71 ms bzq-219-189-185.cablep.bezeqint.net (62.219.189.185)
114305 185.87 ms bzq-114-65-1.cust.bezeqint.net (192.114.65.1)
114316 235.89 ms bzq-219-189-50.dsl.bezeqint.net (62.219.189.50)
114327 235.70 ms bzq-179-161-218.pop.bezeqint.net (212.179.161.218)
114338 235.34 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
114349 332.14 ms et-0-0-61.cr3-was1.ip4.gtt.net (89.149.142.254)
1143510 483.77 ms tky001bb10.IIJ.Net (58.138.88.89)
1143611 500.22 ms tky001bb10.IIJ.Net (58.138.88.81)
1143712 498.99 ms tky001bb11.IIJ.Net (58.138.88.93)
1143813 488.36 ms 202.232.9.94
1143914 ... 18
1144019 478.68 ms 150.60.195.62
11441#######################################################################################################################################
11442Version: 1.11.13-static
11443OpenSSL 1.0.2-chacha (1.0.2g-dev)
11444
11445Connected to 150.60.195.62
11446
11447Testing SSL server 150.60.195.62 on port 443 using SNI name 150.60.195.62
11448
11449 TLS Fallback SCSV:
11450Server supports TLS Fallback SCSV
11451
11452 TLS renegotiation:
11453Secure session renegotiation supported
11454
11455 TLS Compression:
11456Compression disabled
11457
11458 Heartbleed:
11459TLS 1.2 not vulnerable to heartbleed
11460TLS 1.1 not vulnerable to heartbleed
11461TLS 1.0 not vulnerable to heartbleed
11462
11463 Supported Server Cipher(s):
11464Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
11465Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
11466Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
11467Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
11468Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
11469Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
11470Accepted TLSv1.2 128 bits AES128-GCM-SHA256
11471Accepted TLSv1.2 256 bits AES256-GCM-SHA384
11472Accepted TLSv1.2 128 bits AES128-SHA256
11473Accepted TLSv1.2 256 bits AES256-SHA256
11474Accepted TLSv1.2 128 bits AES128-SHA
11475Accepted TLSv1.2 256 bits AES256-SHA
11476Accepted TLSv1.2 256 bits CAMELLIA256-SHA
11477Accepted TLSv1.2 128 bits CAMELLIA128-SHA
11478Preferred TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
11479Accepted TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
11480Accepted TLSv1.1 128 bits AES128-SHA
11481Accepted TLSv1.1 256 bits AES256-SHA
11482Accepted TLSv1.1 256 bits CAMELLIA256-SHA
11483Accepted TLSv1.1 128 bits CAMELLIA128-SHA
11484Preferred TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
11485Accepted TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
11486Accepted TLSv1.0 128 bits AES128-SHA
11487Accepted TLSv1.0 256 bits AES256-SHA
11488Accepted TLSv1.0 256 bits CAMELLIA256-SHA
11489Accepted TLSv1.0 128 bits CAMELLIA128-SHA
11490
11491 SSL Certificate:
11492Signature Algorithm: sha256WithRSAEncryption
11493RSA Key Strength: 2048
11494
11495Subject: www.egw.co.jp
11496Altnames: DNS:www.egw.co.jp
11497Issuer: KDDI Web Communications Certification Authority 3
11498
11499Not valid before: Dec 21 03:54:31 2018 GMT
11500Not valid after: Dec 27 14:59:59 2019 GMT
11501#######################################################################################################################################
11502Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:47 EDT
11503NSE: Loaded 45 scripts for scanning.
11504NSE: Script Pre-scanning.
11505NSE: Starting runlevel 1 (of 2) scan.
11506Initiating NSE at 23:47
11507Completed NSE at 23:47, 0.00s elapsed
11508NSE: Starting runlevel 2 (of 2) scan.
11509Initiating NSE at 23:47
11510Completed NSE at 23:47, 0.00s elapsed
11511Initiating Ping Scan at 23:47
11512Scanning 150.60.195.62 [4 ports]
11513Completed Ping Scan at 23:47, 0.51s elapsed (1 total hosts)
11514Initiating Parallel DNS resolution of 1 host. at 23:47
11515Completed Parallel DNS resolution of 1 host. at 23:47, 0.21s elapsed
11516Initiating Connect Scan at 23:47
11517Scanning 150.60.195.62 [65535 ports]
11518Discovered open port 21/tcp on 150.60.195.62
11519Discovered open port 443/tcp on 150.60.195.62
11520Discovered open port 80/tcp on 150.60.195.62
11521Connect Scan Timing: About 2.71% done; ETC: 00:06 (0:18:33 remaining)
11522Connect Scan Timing: About 8.65% done; ETC: 23:59 (0:10:44 remaining)
11523Connect Scan Timing: About 16.25% done; ETC: 23:56 (0:07:49 remaining)
11524Connect Scan Timing: About 25.23% done; ETC: 23:55 (0:05:59 remaining)
11525Connect Scan Timing: About 35.13% done; ETC: 23:54 (0:04:39 remaining)
11526Connect Scan Timing: About 46.18% done; ETC: 23:53 (0:03:31 remaining)
11527Connect Scan Timing: About 58.25% done; ETC: 23:53 (0:02:31 remaining)
11528Connect Scan Timing: About 71.05% done; ETC: 23:52 (0:01:38 remaining)
11529Connect Scan Timing: About 84.55% done; ETC: 23:52 (0:00:50 remaining)
11530Completed Connect Scan at 23:52, 308.02s elapsed (65535 total ports)
11531Initiating Service scan at 23:52
11532Scanning 3 services on 150.60.195.62
11533Completed Service scan at 23:52, 15.23s elapsed (3 services on 1 host)
11534Initiating OS detection (try #1) against 150.60.195.62
11535Retrying OS detection (try #2) against 150.60.195.62
11536Initiating Traceroute at 23:52
11537Completed Traceroute at 23:52, 6.53s elapsed
11538Initiating Parallel DNS resolution of 12 hosts. at 23:52
11539Completed Parallel DNS resolution of 12 hosts. at 23:52, 0.32s elapsed
11540NSE: Script scanning 150.60.195.62.
11541NSE: Starting runlevel 1 (of 2) scan.
11542Initiating NSE at 23:52
11543Completed NSE at 23:53, 8.41s elapsed
11544NSE: Starting runlevel 2 (of 2) scan.
11545Initiating NSE at 23:53
11546Completed NSE at 23:53, 0.00s elapsed
11547Nmap scan report for 150.60.195.62
11548Host is up, received syn-ack ttl 40 (0.41s latency).
11549Scanned at 2019-08-03 23:47:17 EDT for 350s
11550Not shown: 65528 filtered ports
11551Reason: 65528 no-responses
11552PORT STATE SERVICE REASON VERSION
1155321/tcp open tcpwrapped syn-ack
1155425/tcp closed smtp conn-refused
1155580/tcp open http syn-ack Apache httpd
11556|_http-server-header: Apache
11557| vulscan: VulDB - https://vuldb.com:
11558| [135270] Apache JSPWiki up to 2.11.0.M3 Plugin Link cross site scripting
11559| [135269] Apache JSPWiki up to 2.11.0.M3 InterWiki Link cross site scripting
11560| [135268] Apache JSPWiki up to 2.11.0.M3 Attachment cross site scripting
11561| [134527] Apache Karaf up to 4.2.4 Config Service directory traversal
11562| [134416] Apache Sanselan 0.97-incubator Loop denial of service
11563| [134415] Apache Sanselan 0.97-incubator Hang denial of service
11564| [134291] Apache Axis up to 1.7.8 Server-Side Request Forgery
11565| [134290] Apache UIMA DUCC up to 2.2.2 cross site scripting
11566| [134248] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
11567| [134247] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
11568| [134246] Apache Camel up to 2.19/2.21.3/2.22.2/2.23.0 directory traversal
11569| [134138] Apache Pluto 3.0.0/3.0.1 Chat Room Demo Portlet cross site scripting
11570| [133992] Apache Qpid Proton up to 0.27.0 Certificate Validation Man-in-the-Middle weak authentication
11571| [133977] Apache Zeppelin up to 0.7.x Stored cross site scripting
11572| [133976] Apache Zeppelin up to 0.7.x Cron Scheduler privilege escalation
11573| [133975] Apache Zeppelin up to 0.7.2 Session Fixation weak authentication
11574| [133444] Apache PDFbox 2.0.14 XML Parser XML External Entity
11575| [133750] Oracle Agile Recipe Management for Pharmaceuticals 9.3.3/9.3.4 Apache Commons FileUpload unknown vulnerability
11576| [133728] Oracle Retail Xstore Point of Service 7.0/7.1 Apache HTTP Server denial of service
11577| [133644] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
11578| [133643] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache HTTP Server denial of service
11579| [133640] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Commons FileUpload unknown vulnerability
11580| [133638] Oracle Healthcare Master Person Index 3.0/4.0 Apache Commons FileUpload unknown vulnerability
11581| [133614] Oracle Data Integrator 12.2.1.3.0 Apache Batik unknown vulnerability
11582| [133594] Oracle WebCenter Portal 12.2.1.3.0 Apache Commons FileUpload unknown vulnerability
11583| [133591] Oracle JDeveloper 11.1.1.9.0/12.1.3.0.0/12.2.1.3.0 Apache Log4j unknown vulnerability
11584| [133590] Oracle Identity Analytics 11.1.1.5.8 Apache Commons FileUpload unknown vulnerability
11585| [133588] Oracle Endeca Information Discovery Integrator 3.2.0 Apache Commons FileUpload unknown vulnerability
11586| [133587] Oracle Data Integrator 11.1.1.9.0 Apache Groovy unknown vulnerability
11587| [133585] Oracle API Gateway 11.1.2.4.0 Apache Commons FileUpload unknown vulnerability
11588| [133573] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache ActiveMQ unknown vulnerability
11589| [133571] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache Commons FileUpload unknown vulnerability
11590| [133522] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache Tomcat unknown vulnerability
11591| [133520] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache HTTP Server denial of service
11592| [133518] Oracle Primavera Unifier up to 18.8 Apache Commons FileUpload unknown vulnerability
11593| [133508] Oracle Communications Instant Messaging Server 10.0.1 Apache Tomcat unknown vulnerability
11594| [133501] Oracle Communications Policy Management 12.1/12.2/12.3/12.4 Apache Struts 1 unknown vulnerability
11595| [133500] Oracle Communications Application Session Controller 3.7.1/3.8.0 Apache Tomcat unknown vulnerability
11596| [133493] Oracle Communications Pricing Design Center 11.1/12.0 Apache Log4j unknown vulnerability
11597| [133407] Apache Tomcat up to 7.0.93/8.5.39/9.0.17 on Windows JRE Command Line Argument Code Execution
11598| [133315] Apache Airflow up to 1.10.2 HTTP Endpoint cross site request forgery
11599| [133314] Apache Airflow up to 1.10.2 Metadata Database cross site scripting
11600| [133290] Apache Tomcat up to 8.5.37/9.0.14 HTTP2 Stream Execution denial of service
11601| [133112] Apache HTTP Server up to 2.4.38 mod_auth_digest race condition privilege escalation
11602| [133111] Apache HTTP Server 2.4.37/2.4.38 mod_ssl Bypass privilege escalation
11603| [133092] Airsonic 10.2.1 org.apache.commons.lang.RandomStringUtils RecoverController.java java.util.Random weak authentication
11604| [132568] Apache JSPWiki up to 2.11.0.M2 URL User information disclosure
11605| [132567] Apache JSPWiki up to 2.11.0.M2 URL cross site scripting
11606| [132566] Apache ActiveMQ up to 5.15.8 MQTT Frame Memory denial of service
11607| [132565] Apache HBase up to 2.1.3 REST Server Request privilege escalation
11608| [132183] Apache Mesos up to pre-1.4.x Docker Image Code Execution
11609| [131988] Apache Karaf up to 4.2.2 kar Deployer directory traversal
11610| [131859] Apache Hadoop up to 2.9.1 privilege escalation
11611| [131479] Apache Solr up to 7.6 HTTP GET Request Server-Side Request Forgery
11612| [131446] Apache Solr up to 5.0.5/6.6.5 Config API HTTP POST Request Code Execution
11613| [131385] Apache Qpid Broker-J up to 6.x/7.0.6/7.1.0 AMQP Command Crash denial of service
11614| [131315] Apache Mesos up to pre-1.4.x Mesos Masters Rendering JSON Payload Recursion denial of service
11615| [131236] Apache Airflow up to 1.10.1 Metadata Database cross site scripting
11616| [130755] Apache JSPWiki up to 2.10.5 URL cross site scripting
11617| [130629] Apache Guacamole Cookie Flag weak encryption
11618| [130628] Apache Hadoop up to 3.0.0 HDFS information disclosure
11619| [130529] Apache Subversion 1.10.0/1.10.1/1.10.2/1.10.3/1.11.0 mod_dav_svn Directory Crash denial of service
11620| [130353] Apache Open Office up to 4.1.5 Document Loader String memory corruption
11621| [130341] Apache HTTP Server 2.4.37 mod_ssl Loop denial of service
11622| [130330] Apache HTTP Server up to 2.4.37 mod_session Expired privilege escalation
11623| [130329] Apache HTTP Server 2.4.37 mod_http2 Slowloris denial of service
11624| [130212] Apache Airflow up to 1.10.0 LDAP Auth Backend Certificate weak authentication
11625| [130123] Apache Airflow up to 1.8.2 information disclosure
11626| [130122] Apache Airflow up to 1.8.2 command injection cross site request forgery
11627| [130121] Apache Airflow up to 1.8.2 Webserver Object Code Execution
11628| [129717] Oracle Secure Global Desktop 5.4 Apache HTTP Server denial of service
11629| [129688] Oracle Tape Library ACSLS 8.4 Apache Log4j unknown vulnerability
11630| [129673] Oracle Retail Returns Management 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
11631| [129672] Oracle Retail Central Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
11632| [129671] Oracle Retail Back Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
11633| [129574] Oracle Outside In Technology 8.5.3/8.5.4 Apache Tomcat denial of service
11634| [129573] Oracle WebLogic Server 10.3.6.0 Apache HTTP Server denial of service
11635| [129563] Oracle Enterprise Repository 12.1.3.0.0 Apache Log4j unknown vulnerability
11636| [129555] Oracle Outside In Technology 8.5.3 Apache Batik denial of service
11637| [129551] Oracle Outside In Technology 8.5.3/8.5.4 Apache Commons FileUpload denial of service
11638| [129542] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
11639| [129538] Oracle SOA Suite 12.1.3.0.0/12.2.1.3.0 Apache Batik unknown vulnerability
11640| [129519] Oracle Enterprise Manager Ops Center 12.2.2/12.3.3 Apache ActiveMQ unknown vulnerability
11641| [129508] Oracle Applications Manager up to 12.2.8 Apache Derby unknown vulnerability
11642| [129507] Oracle Mobile Field Service up to 12.2.8 Apache Log4j unknown vulnerability
11643| [129505] Oracle Email Center up to 12.2.8 Apache Log4j unknown vulnerability
11644| [129504] Oracle CRM Technical Foundation up to 12.2.8 Apache Commons FileUpload unknown vulnerability
11645| [129499] Oracle Partner Management up to 12.2.8 Apache Log4j unknown vulnerability
11646| [129498] Oracle Marketing up to 12.2.8 Apache Commons FileUpload unknown vulnerability
11647| [129480] Oracle Communications WebRTC Session Controller up to 7.1 Apache Batik unknown vulnerability
11648| [129479] Oracle Communications Diameter Signaling Router up to 8.2 Apache Batik unknown vulnerability
11649| [129474] Oracle Communications Diameter Signaling Router up to 8.2 Apache HTTP Server information disclosure
11650| [129472] Oracle Communications WebRTC Session Controller up to 7.1 Apache Struts 1 unknown vulnerability
11651| [129470] Oracle Communications Converged Application Server up to 7.0.0.0 Apache Struts 1 unknown vulnerability
11652| [129463] Oracle Communications WebRTC Session Controller up to 7.1 Apache Log4j unknown vulnerability
11653| [129461] Oracle Communications Services Gatekeeper up to 6.1.0.3.x Apache Commons Collections Fileupload unknown vulnerability
11654| [129460] Oracle Communications Service Broker 6.0 Apache Log4j unknown vulnerability
11655| [129459] Oracle Communications Policy Management up to 12.4 Apache Struts 2 unknown vulnerability
11656| [129458] Oracle Communications Online Mediation Controller 6.1 Apache Log4j unknown vulnerability
11657| [129457] Oracle Communications Diameter Signaling Router up to 8.2 Apache Commons Fileupload unknown vulnerability
11658| [129456] Oracle Communications Converged Application Server 6.1 Apache Log4j unknown vulnerability
11659| [128714] Apache Thrift Java Client Library up to 0.11.0 SASL Negotiation org.apache.thrift.transport.TSaslTransport unknown vulnerability
11660| [128713] Apache Thrift Node.js Static Web Server up to 0.11.0 directory traversal
11661| [128709] Apache Karaf up to 4.1.6/4.2.1 Features Deployer XMLInputFactory XML External Entity
11662| [128575] Apache NetBeans 9.0 Proxy Auto-Config Code Execution
11663| [128369] Apache Tika 1.8-1.19.1 SQLite3Parser Loop sql injection
11664| [128111] Apache NiFi 1.8.0 Template Upload Man-in-the-Middle cross site request forgery
11665| [128110] Apache NiFi 1.8.0 Cluster Request privilege escalation
11666| [128109] Apache NiFi 1.8.0 Error Page message-page.jsp Request Header cross site scripting
11667| [128108] Apache NiFi up to 1.7.x X-Frame-Options Header privilege escalation
11668| [128102] Apache Oozie up to 5.0.0 Workflow XML Impersonation spoofing
11669| [127994] WordPress up to 5.0.0 on Apache httpd MIME Restriction cross site scripting
11670| [127981] Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04 HTTP Engine httpService GET Request privilege escalation
11671| [127161] Apache Hadoop 2.7.4/2.7.5/2.7.6 Incomplete Fix CVE-2016-6811 privilege escalation
11672| [127040] Loadbalancer.org Enterprise VA MAX up to 8.3.2 Apache HTTP Server Log cross site scripting
11673| [127007] Apache Spark Request Code Execution
11674| [126791] Apache Hadoop up to 0.23.11/2.7.6/2.8.4/2.9.1/3.0.2 ZIP File unknown vulnerability
11675| [126767] Apache Qpid Proton-J Transport 0.3 Certificate Verification Man-in-the-Middle weak authentication
11676| [126896] Apache Commons FileUpload 1.3.3 on LDAP Manager DiskFileItem File privilege escalation
11677| [126574] Apache Hive up to 2.3.3/3.1.0 Query privilege escalation
11678| [126573] Apache Hive up to 2.3.3/3.1.0 HiveServer2 privilege escalation
11679| [126564] Apache Superset up to 0.22 Pickle Library load Code Execution
11680| [126488] Apache Syncope up to 2.0.10/2.1.1 BPMN Definition xxe privilege escalation
11681| [126487] Apache Syncope up to 2.0.10/2.1.1 cross site scripting
11682| [126346] Apache Tomcat Path privilege escalation
11683| [125922] Apache Impala up to 3.0.0 ALTER privilege escalation
11684| [125921] Apache Impala up to 3.0.0 Queue Injection privilege escalation
11685| [125647] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Install (Apache Tomcat) information disclosure
11686| [125617] Oracle Retail Returns Management 14.1 Apache Batik unknown vulnerability
11687| [125616] Oracle Retail Point-of-Service 13.4/14.0/14.1 Apache Batik unknown vulnerability
11688| [125614] Oracle Retail Central Office 14.1 Apache Batik unknown vulnerability
11689| [125613] Oracle Retail Back Office 13.3/13.4/14/14.1 Apache Batik unknown vulnerability
11690| [125599] Oracle Retail Open Commerce Platform 5.3.0/6.0.0/6.0.1 Apache Log4j unknown vulnerability
11691| [125569] Oracle PeopleSoft Enterprise PeopleTools 8.55/8.56 Apache HTTP Server information disclosure
11692| [125494] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat information disclosure
11693| [125447] Oracle Business Intelligence Enterprise Edition 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Batik unknown vulnerability
11694| [125428] Oracle Identity Management Suite 11.1.2.3.0/12.2.1.3.0 Apache Log4j unknown vulnerability
11695| [125427] Oracle Identity Analytics 11.1.1.5.8 Apache Log4j unknown vulnerability
11696| [125424] Oracle API Gateway 11.1.2.4.0 Apache Log4j unknown vulnerability
11697| [125423] Oracle BI Publisher 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Log4j unknown vulnerability
11698| [125383] Oracle up to 10.2.0 Apache Trinidad unknown vulnerability
11699| [125379] Oracle up to 10.1.x Apache Struts 1 cross site scripting
11700| [125377] Oracle up to 10.2.0 Apache Commons Collections unknown vulnerability
11701| [125376] Oracle Communications Application Session Controller up to 3.7.0 Apache Commons Collections unknown vulnerability
11702| [125375] Oracle Communications User Data Repository up to 12.1.x Apache Xerces memory corruption
11703| [125248] Apache ActiveMQ up to 5.15.5 Web-based Administration Console queue.jsp Parameter cross site scripting
11704| [125133] Apache Tika up to 1.19 XML Parser reset() denial of service
11705| [124877] Apache PDFbox up to 2.0.11 PDF File denial of service
11706| [124876] Apache Ranger up to 1.1.x UnixAuthenticationService Stack-based memory corruption
11707| [124791] Apache Tomcat up to 7.0.90/8.5.33/9.0.11 URL Open Redirect
11708| [124787] Apache Pony Mail 0.7/0.8/0.9 Statistics Generator Timestamp Data information disclosure
11709| [124447] Apache HTTP Server up to 2.4.34 SETTINGS Frame denial of service
11710| [124346] Apache Mesos pre-1.4.2/1.5.0/1.5.1/1.6.0 on Executor HTTP API String Comparison validation JSON Web Token information disclosure
11711| [124286] Apache Tika up to 1.18 IptcAnpaParser Loop denial of service
11712| [124242] Apache Tika up to 0.18 C:/evil.bat" Directory unknown vulnerability
11713| [124241] Apache Tika up to 0.18 XML Parser Entity Expansion denial of service
11714| [124191] Apache Karaf up to 3.0.8/4.0.8/4.1.0 WebConsole .../gogo/ weak authentication
11715| [124190] Apache Karaf up to 4.1.x sshd privilege escalation
11716| [124152] Apache Camel Mail up to 2.22.0 Path directory traversal
11717| [124143] Apache SpamAssassin up to 3.4.1 PDFInfo Plugin Code Execution
11718| [124134] Apache SpamAssassin up to 3.4.1 Scan Engine HTML::Parser Email denial of service
11719| [124095] PHP up to 5.6.37/7.0.31/7.1.21/7.2.9 Apache2 sapi_apache2.c php_handler cross site scripting
11720| [124024] Apache Mesos 1.4.x/1.5.0 libprocess JSON Payload denial of service
11721| [123814] Apache ActiveMQ Client up to 5.15.5 TLS Hostname Verification Man-in-the-Middle weak authentication
11722| [123393] Apache Traffic Server up to 6.2.2/7.1.3 ESI Plugin Config privilege escalation
11723| [123392] Apache Traffic Server 6.2.2 TLS Handshake Segmentation Fault denial of service
11724| [123391] Apache Traffic Server up to 6.2.2/7.1.3 Range Request Performance denial of service
11725| [123390] Apache Traffic Server up to 6.2.2/7.1.3 Request HTTP Smuggling privilege escalation
11726| [123369] Apache Traffic Server up to 6.2.2/7.1.3 ACL remap.config Request denial of service
11727| [123197] Apache Sentry up to 2.0.0 privilege escalation
11728| [123145] Apache Struts up to 2.3.34/2.5.16 Namespace Code Execution
11729| [123144] Apache Cayenne up to 4.1.M1 CayenneModeler XML File File Transfer privilege escalation
11730| [122981] Apache Commons Compress 1.7 ZipArchiveInputStream ZIP Archive denial of service
11731| [122889] Apache HTTP Server up to 2.2.31/2.4.23 mod_userdir HTTP Response Splitting privilege escalation
11732| [122800] Apache Spark 1.3.0 REST API weak authentication
11733| [122642] Apache Airflow up to 1.8.x 404 Page Reflected cross site scripting
11734| [122568] Apache Tomcat up to 8.5.31/9.0.9 Connection Reuse weak authentication
11735| [122567] Apache Axis 1.0./1.1/1.2/1.3/1.4 cross site scripting
11736| [122556] Apache Tomcat up to 7.0.86/8.0.51/8.5.30/9.0.7 UTF-8 Decoder Loop denial of service
11737| [122531] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.9 WebSocket Client unknown vulnerability
11738| [122456] Apache Camel up to 2.20.3/2.21.0 XSD Validator XML External Entity
11739| [122455] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Revoked Certificate weak authentication
11740| [122454] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Responder Revoked Certificate weak authentication
11741| [122214] Apache Kafka up to 0.9.0.1/0.10.2.1/0.11.0.2/1.0.0 Broker Request Data Loss denial of service
11742| [122202] Apache Kafka up to 0.10.2.1/0.11.0.1 SASL Impersonation spoofing
11743| [122101] Docker Skeleton Runtime for Apache OpenWhisk Docker Action dockerskeleton:1.3.0 privilege escalation
11744| [122100] PHP Runtime for Apache OpenWhisk Docker Action action-php-v7.2:1.0.0 privilege escalation
11745| [122012] Apache Ignite up to 2.5 Serialization privilege escalation
11746| [121911] Apache Ambari up to 2.5.x/2.6.2 Log Message Credentials information disclosure
11747| [121910] Apache HTTP Server 2.4.33 mod_md HTTP Requests denial of service
11748| [121854] Oracle Tape Library ACSLS up to ACSLS 8.4.0-2 Apache Commons Collections unknown vulnerability
11749| [121752] Oracle Insurance Policy Administration 10.0/10.1/10.2/11.0 Apache Log4j unknown vulnerability
11750| [121370] Apache Spark up to 2.1.2/2.2.1/2.3.0 URL cross site scripting
11751| [121354] Apache CouchDB HTTP API Code Execution
11752| [121144] Apache LDAP API up to 1.0.1 SSL Filter information disclosure
11753| [121143] Apache storm up to 0.10.2/1.0.6/1.1.2/1.2.1 Cluster privilege escalation
11754| [120436] Apache CXF Fediz up to 1.4.3 Application Plugin unknown vulnerability
11755| [120310] Apache PDFbox up to 1.8.14/2.0.10 AFMParser Loop denial of service
11756| [120168] Apache CXF weak authentication
11757| [120080] Apache Cassandra up to 3.11.1 JMX/RMI Interface RMI Request privilege escalation
11758| [120043] Apache HBase up to 1.2.6.0/1.3.2.0/1.4.4/2.0.0 Thrift 1 API Server weak authentication
11759| [119723] Apache Qpid Broker-J 7.0.0/7.0.1/7.0.2/7.0.3/7.0.4 AMQP Messages Crash denial of service
11760| [122569] Apache HTTP Server up to 2.4.33 HTTP2 Request denial of service
11761| [119486] Apache Geode up to 1.4.0 Security Manager Code Execution
11762| [119306] Apache MXNet Network Interface privilege escalation
11763| [118999] Apache Storm up to 1.0.6/1.1.2/1.2.1 Archive directory traversal
11764| [118996] Apache Storm up to 1.0.6/1.1.2/1.2.1 Daemon spoofing
11765| [118644] Apple macOS up to 10.13.5 apache_mod_php unknown vulnerability
11766| [118200] Apache Batik up to 1.9 Deserialization unknown vulnerability
11767| [118143] Apache NiFi activemq-client Library Deserialization denial of service
11768| [118142] Apache NiFi 1.6.0 SplitXML xxe privilege escalation
11769| [118051] Apache Zookeeper up to 3.4.9/3.5.3-beta weak authentication
11770| [117997] Apache ORC up to 1.4.3 ORC File Recursion denial of service
11771| [117825] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.8 CORS Filter privilege escalation
11772| [117405] Apache Derby up to 10.14.1.0 Network Server Network Packet privilege escalation
11773| [117347] Apache Ambari up to 2.6.1 HTTP Request directory traversal
11774| [117265] LibreOffice/Apache Office Writer SMB Connection XML Document information disclosure
11775| [117143] Apache uimaj/uima-as/uimaFIT/uimaDUCC XML XXE information disclosure
11776| [117117] Apache Tika up to 1.17 ChmParser Loop denial of service
11777| [117116] Apache Tika up to 1.17 BPGParser Loop denial of service
11778| [117115] Apache Tika up to 1.17 tika-server command injection
11779| [116929] Apache Fineract getReportType Parameter privilege escalation
11780| [116928] Apache Fineract REST Endpoint Parameter privilege escalation
11781| [116927] Apache Fineract MakercheckersApiResource Parameter sql injection
11782| [116926] Apache Fineract REST Hand Parameter privilege escalation
11783| [116574] Apache wicket-jquery-ui up to 6.29.0/7.10.1/8.0.0-M9.1 WYSIWYG Editor privilege escalation
11784| [116622] Oracle Enterprise Manager for MySQL Database 12.1.0.4 EM Plugin: General (Apache Tomcat) unknown vulnerability
11785| [115931] Apache Solr up to 6.6.2/7.2.1 XML Data Parameter XML External Entity
11786| [115883] Apache Hive up to 2.3.2 privilege escalation
11787| [115882] Apache Hive up to 2.3.2 xpath_short information disclosure
11788| [115881] Apache DriverHive JDBC Driver up to 2.3.2 Escape Argument Bypass privilege escalation
11789| [115518] Apache Ignite 2.3 Deserialization privilege escalation
11790| [115260] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache cross site scripting
11791| [115259] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache Cookie Stack-based memory corruption
11792| [115500] CA Workload Control Center up to r11.4 SP5 Apache MyFaces Component Code Execution
11793| [115121] Apache Struts REST Plugin up to 2.5.15 Xstream XML Data denial of service
11794| [115061] Apache HTTP Server up to 2.4.29 HTTP Digest Authentication Challenge HTTP Requests Replay privilege escalation
11795| [115060] Apache HTTP Server up to 2.4.29 mod_cache_socache Request Header Crash denial of service
11796| [115059] Apache HTTP Server up to 2.4.29 HTTP2 NULL Pointer Dereference denial of service
11797| [115058] Apache HTTP Server up to 2.4.29 HTTP Header Crash denial of service
11798| [115057] Apache HTTP Server up to 2.4.29 mod_session Variable Name Cache privilege escalation
11799| [115039] Apache HTTP Server up to 2.4.29 FilesMatch File Upload privilege escalation
11800| [115038] Apache HTTP Server up to 2.0.65/2.2.34/2.4.29 mod_authnz_ldap Crash denial of service
11801| [114817] Apache Syncope up to 1.2.10/2.0.7 Search Parameter information disclosure
11802| [114816] Apache Syncope up to 1.2.10/2.0.7 XSLT Code Execution
11803| [114717] Apache Commons 1.11/1.12/1.13/1.14/1.15 ZIP Archive ZipFile/ZipArchiveInputStream denial of service
11804| [114661] Apache Allura up to 1.8.0 HTTP Response Splitting privilege escalation
11805| [114400] Apache Tomcat JK ISAPI Connector up to 1.2.42 IIS/ISAPI privilege escalation
11806| [114258] Apache HTTP Server up to 2.4.22 mod_cluster Segmentation Fault denial of service
11807| [114086] Apache ODE 1.3.3 ODE Process Deployment Web Service directory traversal
11808| [113955] Apache Xerces-C up to 3.2.0 XML Parser NULL Pointer Dereference denial of service
11809| [113945] Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4 URL Pattern Empty String privilege escalation
11810| [113944] Apache OpenMeetings up to 3.x/4.0.1 CRUD Operation denial of service
11811| [113905] Apache Traffic Server up to 5.2.x/5.3.2/6.2.0/7.0.0 TLS Handshake Core Dump denial of service
11812| [113904] Apache Traffic Server up to 6.2.0 Host Header privilege escalation
11813| [113895] Apache Geode up to 1.3.x Code Execution
11814| [113894] Apache Geode up to 1.3.x TcpServer Code Execution
11815| [113888] Apache James Hupa WebMail 0.0.2 cross site scripting
11816| [113813] Apache Geode Cluster up to 1.3.x Secure Mode privilege escalation
11817| [113747] Apache Tomcat Servlets privilege escalation
11818| [113647] Apache Qpid up to 0.30 qpidd Broker AMQP Message Crash denial of service
11819| [113645] Apache VCL up to 2.1/2.2.1/2.3.1 Web GUI/XMLRPC API privilege escalation
11820| [113560] Apache jUDDI Console 3.0.0 Log Entries spoofing
11821| [113571] Apache Oozie up to 4.3.0/5.0.0-beta1 XML Data XML File privilege escalation
11822| [113569] Apache Karaf up to 4.0.7 LDAPLoginModule LDAP injection denial of service
11823| [113273] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
11824| [113198] Apache Qpid Dispatch Router 0.7.0/0.8.0 AMQP denial of service
11825| [113186] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
11826| [113145] Apache Thrift up to 0.9.3 Go Client Library privilege escalation
11827| [113106] Apache jUDDI up to 3.3.3 XML Data WADL2Java/WSDL2Java XML Document privilege escalation
11828| [113105] Apache Qpid Broker-J 7.0.0 AMQP Crash denial of service
11829| [112885] Apache Allura up to 1.8.0 File information disclosure
11830| [112856] Apache CloudStack up to 4.8.1.0/4.9.0.0 API weak authentication
11831| [112855] Apache CloudStack 4.1.0/4.1.1 API information disclosure
11832| [112678] Apache Tomcat up to 7.0.82/8.0.47/8.5.23/9.0.1 Bug Fix 61201 privilege escalation
11833| [112677] Apache Tomcat Native Connector up to 1.1.34/1.2.14 OCSP Checker Client weak authentication
11834| [112625] Apache POI up to 3.16 Loop denial of service
11835| [112448] Apache NiFi up to 1.3.x Deserialization privilege escalation
11836| [112396] Apache Hadoop 2.7.3/2.7.4 YARN NodeManager Credentials information disclosure
11837| [112339] Apache NiFi 1.5.0 Header privilege escalation
11838| [112330] Apache NiFi 1.5.0 Header HTTP Request privilege escalation
11839| [112314] NetGain Enterprise Manager 7.2.730 Build 1034 org.apache.jsp.u.jsp.tools.exec_jsp Servlet Parameter privilege escalation
11840| [112253] Apache Hadoop up to 0.23.x/2.7.4/2.8.2 MapReduce Job History Server Configuration File privilege escalation
11841| [112171] Oracle Secure Global Desktop 5.3 Apache Log4j privilege escalation
11842| [112164] Oracle Agile PLM 9.3.5/9.3.6 Apache Tomcat unknown vulnerability
11843| [112161] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Tomcat privilege escalation
11844| [112158] Oracle Autovue for Agile Product Lifecycle Management 21.0.0/21.0.1 Apache Log4j privilege escalation
11845| [112156] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Log4j privilege escalation
11846| [112155] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Apache Log4j privilege escalation
11847| [112137] Oracle MICROS Relate CRM Software 10.8.x/11.4.x/15.0.x, Apache Tomcat unknown vulnerability
11848| [112136] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat privilege escalation
11849| [112133] Oracle Retail Workforce Management 1.60.7/1.64.0 Apache Log4j privilege escalation
11850| [112129] Oracle Retail Assortment Planning 14.1.3/15.0.3/16.0.1 Apache Log4j privilege escalation
11851| [112114] Oracle 9.1 Apache Log4j privilege escalation
11852| [112113] Oracle 9.1 Apache Log4j privilege escalation
11853| [112045] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat privilege escalation
11854| [112038] Oracle Health Sciences Empirica Inspections 1.0.1.1 Apache Tomcat information disclosure
11855| [112019] Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 Apache Tomcat privilege escalation
11856| [112017] Oracle WebCenter Portal 11.1.1.9.0/12.2.1.2.0/12.2.1.3.0 Apache Struts 1 cross site scripting
11857| [112011] Oracle Identity Manager 11.1.2.3.0 Apache Commons Collections privilege escalation
11858| [111950] Oracle Database 12.2.0.1 Apache Tomcat information disclosure
11859| [111703] Apache Sling XSS Protection API 1.0.4 URL Encoding cross site scripting
11860| [111556] Apache Geode up to 1.2.x Secure Mode Parameter OQL privilege escalation
11861| [111555] Apache Geode up to 1.2.x Secure Mode OQL privilege escalation
11862| [111540] Apache Geode up to 1.2.x Secure Mode information disclosure
11863| [111519] Apache Sling JCR ContentLoader 2.1.4 xmlreader directory traversal
11864| [111338] Apache DeltaSpike-JSF 1.8.0 cross site scripting
11865| [111330] Apache OFBiz 16.11.01/16.11.02/16.11.03 BIRT Plugin cross site scripting
11866| [110789] Apache Sling up to 1.4.0 Authentication Service Credentials information disclosure
11867| [110785] Apache Drill up to 1.11.0 Query Page unknown vulnerability
11868| [110701] Apache Fineract Query Parameter sql injection
11869| [110484] Apache Synapse up to 3.0.0 Apache Commons Collections Serialized Object Code Injection privilege escalation
11870| [110426] Adobe Experience Manager 6.0/6.1/6.2/6.3 Apache Sling Servlets Post cross site scripting
11871| [110393] Apple macOS up to 10.13.2 apache information disclosure
11872| [110141] Apache Struts up to 2.5.14 REST Plugin denial of service
11873| [110140] Apache Qpid Broker-J up to 0.32 privilege escalation
11874| [110139] Apache Qpid Broker-J up to 6.1.4 AMQP Frame denial of service
11875| [110106] Apache CXF Fediz Spring cross site request forgery
11876| [109766] Apache OpenOffice up to 4.1.3 DOC File Parser WW8Fonts memory corruption
11877| [109750] Apache OpenOffice up to 4.1.3 DOC File Parser ImportOldFormatStyles memory corruption
11878| [109749] Apache OpenOffice up to 4.1.3 PPT File Parser PPTStyleSheet memory corruption
11879| [109606] October CMS Build 412 Apache Configuration File Upload privilege escalation
11880| [109419] Apache Camel up to 2.19.3/2.20.0 camel-castor Java Object Deserialization privilege escalation
11881| [109418] Apache Camel up to 2.19.3/2.20.0 camel-hessian Java Object Deserialization privilege escalation
11882| [109400] Apache CouchDB up to 1.6.x/2.1.0 Database Server Shell privilege escalation
11883| [109399] Apache CouchDB up to 1.6.x/2.1.0 JSON Parser Shell privilege escalation
11884| [109398] Apache CXF 3.1.14/3.2.1 JAX-WS/JAX-RS Attachment denial of service
11885| [108872] Apache Hive up to 2.1.1/2.2.0/2.3.0 Policy Enforcement privilege escalation
11886| [108939] Apple macOS up to 10.13.1 apache unknown vulnerability
11887| [108938] Apple macOS up to 10.13.1 apache denial of service
11888| [108937] Apple macOS up to 10.13.1 apache unknown vulnerability
11889| [108936] Apple macOS up to 10.13.1 apache unknown vulnerability
11890| [108935] Apple macOS up to 10.13.1 apache denial of service
11891| [108934] Apple macOS up to 10.13.1 apache unknown vulnerability
11892| [108933] Apple macOS up to 10.13.1 apache unknown vulnerability
11893| [108932] Apple macOS up to 10.13.1 apache unknown vulnerability
11894| [108931] Apple macOS up to 10.13.1 apache denial of service
11895| [108930] Apple macOS up to 10.13.1 apache unknown vulnerability
11896| [108929] Apple macOS up to 10.13.1 apache denial of service
11897| [108928] Apple macOS up to 10.13.1 apache unknown vulnerability
11898| [108797] Apache Struts up to 2.3.19 TextParseUtiltranslateVariables OGNL Expression privilege escalation
11899| [108795] Apache Traffic Server up to 5.3.0 HTTP2 set_dynamic_table_size memory corruption
11900| [108794] Apache WSS4J up to 1.6.16/2.0.1 Incomplete Fix Leak information disclosure
11901| [108793] Apache Qpid up to 0.30 qpidd Crash denial of service
11902| [108792] Apache Traffic Server up to 5.1.0 Access Restriction privilege escalation
11903| [108791] Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2 Session information disclosure
11904| [108790] Apache storm 0.9.0.1 Log Viewer directory traversal
11905| [108789] Apache Cordova In-App-Browser Standalone Plugin up to 0.3.1 on iOS CDVInAppBrowser privilege escalation
11906| [108788] Apache Cordova File-Transfer Standalone Plugin up to 0.4.1 on iOS ios/CDVFileTransfer.m spoofing
11907| [108787] Apache HttpClient up to 4.3.0 HttpClientBuilder.java unknown vulnerability
11908| [108786] Apache Wicket up to 1.4.21/1.5.9/6.3.x script Tag cross site scripting
11909| [108783] Apache Hadoop up to 0.23.3/1.0.3/2.0.1 Kerberos Security Feature Key weak encryption
11910| [108782] Apache Xerces2 XML Service denial of service
11911| [108781] Apache jUDDI up to 1.x happyjuddi.jsp Parameter cross site scripting
11912| [108780] Apache jUDDI up to 1.x Log File uddiget.jsp spoofing
11913| [108709] Apache Cordova Android up to 3.7.1/4.0.1 intent URL privilege escalation
11914| [108708] Apache ActiveMQ up to 5.10.0 XML Data XML External Entity
11915| [108707] Apache ActiveMQ up to 1.7.0 XML Data XML External Entity
11916| [108629] Apache OFBiz up to 10.04.01 privilege escalation
11917| [108543] Apache Derby 10.1.2.1/10.2.2.0/10.3.1.4/10.4.1.3 Export File privilege escalation
11918| [108312] Apache HTTP Server on RHEL IP Address Filter privilege escalation
11919| [108297] Apache NiFi up to 0.7.1/1.1.1 Proxy Chain Username Deserialization privilege escalation
11920| [108296] Apache NiFi up to 0.7.1/1.1.1 Cluster Request privilege escalation
11921| [108250] Oracle Secure Global Desktop 5.3 Apache HTTP Server memory corruption
11922| [108245] Oracle Transportation Management up to 6.3.7 Apache Tomcat unknown vulnerability
11923| [108244] Oracle Transportation Management 6.4.1/6.4.2 Apache Commons FileUpload denial of service
11924| [108243] Oracle Agile Engineering Data Management 6.1.3/6.2.0 Apache Commons Collections memory corruption
11925| [108222] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Batik denial of service
11926| [108219] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat unknown vulnerability
11927| [108217] Oracle Retail Store Inventory Management 13.2.9/14.0.4/14.1.3/15.0.1/16.0.1 Apache Groovy unknown vulnerability
11928| [108216] Oracle Retail Convenience and Fuel POS Software 2.1.132 Apache Groovy unknown vulnerability
11929| [108169] Oracle MySQL Enterprise Monitor up to 3.2.8.2223/3.3.4.3247/3.4.2.4181 Apache Tomcat unknown vulnerability
11930| [108113] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Batik denial of service
11931| [108107] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
11932| [108102] Oracle Healthcare Master Person Index 4.x Apache Groovy unknown vulnerability
11933| [108085] Oracle Identity Manager 11.1.2.3.0 Apache Struts 1 memory corruption
11934| [108083] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
11935| [108080] Oracle GlassFish Server 3.1.2 Apache Commons FileUpload denial of service
11936| [108069] Oracle Endeca Information Discovery Integrator 2.4/3.0/3.1/3.2 Apache Commons Collections memory corruption
11937| [108067] Oracle Business Process Management Suite 11.1.1.9.0/12.2.1.1.0 Apache Commons Collections memory corruption
11938| [108066] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Tomcat memory corruption
11939| [108065] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Commons Collections memory corruption
11940| [108062] Oracle BI Publisher 11.1.1.7.0/12.2.1.1.0/12.2.1.2.0 Apache ActiveMQ memory corruption
11941| [108060] Oracle Enterprise Manager Ops Center 12.2.2/12.3.2 Apache Groovy unknown vulnerability
11942| [108033] Oracle Primavera Unifier 9.13/9.14/10.x/15.x/16.x, Apache Groovy unknown vulnerability
11943| [108024] Oracle Communications Order and Service Management 7.2.4.x.x/7.3.0.x.x/7.3.1.x.x/7.3.5.x.x Apache Commons Collections memory corruption
11944| [108015] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Commons Collections memory corruption
11945| [108013] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Groovy unknown vulnerability
11946| [108011] Oracle Communications Services Gatekeeper 5.1/6.0 Apache Trinidad unknown vulnerability
11947| [107904] Apache Struts up to 2.3.28 Double OGNL Evaluation privilege escalation
11948| [107860] Apache Solr up to 7.0 Apache Lucene RunExecutableListener XML External Entity
11949| [107834] Apache Ranger up to 0.6.1 Change Password privilege escalation
11950| [107639] Apache NiFi 1.4.0 XML External Entity
11951| [107606] Apache ZooKeper up to 3.4.9/3.5.2 Command CPU Exhaustion denial of service
11952| [107597] Apache Roller up to 5.0.2 XML-RPC Protocol Support XML External Entity
11953| [107429] Apache Impala up to 2.9.x Kudu Table privilege escalation
11954| [107411] Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0 JSP File File Upload privilege escalation
11955| [107385] Apache Geode up to 1.2.0 Secure Mode privilege escalation
11956| [107339] Apache OpenNLP up to 1.5.3/1.6.0/1.7.2/1.8.1 XML Data XML External Entity
11957| [107333] Apache Wicket up to 8.0.0-M1 CSRF Prevention HTTP Header privilege escalation
11958| [107323] Apache Wicket 1.5.10/6.13.0 Class Request information disclosure
11959| [107310] Apache Geode up to 1.2.0 Command Line Utility Query privilege escalation
11960| [107276] ArcSight ESM/ArcSight ESM Express up to 6.9.1c Patch 3/6.11.0 Apache Tomcat Version information disclosure
11961| [107266] Apache Tika up to 1.12 XML Parser XML External Entity
11962| [107262] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
11963| [107258] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
11964| [107197] Apache Xerces Jelly Parser XML File XML External Entity
11965| [107193] ZTE NR8950 Apache Commons Collections RMI Request Deserialization privilege escalation
11966| [107084] Apache Struts up to 2.3.19 cross site scripting
11967| [106877] Apache Struts up to 2.0.33/2.5.10 Freemarker Tag privilege escalation
11968| [106875] Apache Struts up to 2.5.5 URL Validator denial of service
11969| [106874] Apache Struts up to 2.3.30 Convention Plugin directory traversal
11970| [106847] Apache Tomcat up to 7.0.80 VirtualDirContext Source information disclosure
11971| [106846] Apache Tomcat up to 7.0.79 on Windows HTTP PUT Method Parameter File Upload privilege escalation
11972| [106777] Apache HTTP Server up to 2.2.34/2.4.27 Limit Directive ap_limit_section HTTP Request information disclosure
11973| [106739] puppetlabs-apache up to 1.11.0/2.0.x weak authentication
11974| [106720] Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4 CryptoMapper privilege escalation
11975| [106586] Apache Brooklyn up to 0.9.x REST Server cross site scripting
11976| [106562] Apache Spark up to 2.1.1 Launcher API Deserialization privilege escalation
11977| [106559] Apache Brooklyn up to 0.9.x SnakeYAML YAML Data Java privilege escalation
11978| [106558] Apache Brooklyn up to 0.9.x REST Server cross site request forgery
11979| [106556] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
11980| [106555] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
11981| [106171] Apache Directory LDAP API up to 1.0.0-M30 Timing unknown vulnerability
11982| [106167] Apache Struts up to 2.5.12 REST Plugin XML Data privilege escalation
11983| [106166] Apache Struts up to 2.3.33/2.5.12 REST Plugin denial of service
11984| [106165] Apache Struts up to 2.3.33/2.5.12 URLValidator Regex CPU Exhaustion denial of service
11985| [106115] Apache Hadoop up to 2.6.4/2.7.2 YARN NodeManager Password information disclosure
11986| [106012] Apache Solr up to 5.5.3/6.4.0 Replication directory traversal
11987| [105980] Apache Engine 16.11.01 Parameter Reflected unknown vulnerability
11988| [105962] Apache Atlas 0.6.0/0.7.0 Frame cross site scripting
11989| [105961] Apache Atlas 0.6.0/0.7.0 Stack Trace information disclosure
11990| [105960] Apache Atlas 0.6.0/0.7.0 Search Reflected cross site scripting
11991| [105959] Apache Atlas 0.6.0/0.7.0 edit Tag DOM cross site scripting
11992| [105958] Apache Atlas 0.6.0/0.7.0 edit Tag Stored cross site scripting
11993| [105957] Apache Atlas 0.6.0/0.7.0 Cookie privilege escalation
11994| [105905] Apache Atlas 0.6.0/0.7.0/0.7.1 /js privilege escalation
11995| [105878] Apache Struts up to 2.3.24.0 privilege escalation
11996| [105682] Apache2Triad 1.5.4 phpsftpd/users.php Parameter cross site scripting
11997| [105681] Apache2Triad 1.5.4 phpsftpd/users.php Request cross site request forgery
11998| [105680] Apache2Triad 1.5.4 Parameter Session Fixation weak authentication
11999| [105643] Apache Pony Mail up to 0.8b weak authentication
12000| [105288] Apache Sling up to 2.3.21 Sling.evalString() String cross site scripting
12001| [105219] Apache Tomcat up to 8.5.15/9.0.0.M21 HTTP2 Bypass directory traversal
12002| [105218] Apache Tomcat up to 7.0.78/8.0.44/8.5.15/9.0.0.M21 CORS Filter Cache Poisoning privilege escalation
12003| [105215] Apache CXF up to 3.0.12/3.1.9 OAuth2 Hawk/JOSE MAC Validation Timing unknown vulnerability
12004| [105206] Apache CXF up to 3.0.11/3.1.8 JAX-RS Module XML External Entity
12005| [105205] Apache CXF up to 3.0.11/3.1.8 HTTP Transport Module Parameter cross site scripting
12006| [105202] Apache Storm 1.0.0/1.0.1/1.0.2/1.0.3/1.1.0 Worker privilege escalation
12007| [104987] Apache Xerces-C++ XML Service CPU Exhaustion denial of service
12008| [104986] Apache CXF 2.4.5/2.5.1 WS-SP UsernameToken Policy SOAP Request weak authentication
12009| [104985] Apache MyFaces Core up to 2.1.4 EL Expression Parameter Injection information disclosure
12010| [104983] Apache Wink up to 1.1.1 XML Document xxe privilege escalation
12011| [104981] Apache Commons Email 1.0/1.1/1.2/1.3/1.4 Subject Linebreak SMTP privilege escalation
12012| [104591] MEDHOST Document Management System Apache Solr Default Credentials weak authentication
12013| [104062] Oracle MySQL Enterprise Monitor up to 3.3.3.1199 Apache Tomcat unknown vulnerability
12014| [104061] Oracle MySQL Enterprise Monitor up to 3.2.7.1204/3.3.3.1199 Apache Tomcat unknown vulnerability
12015| [104060] Oracle MySQL Enterprise Monitor up to 3.1.5.7958/3.2.5.1141/3.3.2.1162 Apache Struts 2 unknown vulnerability
12016| [103995] Oracle 8.3/8.4/15.1/15.2 Apache Trinidad unknown vulnerability
12017| [103993] Oracle Policy Automation up to 12.2.3 Apache Commons FileUplaod denial of service
12018| [103916] Oracle Banking Platform 2.3/2.4/2.4.1/2.5 Apache Commons FileUpload denial of service
12019| [103906] Oracle Communications BRM 11.2.0.0.0 Apache Commons Collections privilege escalation
12020| [103904] Oracle Communications BRM 11.2.0.0.0/11.3.0.0.0 Apache Groovy memory corruption
12021| [103866] Oracle Transportation Management 6.1/6.2 Apache Webserver unknown vulnerability
12022| [103816] Oracle BI Publisher 11.1.1.9.0/12.2.1.1.0/12.2.1.2.0 Apache Commons Fileupload denial of service
12023| [103797] Oracle Tuxedo System and Applications Monitor Apache Commons Collections privilege escalation
12024| [103792] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Commons Fileupload privilege escalation
12025| [103791] Oracle Endeca Server 7.6.0.0/7.6.1.0 Apache Commons Collections privilege escalation
12026| [103788] Oracle Enterprise Repository 11.1.1.7.0/12.1.3.0.0 Apache ActiveMQ memory corruption
12027| [103787] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Groovy memory corruption
12028| [103763] Apache Sling up to 1.0.11 XSS Protection API XSS.getValidXML() Application XML External Entity
12029| [103762] Apache Sling up to 1.0.12 XSS Protection API XSSAPI.encodeForJSString() Script Tag cross site scripting
12030| [103693] Apache OpenMeetings 1.0.0 HTTP Method privilege escalation
12031| [103692] Apache OpenMeetings 1.0.0 Tomcat Error information disclosure
12032| [103691] Apache OpenMeetings 3.2.0 Parameter privilege escalation
12033| [103690] Apache OpenMeetings 1.0.0 sql injection
12034| [103689] Apache OpenMeetings 1.0.0 crossdomain.xml privilege escalation
12035| [103688] Apache OpenMeetings 1.0.0 weak encryption
12036| [103687] Apache OpenMeetings 1.0.0 cross site request forgery
12037| [103556] Apache Roller 5.1.0/5.1.1 Weblog Page Template VTL privilege escalation
12038| [103554] Apache OpenMeetings 1.0.0 Password Update unknown vulnerability
12039| [103553] Apache OpenMeetings 1.0.0 File Upload privilege escalation
12040| [103552] Apache OpenMeetings 3.2.0 Chat cross site scripting
12041| [103551] Apache OpenMeetings 3.1.0 XML unknown vulnerability
12042| [103521] Apache HTTP Server 2.4.26 HTTP2 Free memory corruption
12043| [103520] Apache HTTP Server up to 2.2.33/2.4.26 mod_auth_digest Authorization Header memory corruption
12044| [103519] Apache Struts up to 2.5.11/2.3.32 Spring AOP denial of service
12045| [103518] Apache Struts up to 2.5.11 URLValidator directory traversal
12046| [103492] Apache Spark up to 2.1.x Web UI Reflected cross site scripting
12047| [103401] Apache Struts 2.3.x Struts 1 Plugin ActionMessage privilege escalation
12048| [103399] Apache Traffic Control Traffic Router TCP Connection Slowloris denial of service
12049| [103387] Apache Impala up to 2.8.0 StatestoreSubscriber weak encryption
12050| [103386] Apache Impala up to 2.7.x/2.8.0 Kerberos weak authentication
12051| [103352] Apache Solr Node weak authentication
12052| [102897] Apache Ignite up to 2.0 Update Notifier information disclosure
12053| [102878] Code42 CrashPlan 5.4.x RMI Server org.apache.commons.ssl.rmi.DateRMI privilege escalation
12054| [102698] Apache HTTP Server up to 2.2.32/2.4.25 mod_mime Content-Type memory corruption
12055| [102697] Apache HTTP Server 2.2.32/2.2.24 HTTP Strict Parsing ap_find_token Request Header memory corruption
12056| [102690] Apache HTTP Server up to 2.2.32/2.4.25 mod_ssl ap_hook_process_connection() denial of service
12057| [102689] Apache HTTP Server up to 2.2.32/2.4.25 ap_get_basic_auth_pw weak authentication
12058| [102622] Apache Thrift up to 0.9.2 Client Libraries skip denial of service
12059| [102538] Apache Ranger up to 0.7.0 Authorizer unknown vulnerability
12060| [102537] Apache Ranger up to 0.7.0 Wildcard Character unknown vulnerability
12061| [102536] Apache Ranger up to 0.6 Stored cross site scripting
12062| [102535] Apache Ranger up to 0.6.2 Policy Engine unknown vulnerability
12063| [102255] Apache NiFi up to 0.7.3/1.2.x Response Header privilege escalation
12064| [102254] Apache NiFi up to 0.7.3/1.2.x UI cross site scripting
12065| [102070] Apache CXF Fediz up to 1.1.2/1.2.0 Application Plugin denial of service
12066| [102020] Apache Tomcat up to 9.0.0.M1 Java Servlet HTTP Method unknown vulnerability
12067| [101858] Apache Hive up to 1.2.1/2.0.0 Client weak authentication
12068| [101802] Apache KNOX up to 0.11.0 WebHDFS privilege escalation
12069| [101928] HPE Aruba ClearPass Apache Tomcat information disclosure
12070| [101524] Apache Archiva up to 1.x/2.2.1 REST Endpoint cross site request forgery
12071| [101513] Apache jUDDI 3.1.2/3.1.3/3.1.4/3.1. Logout Open Redirect
12072| [101430] Apache CXF Fediz up to 1.3.1 OIDC Service cross site request forgery
12073| [101429] Apache CXF Fediz up to 1.2.3/1.3.1 Plugins cross site request forgery
12074| [100619] Apache Hadoop up to 2.6.x HDFS Servlet unknown vulnerability
12075| [100618] Apache Hadoop up to 2.7.0 HDFS Web UI cross site scripting
12076| [100621] Adobe ColdFusion 10/11/2016 Apache BlazeDS Library Deserialization privilege escalation
12077| [100205] Oracle MySQL Enterprise Monitor up to 3.1.6.8003/3.2.1182/3.3.2.1162 Apache Commons FileUpload denial of service
12078| [100191] Oracle Secure Global Desktop 4.71/5.2/5.3 Web Server (Apache HTTP Server) information disclosure
12079| [100162] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Commons Collections privilege escalation
12080| [100160] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Trinidad unknown vulnerability
12081| [99969] Oracle WebCenter Sites 11.1.1.8.0 Apache Tomcat memory corruption
12082| [99937] Apache Batik up to 1.8 privilege escalation
12083| [99936] Apache FOP up to 2.1 privilege escalation
12084| [99935] Apache CXF up to 3.0.12/3.1.10 STSClient Cache information disclosure
12085| [99934] Apache CXF up to 3.0.12/3.1.10 JAX-RS XML Security Streaming Client spoofing
12086| [99930] Apache Traffic Server up to 6.2.0 denial of service
12087| [99929] Apache Log4j up to 2.8.1 Socket Server Deserialization privilege escalation
12088| [99925] Apache Traffic Server 6.0.0/6.1.0/6.2.0 HPACK Bomb denial of service
12089| [99738] Ping Identity OpenID Connect Authentication Module up to 2.13 on Apache Mod_auth_openidc.c spoofing
12090| [117569] Apache Hadoop up to 2.7.3 privilege escalation
12091| [99591] Apache TomEE up to 1.7.3/7.0.0-M2 EjbObjectInputStream Serialized Object privilege escalation
12092| [99370] Apache Ignite up to 1.8 update-notifier Document XML External Entity
12093| [99299] Apache Geode up to 1.1.0 Pulse OQL Query privilege escalation
12094| [99572] Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 Application Listener privilege escalation
12095| [99570] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP Connector Cache information disclosure
12096| [99569] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP/2 GOAWAY Frame Resource Exhaustion denial of service
12097| [99568] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 Pipelined Request information disclosure
12098| [99048] Apache Ambari up to 2.3.x REST API Shell Metacharacter privilege escalation
12099| [99014] Apache Camel Jackson/JacksonXML privilege escalation
12100| [98610] Apple macOS up to 10.12.3 apache_mod_php memory corruption
12101| [98609] Apple macOS up to 10.12.3 apache_mod_php denial of service
12102| [98608] Apple macOS up to 10.12.3 apache_mod_php memory corruption
12103| [98607] Apple macOS up to 10.12.3 apache_mod_php denial of service
12104| [98606] Apple macOS up to 10.12.3 apache_mod_php denial of service
12105| [98605] Apple macOS up to 10.12.3 Apache denial of service
12106| [98604] Apple macOS up to 10.12.3 Apache denial of service
12107| [98603] Apple macOS up to 10.12.3 Apache denial of service
12108| [98602] Apple macOS up to 10.12.3 Apache denial of service
12109| [98601] Apple macOS up to 10.12.3 Apache denial of service
12110| [98517] Apache POI up to 3.14 OOXML File XXE denial of service
12111| [98405] Apache Hadoop up to 0.23.10 privilege escalation
12112| [98199] Apache Camel Validation XML External Entity
12113| [97892] Apache Tomcat up to 9.0.0.M15 Reverse-Proxy Http11InputBuffer.java information disclosure
12114| [97617] Apache Camel camel-snakeyaml Deserialization privilege escalation
12115| [97602] Apache Camel camel-jackson/camel-jacksonxml CamelJacksonUnmarshalType privilege escalation
12116| [97732] Apache Struts up to 2.3.31/2.5.10 Jakarta Multipart Parser Content-Type privilege escalation
12117| [97466] mod_auth_openidc up to 2.1.5 on Apache weak authentication
12118| [97455] mod_auth_openidc up to 2.1.4 on Apache weak authentication
12119| [97081] Apache Tomcat HTTPS Request denial of service
12120| [97162] EMC OpenText Documentum D2 BeanShell/Apache Commons privilege escalation
12121| [96949] Hanwha Techwin Smart Security Manager up to 1.5 Redis/Apache Felix Gogo privilege escalation
12122| [96314] Apache Cordova up to 6.1.1 on Android weak authentication
12123| [95945] Apple macOS up to 10.12.2 apache_mod_php denial of service
12124| [95944] Apple macOS up to 10.12.2 apache_mod_php denial of service
12125| [95943] Apple macOS up to 10.12.2 apache_mod_php memory corruption
12126| [95666] Oracle FLEXCUBE Direct Banking 12.0.0/12.0.1/12.0.2/12.0.3 Apache Commons Collections privilege escalation
12127| [95455] Apache NiFi up to 1.0.0/1.1.0 Connection Details Dialogue cross site scripting
12128| [95311] Apache storm UI Daemon privilege escalation
12129| [95291] ZoneMinder 1.30.0 Apache httpd privilege escalation
12130| [94800] Apache Wicket up to 1.5.16/6.24.x Deserialize DiskFileItem denial of service
12131| [94705] Apache Qpid Broker for Java up to 6.1.0 SCRAM-SHA-1/SCRAM-SHA-256 User information disclosure
12132| [94627] Apache HTTP Server up to 2.4.24 mod_auth_digest Crash denial of service
12133| [94626] Apache HTTP Server up to 2.4.24 mod_session_crypto Padding weak encryption
12134| [94625] Apache HTTP Server up to 2.4.24 Response Split privilege escalation
12135| [94540] Apache Tika 1.9 tika-server File information disclosure
12136| [94600] Apache ActiveMQ up to 5.14.1 Administration Console cross site scripting
12137| [94348] Apple macOS up to 10.12.1 apache_mod_php denial of service
12138| [94347] Apple macOS up to 10.12.1 apache_mod_php denial of service
12139| [94346] Apple macOS up to 10.12.1 apache_mod_php denial of service
12140| [94345] Apple macOS up to 10.12.1 apache_mod_php denial of service
12141| [94344] Apple macOS up to 10.12.1 apache_mod_php denial of service
12142| [94343] Apple macOS up to 10.12.1 apache_mod_php memory corruption
12143| [94342] Apple macOS up to 10.12.1 apache_mod_php memory corruption
12144| [94128] Apache Tomcat up to 9.0.0.M13 Error information disclosure
12145| [93958] Apache HTTP Server up to 2.4.23 mod_http2 h2_stream.c denial of service
12146| [93874] Apache Subversion up to 1.8.16/1.9.4 mod_dontdothat XXE denial of service
12147| [93855] Apache Hadoop up to 2.6.4/2.7.2 HDFS Service privilege escalation
12148| [93609] Apache OpenMeetings 3.1.0 RMI Registry privilege escalation
12149| [93555] Apache Tika 1.6-1.13 jmatio MATLAB File privilege escalation
12150| [93799] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
12151| [93798] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
12152| [93797] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 HTTP Split privilege escalation
12153| [93796] Apache Tomcat up to 8.5.6/9.0.0.M11 HTTP/2 Header Parser denial of service
12154| [93532] Apache Commons Collections Library Java privilege escalation
12155| [93210] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 ResourceLinkFactory privilege escalation
12156| [93209] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Realm Authentication User information disclosure
12157| [93208] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 System Property Replacement information disclosure
12158| [93207] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Utility Method privilege escalation
12159| [93206] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Configuration privilege escalation
12160| [93098] Apache Commons FileUpload privilege escalation
12161| [92987] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Commons Collection memory corruption
12162| [92986] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Tomcat memory corruption
12163| [92982] Oracle Insurance IStream 4.3.2 Apache Commons Collections memory corruption
12164| [92981] Oracle Financial Services Lending and Leasing 14.1.0/14.2.0 Apache Commons Collections memory corruption
12165| [92979] Oracle up to 8.0.3 Apache Commons Collections memory corruption
12166| [92977] Oracle FLEXCUBE Universal Banking up to 12.2.0 Apache Commons Collections memory corruption
12167| [92976] Oracle FLEXCUBE Universal Banking 12.87.1/12.87.2 Apache Commons Collections memory corruption
12168| [92975] Oracle FLEXCUBE Private Banking up to 12.1.0 Apache Commons Collections memory corruption
12169| [92974] Oracle FLEXCUBE Investor Servicing 12.0.1 Apache Commons Collections memory corruption
12170| [92973] Oracle 12.0.0/12.1.0 Apache Commons Collections memory corruption
12171| [92972] Oracle FLEXCUBE Core Banking 11.5.0.0.0/11.6.0.0.0 Apache Commons Collections memory corruption
12172| [92962] Oracle Agile PLM 9.3.4/9.3.5 Apache Commons Collections memory corruption
12173| [92909] Oracle Agile PLM 9.3.4/9.3.5 Apache Tomcat unknown vulnerability
12174| [92786] Oracle Banking Digital Experience 15.1 Apache Commons Collections information disclosure
12175| [92549] Apache Tomcat on Red Hat privilege escalation
12176| [92509] Apache Tomcat JK ISAPI Connector up to 1.2.41 jk_uri_worker_map.c memory corruption
12177| [92314] Apache MyFaces Trinidad up to 1.0.13/1.2.15/2.0.1/2.1.1 CoreResponseStateManager memory corruption
12178| [92313] Apache Struts2 up to 2.3.28/2.5.0 Action Name Cleanup cross site request forgery
12179| [92299] Apache Derby up to 10.12.1.0 SqlXmlUtil XML External Entity
12180| [92217] Apache ActiveMQ Artemis up to 1.3.x Broker/REST GetObject privilege escalation
12181| [92174] Apache Ranger up to 0.6.0 Policy cross site scripting
12182| [91831] Apache Jackrabbit up to 2.13.2 HTTP Header cross site request forgery
12183| [91825] Apache Zookeeper up to 3.4.8/3.5.2 C CLI Shell memory corruption
12184| [91818] Apache CXF Fediz up to 1.2.2/1.3.0 Application Plugin privilege escalation
12185| [92056] Apple macOS up to 10.11 apache_mod_php memory corruption
12186| [92055] Apple macOS up to 10.11 apache_mod_php memory corruption
12187| [92054] Apple macOS up to 10.11 apache_mod_php denial of service
12188| [92053] Apple macOS up to 10.11 apache_mod_php denial of service
12189| [92052] Apple macOS up to 10.11 apache_mod_php denial of service
12190| [92051] Apple macOS up to 10.11 apache_mod_php memory corruption
12191| [92050] Apple macOS up to 10.11 apache_mod_php denial of service
12192| [92049] Apple macOS up to 10.11 apache_mod_php memory corruption
12193| [92048] Apple macOS up to 10.11 apache_mod_php denial of service
12194| [92047] Apple macOS up to 10.11 apache_mod_php memory corruption
12195| [92046] Apple macOS up to 10.11 apache_mod_php memory corruption
12196| [92045] Apple macOS up to 10.11 apache_mod_php memory corruption
12197| [92044] Apple macOS up to 10.11 apache_mod_php memory corruption
12198| [92043] Apple macOS up to 10.11 apache_mod_php denial of service
12199| [92042] Apple macOS up to 10.11 apache_mod_php memory corruption
12200| [92041] Apple macOS up to 10.11 apache_mod_php memory corruption
12201| [92040] Apple macOS up to 10.11 Apache Proxy privilege escalation
12202| [91785] Apache Shiro up to 1.3.1 Servlet Filter privilege escalation
12203| [90879] Apache OpenMeetings up to 3.1.1 SWF Panel cross site scripting
12204| [90878] Apache Sentry up to 1.6.x Blacklist Filter reflect/reflect2/java_method privilege escalation
12205| [90610] Apache POI up to 3.13 XLSX2CSV Example OpenXML Document XML External Entity
12206| [90584] Apache ActiveMQ up to 5.11.3/5.12.2/5.13/1 Administration Web Console privilege escalation
12207| [90385] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site scripting
12208| [90384] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site request forgery
12209| [90383] Apache OpenOffice up to 4.1.2 Impress File memory corruption
12210| [89670] Apache Tomcat up to 8.5.4 CGI Servlet Environment Variable Open Redirect
12211| [89669] Apache HTTP Server up to 2.4.23 RFC 3875 Namespace Conflict Environment Variable Open Redirect
12212| [89726] Apple Mac OS X up to 10.11.5 apache_mod_php memory corruption
12213| [89484] Apache Qpid up to 0.13.0 on Windows Proton Library Certificate weak authentication
12214| [89473] HPE iMC PLAT/EAD/APM/iMC NTA/iMC BIMS/iMC UAM_TAM up to 7.2 Apache Commons Collections Library Command privilege escalation
12215| [90263] Apache Archiva Header denial of service
12216| [90262] Apache Archiva Deserialize privilege escalation
12217| [90261] Apache Archiva XML DTD Connection privilege escalation
12218| [88827] Apache Xerces-C++ up to 3.1.3 DTD Stack-Based memory corruption
12219| [88747] Apache HTTP Server 2.4.17/2.4.18 mod_http2 denial of service
12220| [88608] Apache Struts up to 2.3.28.1/2.5.0 URLValidator Null Value denial of service
12221| [88607] Apache Struts up to 2.3.28.1 REST Plugin Expression privilege escalation
12222| [88606] Apache Struts up to 2.3.28.1 Restriction privilege escalation
12223| [88605] Apache Struts up to 2.3.28.1 Restriction privilege escalation
12224| [88604] Apache Struts up to 2.3.28.1 Token Validator cross site request forgery
12225| [88603] Apache Commons FileUpload up to 1.3.1 MultipartStream denial of service
12226| [88602] Apache Struts up to 1.3.10 ActionServlet.java cross site scripting
12227| [88601] Apache Struts up to 1.3.10 Multithreading ActionServlet.java memory corruption
12228| [88600] Apache Struts up to 1.3.10 MultiPageValidator privilege escalation
12229| [89005] Apache Qpid AMQP JMS Client getObject privilege escalation
12230| [87888] Apache Ranger up to 0.5.2 Policy Admin Tool eventTime sql injection
12231| [87835] Apache CloudStack up to 4.5.2.0/4.6.2.0/4.7.1.0/4.8.0.0 SAML-based Authentication privilege escalation
12232| [87806] HPE Discovery and Dependency Mapping Inventory up to 9.32 update 3 Apache Commons Collections Library privilege escalation
12233| [87805] HPE Universal CMDB up to 10.21 Apache Commons Collections Library privilege escalation
12234| [87768] Apache Shiro up to 1.2.4 Cipher Key privilege escalation
12235| [87765] Apache James Server 2.3.2 Command privilege escalation
12236| [88667] Apache HTTP Server up to 2.4.20 mod_http2 Certificate weak authentication
12237| [87718] Apache Struts up to 2.3.24.1 OGNL Caching denial of service
12238| [87717] Apache Struts up to 2.3.28 REST Plugin privilege escalation
12239| [87706] Apache Qpid Java up to 6.0.2 AMQP privilege escalation
12240| [87703] Apache Qbid Java up to 6.0.2 PlainSaslServer.java denial of service
12241| [87702] Apache ActiveMQ up to 5.13.x Fileserver Web Application Upload privilege escalation
12242| [87700] Apache PDFbox up to 1.8.11/2.0.0 XML Parser PDF Document XML External Entity
12243| [87679] HP Release Control 9.13/9.20/9.21 Apache Commons Collections Library Java Object privilege escalation
12244| [87540] Apache Ambari up to 2.2.0 File Browser View information disclosure
12245| [87433] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
12246| [87432] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
12247| [87431] Apple Mac OS X up to 10.11.4 apache_mod_php Format String
12248| [87430] Apple Mac OS X up to 10.11.4 apache_mod_php denial of service
12249| [87429] Apple Mac OS X up to 10.11.4 apache_mod_php information disclosure
12250| [87428] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
12251| [87427] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
12252| [87389] Apache Xerces C++ up to 3.1.3 XML Document DTDScanner.cpp memory corruption
12253| [87172] Adobe ColdFusion up to 10 Update 18/11 Update 7/2016 Apache Commons Collections Library privilege escalation
12254| [87121] Apache Cordova iOS up to 3.x Plugin privilege escalation
12255| [87120] Apache Cordova iOS up to 3.x URL Whitelist privilege escalation
12256| [83806] HPE Network Node Manager i up to 10.01 Apache Commons Collections Library privilege escalation
12257| [83077] Apache Subversion up to 1.8.15/1.9.3 mod_authz_svn mod_authz_svn.c denial of service
12258| [83076] Apache Subversion up to 1.8.15/1.9.3 svnserve svnserve/cyrus_auth.c privilege escalation
12259| [82790] Apache Struts 2.0.0/2.3.24/2.3.28 Dynamic Method privilege escalation
12260| [82789] Apache Struts 2.0.0/2.3.24/2.3.28 XSLTResult privilege escalation
12261| [82725] HPE P9000 Command View up to 7.x/8.4.0 Apache Commons Collections Library privilege escalation
12262| [82444] Apache Camel up to 2.14.x/2.15.4/2.16.0 HTTP Request privilege escalation
12263| [82389] Apache Subversion up to 1.7.x/1.8.14/1.9.2 mod_dav_svn util.c memory corruption
12264| [82280] Apache Struts up to 1.7 JRE URLDecoder cross site scripting
12265| [82260] Apache OFBiz up to 12.04.05/13.07.02 Java Object privilege escalation
12266| [82259] Apache Qpid Proton up to 0.12.0 proton.reactor.Connector weak encryption
12267| [82250] Apache Ranger up to 0.5.0 Admin UI weak authentication
12268| [82214] Apache Wicket up to 1.5.14/6.21.x/7.1.x Input Element cross site scripting
12269| [82213] Apache Wicket up to 1.5.14/6.21.x/7.1.x ModalWindow Title getWindowOpenJavaScript cross site scripting
12270| [82212] Apache Ranger up to 0.5.0 Policy Admin Tool privilege escalation
12271| [82211] Apache OFBiz up to 12.04.06/13.07.02 ModelFormField.java DisplayEntityField.getDescription cross site scripting
12272| [82082] Apache JetSpeed up to 2.3.0 User Manager Service privilege escalation
12273| [82081] Apache OpenMeetings up to 3.1.0 SOAP API information disclosure
12274| [82080] Apache OpenMeetings up to 3.1.0 Event cross site scripting
12275| [82078] Apache OpenMeetings up to 3.1.0 Import/Export System Backup ZIP Archive directory traversal
12276| [82077] Apache OpenMeetings up to 3.1.0 Password Reset sendHashByUser privilege escalation
12277| [82076] Apache Ranger up to 0.5.1 privilege escalation
12278| [82075] Apache JetSpeed up to 2.3.0 Portal cross site scripting
12279| [82074] Apache JetSpeed up to 2.3.0 cross site scripting
12280| [82073] Apache JetSpeed up to 2.3.0 User Manager Service sql injection
12281| [82072] Apache JetSpeed up to 2.3.0 Portal Site Manager ZIP Archive directory traversal
12282| [82058] Apache LDAP Studio/Directory Studio up to 2.0.0-M9 CSV Export privilege escalation
12283| [82053] Apache Ranger up to 0.4.x Policy Admin Tool privilege escalation
12284| [82052] Apache Ranger up to 0.4.x Policy Admin Tool HTTP Request cross site scripting
12285| [81696] Apache ActiveMQ up to 5.13.1 HTTP Header privilege escalation
12286| [81695] Apache Xerces-C up to 3.1.2 internal/XMLReader.cpp memory corruption
12287| [81622] HPE Asset Manager 9.40/9.41/9.50 Apache Commons Collections Library Java Object privilege escalation
12288| [81406] HPE Service Manager up to 9.35 P3/9.41 P1 Apache Commons Collections Library Command privilege escalation
12289| [81405] HPE Operations Orchestration up to 10.50 Apache Commons Collections Library Command privilege escalation
12290| [81427] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
12291| [81426] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
12292| [81372] Apache Struts up to 2.3.24.1 I18NInterceptor cross site scripting
12293| [81371] Apache Struts up to 2.3.24.1 Double OGNL Evaluation privilege escalation
12294| [81370] Apache Struts up to 2.3.24.1 Java URLDecoder cross site scripting
12295| [81084] Apache Tomcat 6.0/7.0/8.0/9.0 ServletContext directory traversal
12296| [81083] Apache Tomcat 7.0/8.0/9.0 Index Page cross site request forgery
12297| [81082] Apache Tomcat 7.0/8.0/9.0 ResourceLinkFactory.setGlobalContext privilege escalation
12298| [81081] Apache Tomcat 6.0/7.0/8.0/9.0 Error information disclosure
12299| [81080] Apache Tomcat 6.0/7.0/8.0/9.0 Session Persistence privilege escalation
12300| [81079] Apache Tomcat 6.0/7.0/8.0/9.0 StatusManagerServlet information disclosure
12301| [81078] Apache Tomcat 7.0/8.0/9.0 Session privilege escalation
12302| [80970] Apache Solr up to 5.3.0 Admin UI plugins.js cross site scripting
12303| [80969] Apache Solr up to 5.2 Schema schema-browser.js cross site scripting
12304| [80968] Apache Solr up to 5.0 analysis.js cross site scripting
12305| [80940] HP Continuous Delivery Automation 1.30 Apache Commons Collections Library privilege escalation
12306| [80823] Apache CloudStack up to 4.5.1 KVM Virtual Machine Migration privilege escalation
12307| [80822] Apache CloudStack up to 4.5.1 API Call information disclosure
12308| [80778] Apache Camel up to 2.15.4/2.16.0 camel-xstream privilege escalation
12309| [80750] HPE Operations Manager 8.x/9.0 on Windows Apache Commons Collections Library privilege escalation
12310| [80724] Apache Hive up to 1.2.1 Authorization Framework privilege escalation
12311| [80577] Oracle Secure Global Desktop 4.63/4.71/5.2 Apache HTTP Server denial of service
12312| [80165] Intel McAfee ePolicy Orchestrator up to 4.6.9/5.0.3/5.3.1 Apache Commons Collections Library privilege escalation
12313| [80116] Apache Subversion up to 1.9.2 svn Protocol libsvn_ra_svn/marshal.c read_string memory corruption
12314| [80115] Apache ActiveMQ up to 5.12.x Broker Service privilege escalation
12315| [80036] IBM Cognos Business Intelligence Apache Commons Collections Library InvokerTransformer privilege escalation
12316| [79873] VMware vCenter Operations/vRealize Orchestrator Apache Commons Collections Library Serialized Java Object privilege escalation
12317| [79840] Apache Cordova File Transfer Plugin up to 1.2.x on Android unknown vulnerability
12318| [79839] Apache TomEE Serialized Java Stream EjbObjectInputStream privilege escalation
12319| [79791] Cisco Products Apache Commons Collections Library privilege escalation
12320| [79539] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
12321| [79538] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
12322| [79294] Apache Cordova-Android up to 3.6 BridgeSecret Random Generator weak encryption
12323| [79291] Apache Cordova-Android up to 4.0 Javascript Whitelist privilege escalation
12324| [79244] Apache CXF up to 2.7.17/3.0.7/3.1.2 SAML Web SSO Module SAML Response weak authentication
12325| [79243] Oracle WebLogic Server 10.3.6.0/12.1.2.0/12.1.3.0/12.2.1.0 WLS Security com.bea.core.apache.commons.collections.jar privilege escalation
12326| [78989] Apache Ambari up to 2.1.1 Open Redirect
12327| [78988] Apache Ambari up to 2.0.1/2.1.0 Password privilege escalation
12328| [78987] Apache Ambari up to 2.0.x cross site scripting
12329| [78986] Apache Ambari up to 2.0.x Proxy Endpoint api/v1/proxy privilege escalation
12330| [78780] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
12331| [78779] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
12332| [78778] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
12333| [78777] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
12334| [78776] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
12335| [78775] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
12336| [78774] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
12337| [78297] Apache Commons Components HttpClient up to 4.3.5 HTTPS Timeout denial of service
12338| [77406] Apache Flex BlazeDS AMF Message XML External Entity
12339| [77429] Apache ActiveMQ up to 5.10.0 LDAPLoginModule privilege escalation
12340| [77399] Apache ActiveMQ up to 5.10.0 LDAPLoginModule weak authentication
12341| [77375] Apache Tapestry up to 5.3.5 Client-Side Object Storage privilege escalation
12342| [77331] Apache ActiveMQ up to 5.11.1 on Windows Fileserver Upload/Download directory traversal
12343| [77299] Apache Solr Real-Time Module up to 7.x-1.1 Index Content information disclosure
12344| [77247] Apache ActiveMQ up to 5.10 TransportConnection.java processControlCommand denial of service
12345| [77083] Apache Groovy up to 2.4.3 MethodClosure.java MethodClosure memory corruption
12346| [76953] Apache Subversion 1.7.0/1.8.0/1.8.10 svn_repos_trace_node_locations information disclosure
12347| [76952] Apache Subversion 1.7.0/1.8.0/1.8.10 mod_authz_svn anonymous/authenticated information disclosure
12348| [76567] Apache Struts 2.3.20 unknown vulnerability
12349| [76733] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 ap_some_auth_required unknown vulnerability
12350| [76732] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 Request apr_brigade_flatten privilege escalation
12351| [76731] Apache HTTP Server 2.4.12 ErrorDocument 400 Crash denial of service
12352| [75690] Apache Camel up to 2.13.3/2.14.1 XPathBuilder.java XML External Entity
12353| [75689] Apache Camel up to 2.13.3/2.14.1 XML Converter Setup XmlConverter.java SAXSource privilege escalation
12354| [75668] Apache Sling API/Sling Servlets Post up to 2.2.1 HtmlResponse cross site scripting
12355| [75601] Apache Jackrabbit up to 2.10.0 WebDAV Request XML External Entity
12356| [75420] Apache Tomcat up to 6.0.43/7.0.58/8.0.16 Security Manager privilege escalation
12357| [75145] Apache OpenOffice up to 4.1.1 HWP Filter Crash denial of service
12358| [75032] Apache Tomcat Connectors up to 1.2.40 mod_jk privilege escalation
12359| [75135] PHP 5.4/5.5 HTTP Request sapi_apache2.c apache2handler privilege escalation
12360| [74793] Apache Tomcat File Upload denial of service
12361| [74708] Apple MacOS X up to 10.10.2 Apache denial of service
12362| [74707] Apple MacOS X up to 10.10.2 Apache denial of service
12363| [74706] Apple MacOS X up to 10.10.2 Apache memory corruption
12364| [74705] Apple MacOS X up to 10.10.2 Apache denial of service
12365| [74704] Apple MacOS X up to 10.10.2 Apache denial of service
12366| [74703] Apple MacOS X up to 10.10.2 Apache denial of service
12367| [74702] Apple MacOS X up to 10.10.2 Apache denial of service
12368| [74701] Apple MacOS X up to 10.10.2 Apache cross site request forgery
12369| [74700] Apple MacOS X up to 10.10.2 Apache unknown vulnerability
12370| [74661] Apache Flex up to 4.14.0 asdoc index.html cross site scripting
12371| [74609] Apache Cassandra up to 1.2.19/2.0.13/2.1.3 JMX/RMI Interface privilege escalation
12372| [74469] Apache Xerces-C up to 7.0 internal/XMLReader.cpp denial of service
12373| [74468] Apache Batik up to 1.6 denial of service
12374| [74414] Apache Mod-gnutls up to 0.5.1 Authentication spoofing
12375| [74371] Apache Standard Taglibs up to 1.2.0 memory corruption
12376| [74367] Apache HTTP Server up to 2.4.12 mod_lua lua_request.c wsupgrade denial of service
12377| [74174] Apache WSS4J up to 2.0.0 privilege escalation
12378| [74172] Apache ActiveMQ up to 5.5.0 Administration Console cross site scripting
12379| [69092] Apache Tomcat up to 6.0.42/7.0.54/8.0.8 HTTP Request Smuggling privilege escalation
12380| [73831] Apache Qpid up to 0.30 Access Restriction unknown vulnerability
12381| [73731] Apache XML Security unknown vulnerability
12382| [68660] Oracle BI Publisher 10.1.3.4.2/11.1.1.7 Apache Tomcat cross site scripting
12383| [73659] Apache CloudStack up to 4.3.0 Stack-Based unknown vulnerability
12384| [73593] Apache Traffic Server up to 5.1.0 denial of service
12385| [73511] Apache POI up to 3.10 Deadlock denial of service
12386| [73510] Apache Solr up to 4.3.0 cross site scripting
12387| [68447] Apache Subversion up to 1.7.18/1.8.10 mod_dav_svn Crash denial of service
12388| [68446] Apache Subversion up to 1.7.18/1.8.10 REPORT Request Crash denial of service
12389| [73173] Apache CloudStack Stack-Based unknown vulnerability
12390| [68357] Apache Struts up to 2.3.16.3 Random Number Generator cross site request forgery
12391| [73106] Apache Hadoop up to 2.4.0 Symlink privilege escalation
12392| [68575] Apache HTTP Server up to 2.4.10 LuaAuthzProvider mod_lua.c privilege escalation
12393| [72890] Apache Qpid 0.30 unknown vulnerability
12394| [72887] Apache Hive 0.13.0 File Permission privilege escalation
12395| [72878] Apache Cordova 3.5.0 cross site request forgery
12396| [72877] Apache Cordova 3.5.0 cross site request forgery
12397| [72876] Apache Cordova 3.5.0 cross site request forgery
12398| [68435] Apache HTTP Server 2.4.10 mod_proxy_fcgi.c handle_headers denial of service
12399| [68065] Apache CXF up to 3.0.1 JAX-RS SAML denial of service
12400| [68064] Apache CXF up to 3.0.0 SAML Token denial of service
12401| [67913] Oracle Retail Markdown Optimization 12.0/13.0/13.1/13.2/13.4 Apache commons-beanutils-1.8.0.jar memory corruption
12402| [67912] Oracle Retail Invoice Matching up to 14.0 Apache commons-beanutils-1.8.0.jar memory corruption
12403| [67911] Oracle Retail Clearance Optimization Engine 13.3/13.4/14.0 Apache commons-beanutils-1.8.0.jar memory corruption
12404| [67910] Oracle Retail Allocation up to 13.2 Apache commons-beanutils-1.8.0.jar memory corruption
12405| [71835] Apache Shiro 1.0.0/1.1.0/1.2.0/1.2.1/1.2.2 unknown vulnerability
12406| [71633] Apachefriends XAMPP 1.8.1 cross site scripting
12407| [71629] Apache Axis2/C spoofing
12408| [67633] Apple Mac OS X up to 10.9.4 apache_mod_php ext/standard/dns.c dns_get_record memory corruption
12409| [67631] Apple Mac OS X up to 10.9.4 apache_mod_php Symlink memory corruption
12410| [67630] Apple Mac OS X up to 10.9.4 apache_mod_php cdf_read_property_info denial of service
12411| [67629] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_count_chain denial of service
12412| [67628] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_check_stream_offset denial of service
12413| [67627] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c mconvert memory corruption
12414| [67626] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c denial of service
12415| [67625] Apple Mac OS X up to 10.9.4 apache_mod_php Crash denial of service
12416| [67624] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_property_info denial of service
12417| [67623] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_unpack_summary_info denial of service
12418| [67622] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_short_sector denial of service
12419| [67620] Apple Mac OS X up to 10.9.4 apache_mod_php magic/Magdir/commands denial of service
12420| [67790] Apache HTTP Server mod_cache NULL Pointer Dereference denial of service
12421| [67522] Apache Tomcat up to 7.0.39 JSP Upload privilege escalation
12422| [70809] Apache POI up to 3.11 Crash denial of service
12423| [70808] Apache POI up to 3.10 unknown vulnerability
12424| [70806] Apache Commons-httpclient 4.2/4.2.1/4.2.2 spoofing
12425| [70749] Apache Axis up to 1.4 getCN spoofing
12426| [70701] Apache Traffic Server up to 3.3.5 denial of service
12427| [70700] Apache OFBiz up to 12.04.03 cross site scripting
12428| [67402] Apache OpenOffice 4.0.0/4.0.1/4.1.0 Calc privilege escalation
12429| [67401] Apache OpenOffice up to 4.1.0 OLE Object information disclosure
12430| [70661] Apache Subversion up to 1.6.17 denial of service
12431| [70660] Apache Subversion up to 1.6.17 spoofing
12432| [70659] Apache Subversion up to 1.6.17 spoofing
12433| [67183] Apache HTTP Server up to 2.4.9 mod_proxy denial of service
12434| [67180] Apache HTTP Server up to 2.4.9 WinNT MPM Memory Leak denial of service
12435| [67185] Apache HTTP Server up to 2.4.9 mod_status Heap-Based memory corruption
12436| [67184] Apache HTTP Server 2.4.5/2.4.6 mod_cache NULL Pointer Dereference denial of service
12437| [67182] Apache HTTP Server up to 2.4.9 mod_deflate Memory Consumption denial of service
12438| [67181] Apache HTTP Server up to 2.4.9 mod_cgid denial of service
12439| [70338] Apache Syncope up to 1.1.7 unknown vulnerability
12440| [70295] Apache CXF up to 2.7.9 Cleartext information disclosure
12441| [70106] Apache Open For Business Project up to 10.04.0 getServerError cross site scripting
12442| [70105] Apache MyFaces up to 2.1.5 JavaServer Faces directory traversal
12443| [69846] Apache HBase up to 0.94.8 information disclosure
12444| [69783] Apache CouchDB up to 1.2.0 memory corruption
12445| [13383] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 XML Parser privilege escalation
12446| [13300] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi setuid() privilege escalation
12447| [13299] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi Content-Type Header information disclosure
12448| [13164] Apache CXF up to 2.6.13/2.7.10 SOAP OutgoingChainInterceptor.java Invalid Content denial of service
12449| [13163] Apache CXF up to 2.6.13/2.7.10 SOAP HTML Content denial of service
12450| [13158] Apache Struts up to 2.3.16.2 ParametersInterceptor getClass privilege escalation
12451| [69515] Apache Struts up to 2.3.15.0 CookieInterceptor memory corruption
12452| [13086] Apache Struts up to 1.3.10 Class Loader privilege escalation
12453| [13067] Apache Struts up to 2.3.16.1 Class Loader privilege escalation
12454| [69431] Apache Archiva up to 1.3.6 cross site scripting
12455| [69385] Apache Syncope up to 1.1.6 unknown vulnerability
12456| [69338] Apache Xalan-Java up to 2.7.1 system-property unknown vulnerability
12457| [12742] Trustwave ModSecurity up to 2.7.5 Chunk Extension apache2/modsecurity.c modsecurity_tx_init() privilege escalation
12458| [12741] Trustwave ModSecurity up to 2.7.6 Chunked HTTP Transfer apache2/modsecurity.c modsecurity_tx_init Trailing Header privilege escalation
12459| [13387] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Content-Length Header privilege escalation
12460| [13386] Apache Tomcat Security Manager up to 6.0.39/7.0.53/8.0.5 XSLT privilege escalation
12461| [13385] Apache Tomcat 8.0.0/8.0.1/8.0.3 AJP Request Zero Length denial of service
12462| [13384] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Chunked HTTP Request denial of service
12463| [12748] Apache CouchDB 1.5.0 UUIDS /_uuids denial of service
12464| [66739] Apache Camel up to 2.12.2 unknown vulnerability
12465| [66738] Apache Camel up to 2.12.2 unknown vulnerability
12466| [12667] Apache HTTP Server 2.4.7 mod_log_config.c log_cookie denial of service
12467| [66695] Apache CouchDB up to 1.2.0 cross site scripting
12468| [66694] Apache CouchDB up to 1.2.0 Partition partition2 directory traversal
12469| [66689] Apache HTTP Server up to 2.0.33 mod_dav dav_xml_get_cdata denial of service
12470| [12518] Apache Tomcat up to 6.0.38/7.0.49/8.0.0-RC9 HTTP Header denial of service
12471| [66498] Apache expressions up to 3.3.0 Whitelist unknown vulnerability
12472| [12781] Apache Struts up to 2.3.8 ParametersInterceptor getClass denial of service
12473| [12439] Apache Tomcat 6.0.33 XML XXE information disclosure
12474| [12438] Apache Tomcat 6.0.33/6.0.34/6.0.35/6.0.36/6.0.37 coyoteadapter.java disableURLRewriting privilege escalation
12475| [66356] Apache Wicket up to 6.8.0 information disclosure
12476| [12209] Apache Tomcat 8.0.0-RC1/8.0.1/7.0.0/7.0.50 Content-Type Header for Multi-Part Request Infinite Loop denial of service
12477| [66322] Apache ActiveMQ up to 5.8.0 cross site scripting
12478| [12291] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
12479| [66255] Apache Open For Business Project up to 10.04.3 cross site scripting
12480| [66200] Apache Hadoop up to 2.0.5 Security Feature information disclosure
12481| [66072] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
12482| [66068] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
12483| [11928] Oracle Secure Global Desktop up to 4.71 Apache Tomcat unknown vulnerability
12484| [11924] Oracle Secure Global Desktop up to 4.63 Apache Tomcat denial of service
12485| [11922] Oracle Secure Global Desktop up to 4.63 Apache Tomcat unknown vulnerability
12486| [66049] Apache XML Security for Java up to 1.4.6 Memory Consumption denial of service
12487| [12199] Apache Subversion up to 1.8.5 mod_dav_svn/repos.c get_resource denial of service
12488| [65946] askapache Firefox Adsense up to 3.0 askapache-firefox-adsense.php cross site request forgery
12489| [65668] Apache Solr 4.0.0 Updater denial of service
12490| [65665] Apache Solr up to 4.3.0 denial of service
12491| [65664] Apache Solr 3.6.0/3.6.1/3.6.2/4.0.0 Updater denial of service
12492| [65663] Apache Solr up to 4.5.1 ResourceLoader directory traversal
12493| [65658] Apache roller 4.0/4.0.1/5.0/5.0.1 unknown vulnerability
12494| [65657] Apache Roller 4.0/4.0.1/5.0/5.0.1 cross site scripting
12495| [11325] Apache Subversion 1.7.13 mod_dontdothat Bypass denial of service
12496| [11324] Apache Subversion up to 1.8.4 mod_dav_svn denial of service
12497| [11098] Apache Tomcat 5.5.25 HTTP Request cross site request forgery
12498| [65410] Apache Struts 2.3.15.3 cross site scripting
12499| [65386] Apache Solr up to 2.2.1 on TYPO3 cross site scripting
12500| [65385] Apache Solr up to 2.2.1 on TYPO3 unknown vulnerability
12501| [11044] Apache Struts 2.3.15.3 showConfig.action cross site scripting
12502| [11043] Apache Struts 2.3.15.3 actionNames.action cross site scripting
12503| [11018] cPanel WHM up to 11.40.0.11 Apache mod_userdir Tweak Interface privilege escalation
12504| [65342] Apache Sling 1.0.2/1.0.4/1.0.6/1.1.0/1.1.2 Auth Core cross site scripting
12505| [65340] Apache Shindig 2.5.0 information disclosure
12506| [65316] Apache Mod Fcgid up to 2.3.7 mod_fcgid fcgid_bucket.c fcgid_header_bucket_read memory corruption
12507| [65313] Apache Sling 2.2.0/2.3.0 AbstractCreateOperation.java deepGetOrCreateNode denial of service
12508| [10826] Apache Struts 2 File privilege escalation
12509| [65204] Apache Camel up to 2.10.1 unknown vulnerability
12510| [10460] Apache Struts 2.0.0/2.3.15.1 Action Mapping Mechanism Bypass privilege escalation
12511| [10459] Apache Struts 2.0.0/2.3.15 Dynamic Method Invocation unknown vulnerability
12512| [10160] Apache Subversion 1.8.0/1.8.1/1.8.2 svnwcsub.py handle_options race condition
12513| [10159] Apache Subversion up to 1.8.2 svnserve write_pid_file() race condition
12514| [10158] Apache Subversion 1.8.0/1.8.1/1.8.2 daemonize.py daemon::daemonize race condition
12515| [10157] Apache Subversion up to 1.8.1 FSFS Repository Symlink privilege escalation
12516| [64808] Fail2ban up to 0.8.9 apache-auth.conf denial of service
12517| [64760] Best Practical RT up to 4.0.12 Apache::Session::File information disclosure
12518| [64722] Apache XML Security for C++ Heap-based memory corruption
12519| [64719] Apache XML Security for C++ Heap-based memory corruption
12520| [64718] Apache XML Security for C++ verify denial of service
12521| [64717] Apache XML Security for C++ getURIBaseTXFM memory corruption
12522| [64716] Apache XML Security for C++ spoofing
12523| [64701] Apache CXF up to 2.7.3 XML Parser Memory Consumption denial of service
12524| [64700] Apache CloudStack up to 4.1.0 Stack-Based cross site scripting
12525| [64667] Apache Open For Business Project up to 10.04.04 unknown vulnerability
12526| [64666] Apache Open For Business Project up to 10.04.04 cross site scripting
12527| [9891] Apache HTTP Server 2.2.22 suEXEC Feature .htaccess information disclosure
12528| [64509] Apache ActiveMQ up to 5.8.0 scheduled.jsp cross site scripting
12529| [9826] Apache Subversion up to 1.8.0 mod_dav_svn denial of service
12530| [9683] Apache HTTP Server 2.4.5 mod_session_dbd denial of service
12531| [64485] Apache Struts up to 2.2.3.0 privilege escalation
12532| [9568] Apache Struts up to 2.3.15 DefaultActionMapper cross site request forgery
12533| [9567] Apache Struts up to 2.3.15 DefaultActionMapper memory corruption
12534| [64467] Apache Geronimo 3.0 memory corruption
12535| [64466] Apache OpenJPA up to 2.2.1 Serialization memory corruption
12536| [64457] Apache Struts up to 2.2.3.0 cross site scripting
12537| [64326] Alejandro Garza Apachesolr Autocomplete up to 7.x-1.1 cross site scripting
12538| [9184] Apache Qpid up to 0.20 SSL misconfiguration
12539| [8935] Apache Subversion up to 1.7.9 FSFS Format Repository denial of service
12540| [8934] Apache Subversion up to 1.7.9 Svnserve Server denial of service
12541| [8933] Apache Subversion up to 1.6.21 check-mime-type.pl svnlook memory corruption
12542| [8932] Apache Subversion up to 1.6.21 svn-keyword-check.pl svnlook changed memory corruption
12543| [9022] Apache Struts up to 2.3.14.2 OGNL Expression memory corruption
12544| [8873] Apache Struts 2.3.14 privilege escalation
12545| [8872] Apache Struts 2.3.14 privilege escalation
12546| [8746] Apache HTTP Server Log File Terminal Escape Sequence Filtering mod_rewrite.c do_rewritelog privilege escalation
12547| [8666] Apache Tomcat up to 7.0.32 AsyncListener information disclosure
12548| [8665] Apache Tomcat up to 7.0.29 Chunked Transfer Encoding Extension Size denial of service
12549| [8664] Apache Tomcat up to 7.0.32 FORM Authentication weak authentication
12550| [64075] Apache Subversion up to 1.7.7 mod_dav_svn Crash denial of service
12551| [64074] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
12552| [64073] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
12553| [64072] Apache Subversion up to 1.7.7 mod_dav_svn NULL Pointer Dereference denial of service
12554| [64071] Apache Subversion up to 1.7.8 mod_dav_svn Memory Consumption denial of service
12555| [8768] Apache Struts up to 2.3.14 on Mac EL and OGNL Interpreter memory corruption
12556| [64006] Apache ActiveMQ up to 5.7.0 denial of service
12557| [64005] Apache ActiveMQ up to 5.7.0 Default Configuration denial of service
12558| [64004] Apache ActiveMQ up to 5.7.0 PortfolioPublishServlet.java cross site scripting
12559| [8427] Apache Tomcat Session Transaction weak authentication
12560| [63960] Apache Maven 3.0.4 Default Configuration spoofing
12561| [63751] Apache qpid up to 0.20 qpid::framing::Buffer denial of service
12562| [63750] Apache qpid up to 0.20 checkAvailable denial of service
12563| [63749] Apache Qpid up to 0.20 Memory Consumption denial of service
12564| [63748] Apache Qpid up to 0.20 Default Configuration denial of service
12565| [63747] Apache Rave up to 0.20 User Account information disclosure
12566| [7889] Apache Subversion up to 1.6.17 mod_dav_svn/svn_fs_file_length() denial of service
12567| [63646] Apache HTTP Server up to 2.2.23/2.4.3 mod_proxy_balancer.c balancer_handler cross site scripting
12568| [7688] Apache CXF up to 2.7.1 WSS4JInterceptor Bypass weak authentication
12569| [7687] Apache CXF up to 2.7.2 Token weak authentication
12570| [63334] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
12571| [63299] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
12572| [7202] Apache HTTP Server 2.4.2 on Oracle Solaris ld_library_path cross site scripting
12573| [7075] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector NioEndpoint.java denial of service
12574| [7074] Apache Tomcat up to 6.0.35/7.0.29 FORM Authentication RealmBase.java weak authentication
12575| [7073] Apache Tomcat up to 6.0.35/7.0.31 CSRF Prevention Filter cross site request forgery
12576| [63090] Apache Tomcat up to 4.1.24 denial of service
12577| [63089] Apache HTTP Server up to 2.2.13 mod_proxy_ajp denial of service
12578| [62933] Apache Tomcat up to 5.5.0 Access Restriction unknown vulnerability
12579| [62929] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector Memory Consumption denial of service
12580| [62833] Apache CXF -/2.6.0 spoofing
12581| [62832] Apache Axis2 up to 1.6.2 spoofing
12582| [62831] Apache Axis up to 1.4 Java Message Service spoofing
12583| [62830] Apache Commons-httpclient 3.0 Payments spoofing
12584| [62826] Apache Libcloud up to 0.11.0 spoofing
12585| [62757] Apache Open For Business Project up to 10.04.0 unknown vulnerability
12586| [8830] Red Hat JBoss Enterprise Application Platform 6.0.1 org.apache.catalina.connector.Response.encodeURL information disclosure
12587| [62661] Apache Axis2 unknown vulnerability
12588| [62658] Apache Axis2 unknown vulnerability
12589| [62467] Apache Qpid up to 0.17 denial of service
12590| [62417] Apache CXF 2.4.7/2.4.8/2.5.3/2.5.4/2.6.1 spoofing
12591| [6301] Apache HTTP Server mod_pagespeed cross site scripting
12592| [6300] Apache HTTP Server mod_pagespeed Hostname information disclosure
12593| [6123] Apache Wicket up to 1.5.7 Ajax Link cross site scripting
12594| [62035] Apache Struts up to 2.3.4 denial of service
12595| [61916] Apache QPID 0.14/0.16/0.5/0.6 unknown vulnerability
12596| [6998] Apache Tomcat 5.5.35/6.0.35/7.0.28 DIGEST Authentication Session State Caching privilege escalation
12597| [6997] Apache Tomcat 5.5.35/6.0.35/7.0.28 HTTP Digest Authentication Implementation privilege escalation
12598| [6092] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_ajp.c information disclosure
12599| [6090] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_http.c information disclosure
12600| [61507] Apache POI up to 3.8 UnhandledDataStructure denial of service
12601| [6070] Apache Struts up to 2.3.4 Token Name Configuration Parameter privilege escalation
12602| [6069] Apache Struts up to 2.3.4 Request Parameter OGNL Expression denial of service
12603| [5764] Oracle Solaris 10 Apache HTTP Server information disclosure
12604| [5700] Oracle Secure Backup 10.3.0.3/10.4.0.1 Apache denial of service
12605| [61255] Apache Hadoop 2.0.0 Kerberos unknown vulnerability
12606| [61229] Apache Sling up to 2.1.1 denial of service
12607| [61152] Apache Commons-compress 1.0/1.1/1.2/1.3/1.4 denial of service
12608| [61094] Apache Roller up to 5.0 cross site scripting
12609| [61093] Apache Roller up to 5.0 cross site request forgery
12610| [61005] Apache OpenOffice 3.3/3.4 unknown vulnerability
12611| [9673] Apache HTTP Server up to 2.4.4 mod_dav mod_dav.c Request denial of service
12612| [5436] Apache OpenOffice 3.3/3.4 WPXContentListener.cpp _closeTableRow() File memory corruption
12613| [5435] Apache OpenOffice 3.3/3.4 vclmi.dll File memory corruption
12614| [60730] PHP 5.4.0/5.4.1/5.4.2 apache_request_headers memory corruption
12615| [60708] Apache Qpid 0.12 unknown vulnerability
12616| [5032] Apache Hadoop up to 0.20.205.0/1.0.1/0.23.1 Kerberos/MapReduce Security Feature privilege escalation
12617| [4949] Apache Struts File Upload XSLTResult.java XSLT File privilege escalation
12618| [4955] Apache Traffic Server 3.0.3/3.1.2 HTTP Header Parser memory corruption
12619| [4882] Apache Wicket up to 1.5.4 directory traversal
12620| [4881] Apache Wicket up to 1.4.19 cross site scripting
12621| [4884] Apache HTTP Server up to 2.3.6 mod_fcgid fcgid_spawn_ctl.c FcgidMaxProcessesPerClass HTTP Requests denial of service
12622| [60352] Apache Struts up to 2.2.3 memory corruption
12623| [60153] Apache Portable Runtime up to 1.4.3 denial of service
12624| [4598] Apache Struts 1.3.10 upload-submit.do cross site scripting
12625| [4597] Apache Struts 1.3.10 processSimple.do cross site scripting
12626| [4596] Apache Struts 2.0.14/2.2.3 struts2-rest-showcase/orders cross site scripting
12627| [4595] Apache Struts 2.0.14/2.2.3 struts2-showcase/person/editPerson.action cross site scripting
12628| [4583] Apache HTTP Server up to 2.2.21 Threaded MPM denial of service
12629| [4582] Apache HTTP Server up to 2.2.21 protocol.c information disclosure
12630| [4571] Apache Struts up to 2.3.1.2 privilege escalation
12631| [4557] Apache Tomcat up to 7.0.21 Caching/Recycling information disclosure
12632| [59934] Apache Tomcat up to 6.0.9 DigestAuthenticator.java unknown vulnerability
12633| [59933] Apache Tomcat up to 6.0.9 Access Restriction unknown vulnerability
12634| [59932] Apache Tomcat up to 6.0.9 unknown vulnerability
12635| [59931] Apache Tomcat up to 6.0.9 Access Restriction information disclosure
12636| [59902] Apache Struts up to 2.2.3 Interfaces unknown vulnerability
12637| [4528] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
12638| [4527] Apache Struts up to 2.2.3 ExceptionDelegator cross site scripting
12639| [59888] Apache Tomcat up to 6.0.6 denial of service
12640| [59886] Apache ActiveMQ up to 5.5.1 Crash denial of service
12641| [4513] Apache Struts up to 2.3.1 ParameterInterceptor directory traversal
12642| [4512] Apache Struts up to 2.2.3 CookieInterceptor command injection
12643| [59850] Apache Geronimo up to 2.2.1 denial of service
12644| [59825] Apache HTTP Server up to 2.1.7 mod_reqtimeout denial of service
12645| [59556] Apache HTTP Server up to 2.0.53 mod_proxy information disclosure
12646| [58467] Apache libcloud 0.2.0/0.3.0/0.3.1/0.4.0 Access Restriction spoofing
12647| [58413] Apache Tomcat up to 6.0.10 spoofing
12648| [58381] Apache Wicket up to 1.4.17 cross site scripting
12649| [58296] Apache Tomcat up to 7.0.19 unknown vulnerability
12650| [57888] Apache HttpClient 4.0/4.0.1/4.1 Authorization information disclosure
12651| [57587] Apache Subversion up to 1.6.16 mod_dav_svn information disclosure
12652| [57585] Apache Subversion up to 1.6.16 mod_dav_svn Memory Consumption denial of service
12653| [57584] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
12654| [57577] Apache Rampart-C 1.3.0 Access Restriction rampart_timestamp_token_validate privilege escalation
12655| [57568] Apache Archiva up to 1.3.4 cross site scripting
12656| [57567] Apache Archiva up to 1.3.4 cross site request forgery
12657| [57481] Apache Tomcat 7.0.12/7.0.13 Access Restriction unknown vulnerability
12658| [4355] Apache HTTP Server APR apr_fnmatch denial of service
12659| [57435] Apache Struts up to 2.2.1.1 FileHandler.java cross site scripting
12660| [57425] Apache Struts up to 2.2.1.1 cross site scripting
12661| [4352] Apache HTTP Server 2.2.x APR apr_fnmatch denial of service
12662| [57025] Apache Tomcat up to 7.0.11 information disclosure
12663| [57024] Apache Tomcat 7.0.11 Access Restriction information disclosure
12664| [56774] IBM WebSphere Application Server up to 7.0.0.14 org.apache.jasper.runtime.JspWriterImpl.response denial of service
12665| [56824] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
12666| [56832] Apache Tomcat up to 7.0.10 Access Restriction information disclosure
12667| [56830] Apache Tomcat up to 7.0.9 Access Restriction privilege escalation
12668| [12440] Apache Tomcat 6.0.33 Malicious Request cross site scripting
12669| [56512] Apache Continuum up to 1.4.0 cross site scripting
12670| [4285] Apache Tomcat 5.x JVM getLocale() denial of service
12671| [4284] Apache Tomcat 5.x HTML Manager cross site scripting
12672| [4283] Apache Tomcat 5.x ServletContect privilege escalation
12673| [56441] Apache Tomcat up to 7.0.6 denial of service
12674| [56300] Apache CouchDB up to 1.0.1 Web Administration Interface cross site scripting
12675| [55967] Apache Subversion up to 1.6.4 rev_hunt.c denial of service
12676| [55966] Apache Subversion up to 1.6.4 mod_dav_svn repos.c walk denial of service
12677| [55095] Apache Axis2 up to 1.6 Default Password memory corruption
12678| [55631] Apache Archiva up to 1.3.1 User Account cross site request forgery
12679| [55556] Apache Tomcat up to 6.0.29 Default Configuration information disclosure
12680| [55553] Apache Tomcat up to 7.0.4 sessionsList.jsp cross site scripting
12681| [55162] Apache MyFaces up to 2.0.0 Authentication Code unknown vulnerability
12682| [54881] Apache Subversion up to 1.6.12 mod_dav_svn authz.c privilege escalation
12683| [54879] Apache APR-util up to 0.9.14 mod_reqtimeout apr_brigade_split_line denial of service
12684| [54693] Apache Traffic Server DNS Cache unknown vulnerability
12685| [54416] Apache CouchDB up to 0.11.0 cross site request forgery
12686| [54394] Apache CXF up to 2.2.8 Memory Consumption denial of service
12687| [54261] Apache Tomcat jsp/cal/cal2.jsp cross site scripting
12688| [54166] Apache HTTP Server up to 2.2.12 mod_cache Crash denial of service
12689| [54385] Apache Struts up to 2.1.8.1 ParameterInterceptor unknown vulnerability
12690| [54012] Apache Tomcat up to 6.0.10 denial of service
12691| [53763] Apache Axis2 1.3/1.4/1.4.1/1.5/1.5.1 Memory Consumption denial of service
12692| [53368] Apache MyFaces 1.1.7/1.2.8 cross site scripting
12693| [53397] Apache axis2 1.4.1/1.5.1 Administration Console cross site scripting
12694| [52894] Apache Tomcat up to 6.0.7 information disclosure
12695| [52960] Apache ActiveMQ up to 5.4-snapshot information disclosure
12696| [52843] Apache HTTP Server mod_auth_shadow unknown vulnerability
12697| [52786] Apache Open For Business Project up to 09.04 cross site scripting
12698| [52587] Apache ActiveMQ up to 5.3.0 cross site request forgery
12699| [52586] Apache ActiveMQ up to 5.3.0 cross site scripting
12700| [52584] Apache CouchDB up to 0.10.1 information disclosure
12701| [51757] Apache HTTP Server 2.0.44 cross site scripting
12702| [51756] Apache HTTP Server 2.0.44 spoofing
12703| [51717] Apache HTTP Server up to 1.3.3 mod_proxy ap_proxy_send_fb memory corruption
12704| [51690] Apache Tomcat up to 6.0 directory traversal
12705| [51689] Apache Tomcat up to 6.0 information disclosure
12706| [51688] Apache Tomcat up to 6.0 directory traversal
12707| [50886] HP Operations Manager 8.10 on Windows File Upload org.apache.catalina.manager.HTMLManagerServlet memory corruption
12708| [50802] Apache Tomcat up to 3.3 Default Password weak authentication
12709| [50626] Apache Solr 1.0.0 cross site scripting
12710| [49857] Apache HTTP Server mod_proxy_ftp cross site scripting
12711| [49856] Apache HTTP Server 2.2.13 mod_proxy_ftp ap_proxy_ftp_handler denial of service
12712| [49348] Apache Xerces-C++ 2.7.0 Stack-Based denial of service
12713| [86789] Apache Portable Runtime memory/unix/apr_pools.c unknown vulnerability
12714| [49283] Apache APR-util up to 1.3.8 apr-util misc/apr_rmm.c apr_rmm_realloc memory corruption
12715| [48952] Apache HTTP Server up to 1.3.6 mod_deflate denial of service
12716| [48626] Apache Tomcat up to 4.1.23 Access Restriction directory traversal
12717| [48431] Apache Tomcat up to 4.1.23 j_security_check cross site scripting
12718| [48430] Apache Tomcat up to 4.1.23 mod_jk denial of service
12719| [47801] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site request forgery
12720| [47800] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site scripting
12721| [47799] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console directory traversal
12722| [47648] Apache Tiles 2.1.0/2.1.1 cross site scripting
12723| [47640] Apache Struts 2.0.11/2.0.6/2.0.8/2.0.9/2.1 cross site scripting
12724| [47638] Apache Tomcat up to 4.1.23 mod_jk information disclosure
12725| [47636] Apache Struts 2.0.9 xip_client.html cross site scripting
12726| [47593] Apache Mod Perl 1 perl-status Apache::Status cross site scripting
12727| [47637] Apache Struts 1.0.2/1.1/1.2.4/1.2.7/1.2.8 cross site scripting
12728| [47239] Apache Struts up to 2.1.2 Beta struts directory traversal
12729| [47214] Apachefriends xampp 1.6.8 spoofing
12730| [47213] Apachefriends xampp 1.6.8 htaccess cross site request forgery
12731| [47162] Apachefriends XAMPP 1.4.4 weak authentication
12732| [47065] Apache Tomcat 4.1.23 cross site scripting
12733| [46834] Apache Tomcat up to 5.5.20 cross site scripting
12734| [46004] Apache Jackrabbit 1.4/1.5.0 search.jsp cross site scripting
12735| [49205] Apache Roller 2.3/3.0/3.1/4.0 Search cross site scripting
12736| [86625] Apache Struts directory traversal
12737| [44461] Apache Tomcat up to 5.5.0 information disclosure
12738| [44389] Apache Xerces-C++ XML Parser Memory Consumption denial of service
12739| [44352] Apache Friends XAMPP 1.6.8 adodb.php cross site scripting
12740| [43663] Apache Tomcat up to 6.0.16 directory traversal
12741| [43612] Apache Friends XAMPP 1.6.7 iart.php cross site scripting
12742| [43556] Apache HTTP Server up to 2.1.8 mod_proxy_ftp proxy_ftp.c cross site scripting
12743| [43516] Apache Tomcat up to 4.1.20 directory traversal
12744| [43509] Apache Tomcat up to 6.0.13 cross site scripting
12745| [42637] Apache Tomcat up to 6.0.16 cross site scripting
12746| [42325] Apache HTTP Server up to 2.1.8 Error Page cross site scripting
12747| [41838] Apache-SSL 1.3.34 1.57 expandcert privilege escalation
12748| [41091] Apache Software Foundation Mod Jk up to 2.0.1 mod_jk2 Stack-based memory corruption
12749| [40924] Apache Tomcat up to 6.0.15 information disclosure
12750| [40923] Apache Tomcat up to 6.0.15 unknown vulnerability
12751| [40922] Apache Tomcat up to 6.0 information disclosure
12752| [40710] Apache HTTP Server up to 2.0.61 mod_negotiation cross site scripting
12753| [40709] Apache HTTP Server up to 2.0.53 mod_negotiation cross site scripting
12754| [40656] Apache Tomcat 5.5.20 information disclosure
12755| [40503] Apache HTTP Server mod_proxy_ftp cross site scripting
12756| [40502] Apache HTTP Server up to 2.2.5 mod_proxy_balancer memory corruption
12757| [40501] Apache HTTP Server 2.2.6 mod_proxy_balancer cross site request forgery
12758| [40398] Apache HTTP Server up to 2.2 mod_proxy_balancer cross site scripting
12759| [40397] Apache HTTP Server up to 2.2 mod_proxy_balancer balancer_handler denial of service
12760| [40234] Apache Tomcat up to 6.0.15 directory traversal
12761| [40221] Apache HTTP Server 2.2.6 information disclosure
12762| [40027] David Castro Apache Authcas 0.4 sql injection
12763| [3495] Apache OpenOffice up to 2.3 Database Document Processor Designfehler
12764| [3489] Apache HTTP Server 2.x HTTP Header cross site scripting
12765| [3414] Apache Tomcat WebDAV Stored Umgehungs-Angriff
12766| [39489] Apache Jakarta Slide up to 2.1 directory traversal
12767| [39540] Apache Geronimo 2.0/2.0.1/2.0.2/2.1 unknown vulnerability
12768| [3310] Apache OpenOffice 1.1.3/2.0.4/2.2.1 TIFF Image Parser Heap-based memory corruption
12769| [38768] Apache HTTP Server up to 2.1.7 mod_autoindex.c cross site scripting
12770| [38952] Apache Geronimo 2.0.1/2.1 unknown vulnerability
12771| [38658] Apache Tomcat 4.1.31 cal2.jsp cross site request forgery
12772| [38524] Apache Geronimo 2.0 unknown vulnerability
12773| [3256] Apache Tomcat up to 6.0.13 cross site scripting
12774| [38331] Apache Tomcat 4.1.24 information disclosure
12775| [38330] Apache Tomcat 4.1.24 information disclosure
12776| [38185] Apache Tomcat 3.3/3.3.1/3.3.1a/3.3.2 Error Message CookieExample cross site scripting
12777| [37967] Apache Tomcat up to 4.1.36 Error Message sendmail.jsp cross site scripting
12778| [37647] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 Authorization unknown vulnerability
12779| [37646] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 unknown vulnerability
12780| [3141] Apache Tomcat up to 4.1.31 Accept-Language Header cross site scripting
12781| [3133] Apache Tomcat up to 6.0 HTTP cross site scripting
12782| [37292] Apache Tomcat up to 5.5.1 cross site scripting
12783| [3130] Apache OpenOffice 2.2.1 RTF Document Heap-based memory corruption
12784| [36981] Apache Tomcat JK Web Server Connector up to 1.2.22 mod_jk directory traversal
12785| [36892] Apache Tomcat up to 4.0.0 hello.jsp cross site scripting
12786| [37320] Apache MyFaces Tomahawk up to 1.1.4 cross site scripting
12787| [36697] Apache Tomcat up to 5.5.17 implicit-objects.jsp cross site scripting
12788| [36491] Apache Axis 1.0 Installation javaioFileNotFoundException information disclosure
12789| [36400] Apache Tomcat 5.5.15 mod_jk cross site scripting
12790| [36698] Apache Tomcat up to 4.0.0 cal2.jsp cross site scripting
12791| [36224] XAMPP Apache Distribution up to 1.6.0a adodb.php connect memory corruption
12792| [36225] XAMPP Apache Distribution 1.6.0a sql injection
12793| [2997] Apache httpd/Tomcat 5.5/6.0 directory traversal
12794| [35896] Apache Apache Test up to 1.29 mod_perl denial of service
12795| [35653] Avaya S8300 Cm 3.1.2 Apache Tomcat unknown vulnerability
12796| [35402] Apache Tomcat JK Web Server Connector 1.2.19 mod_jk.so map_uri_to_worker memory corruption
12797| [35067] Apache Stats up to 0.0.2 extract unknown vulnerability
12798| [35025] Apache Stats up to 0.0.3 extract unknown vulnerability
12799| [34252] Apache HTTP Server denial of service
12800| [2795] Apache OpenOffice 2.0.4 WMF/EMF File Heap-based memory corruption
12801| [33877] Apache Opentaps 0.9.3 cross site scripting
12802| [33876] Apache Open For Business Project unknown vulnerability
12803| [33875] Apache Open For Business Project cross site scripting
12804| [2703] Apache Jakarta Tomcat up to 5.x der_get_oid() memory corruption
12805| [2611] Apache HTTP Server up to 1.0.1 set_var Format String
12806| [31827] XMB Extreme Message Board up to 1.9.6 Apache HTTP Server memcp.php directory traversal
12807| [2452] Apache HTTP Server up to 2.2.3 on Windows mod_alias unknown vulnerability
12808| [31663] vbPortal Apache HTTP Server index.php directory traversal
12809| [2414] Apache HTTP Server up to 2.2.3 mod_rewrite memory corruption
12810| [2393] Apache HTTP Server up to 2.2.2 HTTP Header cross site scripting
12811| [30623] Apache James 2.2.0 SMTP Server denial of service
12812| [30176] PHP-Fusion up to 6.00.306 Apache HTTP Server .php.gif privilege escalation
12813|
12814| MITRE CVE - https://cve.mitre.org:
12815| [CVE-2013-4156] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.
12816| [CVE-2013-4131] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.
12817| [CVE-2013-3239] phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
12818| [CVE-2013-3060] The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
12819| [CVE-2013-2765] The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
12820| [CVE-2013-2251] Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
12821| [CVE-2013-2249] mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.
12822| [CVE-2013-2248] Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
12823| [CVE-2013-2189] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.
12824| [CVE-2013-2135] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
12825| [CVE-2013-2134] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
12826| [CVE-2013-2115] Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
12827| [CVE-2013-2071] java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
12828| [CVE-2013-2067] java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
12829| [CVE-2013-1966] Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
12830| [CVE-2013-1965] Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
12831| [CVE-2013-1896] mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
12832| [CVE-2013-1884] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
12833| [CVE-2013-1879] Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
12834| [CVE-2013-1862] mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
12835| [CVE-2013-1849] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
12836| [CVE-2013-1847] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
12837| [CVE-2013-1846] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
12838| [CVE-2013-1845] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
12839| [CVE-2013-1814] The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
12840| [CVE-2013-1777] The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not property implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
12841| [CVE-2013-1768] The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
12842| [CVE-2013-1088] Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
12843| [CVE-2013-1048] The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
12844| [CVE-2013-0966] The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI.
12845| [CVE-2013-0942] Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
12846| [CVE-2013-0941] EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
12847| [CVE-2013-0253] The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
12848| [CVE-2013-0248] The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
12849| [CVE-2013-0239] Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
12850| [CVE-2012-6573] Cross-site scripting (XSS) vulnerability in the Apache Solr Autocomplete module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving autocomplete results.
12851| [CVE-2012-6551] The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
12852| [CVE-2012-6092] Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
12853| [CVE-2012-5887] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
12854| [CVE-2012-5886] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
12855| [CVE-2012-5885] The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
12856| [CVE-2012-5786] The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
12857| [CVE-2012-5785] Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
12858| [CVE-2012-5784] Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
12859| [CVE-2012-5783] Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
12860| [CVE-2012-5633] The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
12861| [CVE-2012-5616] Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
12862| [CVE-2012-5568] Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
12863| [CVE-2012-5351] Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
12864| [CVE-2012-4558] Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
12865| [CVE-2012-4557] The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
12866| [CVE-2012-4556] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
12867| [CVE-2012-4555] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
12868| [CVE-2012-4534] org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
12869| [CVE-2012-4528] The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
12870| [CVE-2012-4501] Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
12871| [CVE-2012-4460] The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
12872| [CVE-2012-4459] Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
12873| [CVE-2012-4458] The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
12874| [CVE-2012-4446] The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
12875| [CVE-2012-4431] org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
12876| [CVE-2012-4418] Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
12877| [CVE-2012-4387] Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
12878| [CVE-2012-4386] The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
12879| [CVE-2012-4360] Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
12880| [CVE-2012-4063] The Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying XML Signature transforms to documents, which allows remote attackers to cause a denial of service via unspecified vectors.
12881| [CVE-2012-4001] The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.
12882| [CVE-2012-3908] Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
12883| [CVE-2012-3546] org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
12884| [CVE-2012-3544] Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
12885| [CVE-2012-3526] The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
12886| [CVE-2012-3513] munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
12887| [CVE-2012-3506] Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
12888| [CVE-2012-3502] The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
12889| [CVE-2012-3499] Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
12890| [CVE-2012-3467] Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
12891| [CVE-2012-3451] Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
12892| [CVE-2012-3446] Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
12893| [CVE-2012-3376] DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
12894| [CVE-2012-3373] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
12895| [CVE-2012-3126] Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Apache Tomcat Agent.
12896| [CVE-2012-3123] Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, related to Apache HTTP Server.
12897| [CVE-2012-2760] mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.
12898| [CVE-2012-2733] java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
12899| [CVE-2012-2687] Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
12900| [CVE-2012-2381] Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
12901| [CVE-2012-2380] Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.
12902| [CVE-2012-2379] Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
12903| [CVE-2012-2378] Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
12904| [CVE-2012-2329] Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
12905| [CVE-2012-2145] Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
12906| [CVE-2012-2138] The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
12907| [CVE-2012-2098] Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
12908| [CVE-2012-1574] The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
12909| [CVE-2012-1181] fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
12910| [CVE-2012-1089] Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.
12911| [CVE-2012-1007] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
12912| [CVE-2012-1006] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
12913| [CVE-2012-0883] envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
12914| [CVE-2012-0840] tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
12915| [CVE-2012-0838] Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
12916| [CVE-2012-0788] The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
12917| [CVE-2012-0394] ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
12918| [CVE-2012-0393] The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
12919| [CVE-2012-0392] The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
12920| [CVE-2012-0391] The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
12921| [CVE-2012-0256] Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
12922| [CVE-2012-0216] The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
12923| [CVE-2012-0213] The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
12924| [CVE-2012-0053] protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
12925| [CVE-2012-0047] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.
12926| [CVE-2012-0031] scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
12927| [CVE-2012-0022] Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
12928| [CVE-2012-0021] The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
12929| [CVE-2011-5064] DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
12930| [CVE-2011-5063] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
12931| [CVE-2011-5062] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
12932| [CVE-2011-5057] Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
12933| [CVE-2011-5034] Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
12934| [CVE-2011-4905] Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.
12935| [CVE-2011-4858] Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
12936| [CVE-2011-4668] IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
12937| [CVE-2011-4449] actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
12938| [CVE-2011-4415] The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
12939| [CVE-2011-4317] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
12940| [CVE-2011-3639] The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
12941| [CVE-2011-3620] Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
12942| [CVE-2011-3607] Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
12943| [CVE-2011-3376] org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
12944| [CVE-2011-3375] Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
12945| [CVE-2011-3368] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
12946| [CVE-2011-3348] The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
12947| [CVE-2011-3192] The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
12948| [CVE-2011-3190] Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
12949| [CVE-2011-2729] native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
12950| [CVE-2011-2712] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
12951| [CVE-2011-2688] SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
12952| [CVE-2011-2526] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
12953| [CVE-2011-2516] Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
12954| [CVE-2011-2481] Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
12955| [CVE-2011-2329] The rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart/C 1.3.0 does not properly calculate the expiration of timestamp tokens, which allows remote attackers to bypass intended access restrictions by leveraging an expired token, a different vulnerability than CVE-2011-0730.
12956| [CVE-2011-2204] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
12957| [CVE-2011-2088] XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
12958| [CVE-2011-2087] Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
12959| [CVE-2011-1928] The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
12960| [CVE-2011-1921] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.
12961| [CVE-2011-1783] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.
12962| [CVE-2011-1772] Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
12963| [CVE-2011-1752] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.
12964| [CVE-2011-1610] Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
12965| [CVE-2011-1582] Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
12966| [CVE-2011-1571] Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
12967| [CVE-2011-1570] Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
12968| [CVE-2011-1503] The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
12969| [CVE-2011-1502] Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
12970| [CVE-2011-1498] Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
12971| [CVE-2011-1475] The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
12972| [CVE-2011-1419] Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
12973| [CVE-2011-1318] Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by accessing a JSP page of an application that is repeatedly stopped and restarted.
12974| [CVE-2011-1184] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
12975| [CVE-2011-1183] Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
12976| [CVE-2011-1176] The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
12977| [CVE-2011-1088] Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
12978| [CVE-2011-1077] Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
12979| [CVE-2011-1026] Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.
12980| [CVE-2011-0715] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
12981| [CVE-2011-0534] Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
12982| [CVE-2011-0533] Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta
12983| [CVE-2011-0419] Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
12984| [CVE-2011-0013] Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
12985| [CVE-2010-4644] Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.
12986| [CVE-2010-4539] The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
12987| [CVE-2010-4476] The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
12988| [CVE-2010-4455] Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.2 and 11.1.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Apache Plugin.
12989| [CVE-2010-4408] Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
12990| [CVE-2010-4312] The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
12991| [CVE-2010-4172] Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
12992| [CVE-2010-3872] The fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.6 for the Apache HTTP Server does not use bytewise pointer arithmetic in certain circumstances, which has unspecified impact and attack vectors related to "untrusted FastCGI applications" and a "stack buffer overwrite."
12993| [CVE-2010-3863] Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
12994| [CVE-2010-3854] Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
12995| [CVE-2010-3718] Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
12996| [CVE-2010-3449] Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1
12997| [CVE-2010-3315] authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
12998| [CVE-2010-3083] sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
12999| [CVE-2010-2952] Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.
13000| [CVE-2010-2791] mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
13001| [CVE-2010-2375] Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
13002| [CVE-2010-2234] Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
13003| [CVE-2010-2227] Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
13004| [CVE-2010-2103] Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
13005| [CVE-2010-2086] Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
13006| [CVE-2010-2076] Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
13007| [CVE-2010-2068] mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
13008| [CVE-2010-2057] shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
13009| [CVE-2010-1632] Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
13010| [CVE-2010-1623] Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
13011| [CVE-2010-1587] The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
13012| [CVE-2010-1452] The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
13013| [CVE-2010-1325] Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting. NOTE: some sources report that this is a vulnerability in a product named "Apache SLMS," but that is incorrect.
13014| [CVE-2010-1244] Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
13015| [CVE-2010-1157] Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
13016| [CVE-2010-1151] Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.
13017| [CVE-2010-0684] Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
13018| [CVE-2010-0434] The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
13019| [CVE-2010-0432] Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
13020| [CVE-2010-0425] modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
13021| [CVE-2010-0408] The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
13022| [CVE-2010-0390] Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions, allows remote attackers to execute arbitrary code by uploading a file with a pjpeg or jpeg extension, then accessing it via a direct request to the file in original/. NOTE: some of these details are obtained from third party information.
13023| [CVE-2010-0219] Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
13024| [CVE-2010-0010] Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
13025| [CVE-2010-0009] Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
13026| [CVE-2009-5120] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
13027| [CVE-2009-5119] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
13028| [CVE-2009-5006] The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote authenticated users to cause a denial of service (NULL pointer dereference, daemon crash, and cluster outage) by attempting to modify the alternate of an exchange.
13029| [CVE-2009-5005] The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.
13030| [CVE-2009-4355] Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
13031| [CVE-2009-4269] The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
13032| [CVE-2009-3923] The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.
13033| [CVE-2009-3890] Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.
13034| [CVE-2009-3843] HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
13035| [CVE-2009-3821] Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
13036| [CVE-2009-3555] The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
13037| [CVE-2009-3548] The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
13038| [CVE-2009-3250] The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.
13039| [CVE-2009-3095] The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
13040| [CVE-2009-3094] The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
13041| [CVE-2009-2902] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
13042| [CVE-2009-2901] The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
13043| [CVE-2009-2823] The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the HTTP TRACE method, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software.
13044| [CVE-2009-2699] The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
13045| [CVE-2009-2696] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
13046| [CVE-2009-2693] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
13047| [CVE-2009-2625] XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
13048| [CVE-2009-2412] Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR
13049| [CVE-2009-2299] The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
13050| [CVE-2009-1956] Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
13051| [CVE-2009-1955] The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
13052| [CVE-2009-1903] The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.
13053| [CVE-2009-1891] The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
13054| [CVE-2009-1890] The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
13055| [CVE-2009-1885] Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
13056| [CVE-2009-1462] The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.
13057| [CVE-2009-1275] Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
13058| [CVE-2009-1195] The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
13059| [CVE-2009-1191] mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
13060| [CVE-2009-1012] Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
13061| [CVE-2009-0918] Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
13062| [CVE-2009-0796] Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
13063| [CVE-2009-0783] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
13064| [CVE-2009-0781] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
13065| [CVE-2009-0754] PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
13066| [CVE-2009-0580] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
13067| [CVE-2009-0486] Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
13068| [CVE-2009-0039] Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
13069| [CVE-2009-0038] Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring
13070| [CVE-2009-0033] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
13071| [CVE-2009-0026] Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
13072| [CVE-2009-0023] The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
13073| [CVE-2008-6879] Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
13074| [CVE-2008-6755] ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.
13075| [CVE-2008-6722] Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.
13076| [CVE-2008-6682] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
13077| [CVE-2008-6505] Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
13078| [CVE-2008-6504] ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
13079| [CVE-2008-5696] Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the ApacheAdmin console, which allows remote attackers to reconfigure the Apache HTTP Server via console operations.
13080| [CVE-2008-5676] Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to "transformation caching."
13081| [CVE-2008-5519] The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
13082| [CVE-2008-5518] Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet)
13083| [CVE-2008-5515] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
13084| [CVE-2008-5457] Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
13085| [CVE-2008-4308] The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
13086| [CVE-2008-4008] Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
13087| [CVE-2008-3666] Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-dependent attackers to cause a denial of service (panic) via vectors involving creation of a crafted file and use of the sendfilev system call, as demonstrated by a file served by an Apache 2.2.x web server with EnableSendFile configured
13088| [CVE-2008-3271] Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
13089| [CVE-2008-3257] Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
13090| [CVE-2008-2939] Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
13091| [CVE-2008-2938] Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
13092| [CVE-2008-2742] Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory. NOTE: this is only a vulnerability in environments that support multiple extensions, such as Apache with the mod_mime module enabled.
13093| [CVE-2008-2717] TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
13094| [CVE-2008-2579] Unspecified vulnerability in the WebLogic Server Plugins for Apache, Sun and IIS web servers component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 has unknown impact and remote attack vectors.
13095| [CVE-2008-2384] SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
13096| [CVE-2008-2370] Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
13097| [CVE-2008-2364] The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
13098| [CVE-2008-2168] Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
13099| [CVE-2008-2025] Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
13100| [CVE-2008-1947] Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
13101| [CVE-2008-1734] Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.
13102| [CVE-2008-1678] Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
13103| [CVE-2008-1232] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
13104| [CVE-2008-0869] Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
13105| [CVE-2008-0732] The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
13106| [CVE-2008-0555] The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.
13107| [CVE-2008-0457] Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
13108| [CVE-2008-0456] CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
13109| [CVE-2008-0455] Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
13110| [CVE-2008-0128] The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
13111| [CVE-2008-0005] mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
13112| [CVE-2008-0002] Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
13113| [CVE-2007-6750] The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.
13114| [CVE-2007-6726] Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
13115| [CVE-2007-6514] Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive.
13116| [CVE-2007-6423] ** DISPUTED ** Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue.
13117| [CVE-2007-6422] The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.
13118| [CVE-2007-6421] Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
13119| [CVE-2007-6420] Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
13120| [CVE-2007-6388] Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
13121| [CVE-2007-6361] Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote attackers to read certain files under temp/, as demonstrated by a log file that records the titles of blog entries. NOTE: access to temp/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
13122| [CVE-2007-6342] SQL injection vulnerability in the David Castro AuthCAS module (AuthCAS.pm) 0.4 for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the SESSION_COOKIE_NAME (session ID) in a cookie.
13123| [CVE-2007-6286] Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
13124| [CVE-2007-6258] Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.
13125| [CVE-2007-6231] Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4) status_top_x.inc.php, or (5) libchart-1.1/libchart.php in include/. NOTE: access to include/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
13126| [CVE-2007-6203] Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
13127| [CVE-2007-5797] SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
13128| [CVE-2007-5731] Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
13129| [CVE-2007-5461] Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
13130| [CVE-2007-5342] The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
13131| [CVE-2007-5333] Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
13132| [CVE-2007-5156] Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
13133| [CVE-2007-5085] Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.
13134| [CVE-2007-5000] Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
13135| [CVE-2007-4724] Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
13136| [CVE-2007-4723] Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a "/...../" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.
13137| [CVE-2007-4641] Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting code into an Apache log file.
13138| [CVE-2007-4556] Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
13139| [CVE-2007-4548] The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
13140| [CVE-2007-4465] Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
13141| [CVE-2007-3847] The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
13142| [CVE-2007-3571] The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
13143| [CVE-2007-3386] Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
13144| [CVE-2007-3385] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
13145| [CVE-2007-3384] Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.
13146| [CVE-2007-3383] Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
13147| [CVE-2007-3382] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
13148| [CVE-2007-3304] Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
13149| [CVE-2007-3303] Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
13150| [CVE-2007-3101] Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.
13151| [CVE-2007-2450] Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
13152| [CVE-2007-2449] Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the '
13153| [CVE-2007-2353] Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
13154| [CVE-2007-2025] Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.
13155| [CVE-2007-1863] cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
13156| [CVE-2007-1862] The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.
13157| [CVE-2007-1860] mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
13158| [CVE-2007-1858] The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.
13159| [CVE-2007-1842] Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, a related issue to CVE-2006-2019.
13160| [CVE-2007-1801] Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by inc/lang.php.
13161| [CVE-2007-1743] suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.
13162| [CVE-2007-1742] suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
13163| [CVE-2007-1741] Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
13164| [CVE-2007-1720] Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
13165| [CVE-2007-1636] Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.
13166| [CVE-2007-1633] Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by bbcode_ref.php.
13167| [CVE-2007-1577] Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tplname] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
13168| [CVE-2007-1539] Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the module_name parameter, as demonstrated via a static PHP code injection attack in an Apache log file.
13169| [CVE-2007-1524] Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the settings[skin] parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via themes/default/.
13170| [CVE-2007-1491] Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties.
13171| [CVE-2007-1358] Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
13172| [CVE-2007-1349] PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
13173| [CVE-2007-0975] Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the _REQUEST superglobal array.
13174| [CVE-2007-0930] Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function.
13175| [CVE-2007-0792] The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
13176| [CVE-2007-0774] Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
13177| [CVE-2007-0637] Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the galeria parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by zd_numer.php.
13178| [CVE-2007-0451] Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
13179| [CVE-2007-0450] Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
13180| [CVE-2007-0419] The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
13181| [CVE-2007-0173] Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
13182| [CVE-2007-0098] Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
13183| [CVE-2007-0086] ** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
13184| [CVE-2006-7217] Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
13185| [CVE-2006-7216] Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
13186| [CVE-2006-7197] The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.
13187| [CVE-2006-7196] Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
13188| [CVE-2006-7195] Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
13189| [CVE-2006-7098] The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.
13190| [CVE-2006-6869] Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang cookie to error.php, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
13191| [CVE-2006-6675] Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecifeid parameters in Welcome web-app.
13192| [CVE-2006-6613] Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_lang[include_file] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
13193| [CVE-2006-6589] Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCH_STRING parameter, a different issue than CVE-2006-6587. NOTE: some of these details are obtained from third party information.
13194| [CVE-2006-6588] The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown impact.
13195| [CVE-2006-6587] Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
13196| [CVE-2006-6445] Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
13197| [CVE-2006-6071] TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
13198| [CVE-2006-6047] Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
13199| [CVE-2006-5894] Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by lang.php.
13200| [CVE-2006-5752] Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.
13201| [CVE-2006-5733] Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
13202| [CVE-2006-5263] Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter, as demonstrated by a parameter value naming an Apache HTTP Server log file that apparently contains PHP code.
13203| [CVE-2006-4994] Multiple unquoted Windows search path vulnerabilities in Apache Friends XAMPP 1.5.2 might allow local users to gain privileges via a malicious program file in %SYSTEMDRIVE%, which is run when XAMPP attempts to execute (1) FileZillaServer.exe, (2) mysqld-nt.exe, (3) Perl.exe, or (4) xamppcontrol.exe with an unquoted "Program Files" pathname.
13204| [CVE-2006-4636] Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
13205| [CVE-2006-4625] PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
13206| [CVE-2006-4558] DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
13207| [CVE-2006-4191] Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by header.php.
13208| [CVE-2006-4154] Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.
13209| [CVE-2006-4110] Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.
13210| [CVE-2006-4004] Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
13211| [CVE-2006-3918] http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
13212| [CVE-2006-3835] Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (
13213| [CVE-2006-3747] Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
13214| [CVE-2006-3362] Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
13215| [CVE-2006-3102] Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles directory.
13216| [CVE-2006-3070] write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
13217| [CVE-2006-2831] Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
13218| [CVE-2006-2806] The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.
13219| [CVE-2006-2743] Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.
13220| [CVE-2006-2514] Coppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.
13221| [CVE-2006-2330] PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
13222| [CVE-2006-1777] Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.
13223| [CVE-2006-1564] Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory.
13224| [CVE-2006-1548] Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
13225| [CVE-2006-1547] ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
13226| [CVE-2006-1546] Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
13227| [CVE-2006-1393] Multiple cross-site scripting (XSS) vulnerabilities in the mod_pubcookie Apache application server module in University of Washington Pubcookie 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.
13228| [CVE-2006-1346] Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang[*][file] parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by index.php.
13229| [CVE-2006-1292] Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.
13230| [CVE-2006-1243] Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included using install05.php.
13231| [CVE-2006-1095] Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
13232| [CVE-2006-1079] htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
13233| [CVE-2006-1078] Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
13234| [CVE-2006-0743] Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
13235| [CVE-2006-0254] Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
13236| [CVE-2006-0150] Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
13237| [CVE-2006-0144] The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
13238| [CVE-2006-0042] Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.
13239| [CVE-2005-4857] eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error".
13240| [CVE-2005-4849] Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
13241| [CVE-2005-4836] The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
13242| [CVE-2005-4814] Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory.
13243| [CVE-2005-4703] Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
13244| [CVE-2005-3745] Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
13245| [CVE-2005-3630] Fedora Directory Server before 10 allows remote attackers to obtain sensitive information, such as the password from adm.conf via an IFRAME element, probably involving an Apache httpd.conf configuration that orders "allow" directives before "deny" directives.
13246| [CVE-2005-3510] Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
13247| [CVE-2005-3392] Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.
13248| [CVE-2005-3357] mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
13249| [CVE-2005-3352] Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
13250| [CVE-2005-3319] The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
13251| [CVE-2005-3164] The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
13252| [CVE-2005-2970] Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.
13253| [CVE-2005-2963] The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.
13254| [CVE-2005-2728] The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
13255| [CVE-2005-2660] apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
13256| [CVE-2005-2088] The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
13257| [CVE-2005-1754] ** DISPUTED ** JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
13258| [CVE-2005-1753] ** DISPUTED ** ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
13259| [CVE-2005-1344] Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
13260| [CVE-2005-1268] Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
13261| [CVE-2005-1266] Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.
13262| [CVE-2005-0808] Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
13263| [CVE-2005-0182] The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.
13264| [CVE-2005-0108] Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.
13265| [CVE-2004-2734] webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
13266| [CVE-2004-2680] mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.
13267| [CVE-2004-2650] Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
13268| [CVE-2004-2343] ** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.
13269| [CVE-2004-2336] Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
13270| [CVE-2004-2115] Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
13271| [CVE-2004-1834] mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.
13272| [CVE-2004-1765] Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.
13273| [CVE-2004-1545] UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.hwp, which allows remote attackers to upload and execute arbitrary code.
13274| [CVE-2004-1438] The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.
13275| [CVE-2004-1405] MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
13276| [CVE-2004-1404] Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
13277| [CVE-2004-1387] The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
13278| [CVE-2004-1084] Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles.
13279| [CVE-2004-1083] Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
13280| [CVE-2004-1082] mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
13281| [CVE-2004-0942] Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.
13282| [CVE-2004-0940] Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
13283| [CVE-2004-0885] The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
13284| [CVE-2004-0811] Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.
13285| [CVE-2004-0809] The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
13286| [CVE-2004-0786] The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
13287| [CVE-2004-0751] The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).
13288| [CVE-2004-0748] mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.
13289| [CVE-2004-0747] Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.
13290| [CVE-2004-0700] Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
13291| [CVE-2004-0646] Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod_jrun and (2) mod_jrun20 for Apache, with verbose logging enabled, allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.
13292| [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
13293| [CVE-2004-0493] The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
13294| [CVE-2004-0492] Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
13295| [CVE-2004-0490] cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
13296| [CVE-2004-0488] Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
13297| [CVE-2004-0263] PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.
13298| [CVE-2004-0174] Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."
13299| [CVE-2004-0173] Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.
13300| [CVE-2004-0113] Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
13301| [CVE-2004-0009] Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user.
13302| [CVE-2003-1581] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
13303| [CVE-2003-1580] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
13304| [CVE-2003-1573] The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
13305| [CVE-2003-1521] Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
13306| [CVE-2003-1516] The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
13307| [CVE-2003-1502] mod_throttle 3.0 allows local users with Apache privileges to access shared memory that points to a file that is writable by the apache user, which could allow local users to gain privileges.
13308| [CVE-2003-1418] Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child proccess IDs (PID).
13309| [CVE-2003-1307] ** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP."
13310| [CVE-2003-1172] Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
13311| [CVE-2003-1171] Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data.
13312| [CVE-2003-1138] The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).
13313| [CVE-2003-1054] mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname, as parsed by the ap_parse_uri_components function in Apache, which triggers a null dereference.
13314| [CVE-2003-0993] mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
13315| [CVE-2003-0987] mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
13316| [CVE-2003-0866] The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
13317| [CVE-2003-0844] mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
13318| [CVE-2003-0843] Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode and using the Apache log, allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header.
13319| [CVE-2003-0789] mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.
13320| [CVE-2003-0771] Gallery.pm in Apache::Gallery (aka A::G) uses predictable temporary filenames when running Inline::C, which allows local users to execute arbitrary code by creating and modifying the files before Apache::Gallery does.
13321| [CVE-2003-0658] Docview before 1.1-18 in Caldera OpenLinux 3.1.1, SCO Linux 4.0, OpenServer 5.0.7, configures the Apache web server in a way that allows remote attackers to read arbitrary publicly readable files via a certain URL, possibly related to rewrite rules.
13322| [CVE-2003-0542] Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.
13323| [CVE-2003-0460] The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.
13324| [CVE-2003-0254] Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.
13325| [CVE-2003-0253] The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.
13326| [CVE-2003-0249] ** DISPUTED ** PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report."
13327| [CVE-2003-0245] Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.
13328| [CVE-2003-0192] Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.
13329| [CVE-2003-0189] The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.
13330| [CVE-2003-0134] Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.
13331| [CVE-2003-0132] A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
13332| [CVE-2003-0083] Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
13333| [CVE-2003-0020] Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.
13334| [CVE-2003-0017] Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
13335| [CVE-2003-0016] Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
13336| [CVE-2002-2310] ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than Apache, which allows remote attackers to obtain usernames and passwords.
13337| [CVE-2002-2309] php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
13338| [CVE-2002-2272] Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
13339| [CVE-2002-2103] Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
13340| [CVE-2002-2029] PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
13341| [CVE-2002-2012] Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
13342| [CVE-2002-2009] Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
13343| [CVE-2002-2008] Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
13344| [CVE-2002-2007] The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
13345| [CVE-2002-2006] The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
13346| [CVE-2002-1895] The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
13347| [CVE-2002-1850] mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
13348| [CVE-2002-1793] HTTP Server mod_ssl module running on HP-UX 11.04 with Virtualvault OS (VVOS) 4.5 through 4.6 closes the connection when the Apache server times out during an SSL request, which may allow attackers to cause a denial of service.
13349| [CVE-2002-1658] Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
13350| [CVE-2002-1635] The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
13351| [CVE-2002-1593] mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.
13352| [CVE-2002-1592] The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
13353| [CVE-2002-1567] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
13354| [CVE-2002-1394] Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
13355| [CVE-2002-1233] A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
13356| [CVE-2002-1157] Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
13357| [CVE-2002-1156] Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
13358| [CVE-2002-1148] The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
13359| [CVE-2002-0935] Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
13360| [CVE-2002-0843] Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
13361| [CVE-2002-0840] Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
13362| [CVE-2002-0839] The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
13363| [CVE-2002-0682] Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
13364| [CVE-2002-0661] Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
13365| [CVE-2002-0658] OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.
13366| [CVE-2002-0654] Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
13367| [CVE-2002-0653] Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
13368| [CVE-2002-0513] The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
13369| [CVE-2002-0493] Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
13370| [CVE-2002-0392] Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
13371| [CVE-2002-0259] InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache directory, or (2) mplog.txt, which could allow local users to gain privileges.
13372| [CVE-2002-0249] PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.
13373| [CVE-2002-0240] PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
13374| [CVE-2002-0082] The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
13375| [CVE-2002-0061] Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
13376| [CVE-2001-1556] The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
13377| [CVE-2001-1534] mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
13378| [CVE-2001-1510] Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
13379| [CVE-2001-1449] The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
13380| [CVE-2001-1385] The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
13381| [CVE-2001-1342] Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.
13382| [CVE-2001-1217] Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
13383| [CVE-2001-1216] Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
13384| [CVE-2001-1072] Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.
13385| [CVE-2001-1013] Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
13386| [CVE-2001-0925] The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
13387| [CVE-2001-0829] A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
13388| [CVE-2001-0766] Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.
13389| [CVE-2001-0731] Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.
13390| [CVE-2001-0730] split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header.
13391| [CVE-2001-0729] Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash) characters.
13392| [CVE-2001-0590] Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
13393| [CVE-2001-0131] htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
13394| [CVE-2001-0108] PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
13395| [CVE-2001-0042] PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequences.
13396| [CVE-2000-1247] The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.
13397| [CVE-2000-1210] Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
13398| [CVE-2000-1206] Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
13399| [CVE-2000-1205] Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.
13400| [CVE-2000-1204] Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root.
13401| [CVE-2000-1168] IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.
13402| [CVE-2000-1016] The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL.
13403| [CVE-2000-0913] mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.
13404| [CVE-2000-0883] The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory.
13405| [CVE-2000-0869] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary diretories via the PROPFIND HTTP request method.
13406| [CVE-2000-0868] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/.
13407| [CVE-2000-0791] Trustix installs the httpsd program for Apache-SSL with world-writeable permissions, which allows local users to replace it with a Trojan horse.
13408| [CVE-2000-0760] The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
13409| [CVE-2000-0759] Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
13410| [CVE-2000-0628] The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files.
13411| [CVE-2000-0505] The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
13412| [CVE-1999-1412] A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.
13413| [CVE-1999-1293] mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
13414| [CVE-1999-1237] Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
13415| [CVE-1999-1199] Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.
13416| [CVE-1999-1053] guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
13417| [CVE-1999-0926] Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
13418| [CVE-1999-0678] A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.
13419| [CVE-1999-0448] IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.
13420| [CVE-1999-0289] The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL.
13421| [CVE-1999-0236] ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
13422| [CVE-1999-0107] Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.
13423| [CVE-1999-0071] Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.
13424|
13425| SecurityFocus - https://www.securityfocus.com/bid/:
13426| [104554] Apache HBase CVE-2018-8025 Security Bypass Vulnerability
13427| [104465] Apache Geode CVE-2017-15695 Remote Code Execution Vulnerability
13428| [104418] Apache Storm CVE-2018-8008 Arbitrary File Write Vulnerability
13429| [104399] Apache Storm CVE-2018-1332 User Impersonation Vulnerability
13430| [104348] Apache UIMA CVE-2017-15691 XML External Entity Injection Vulnerability
13431| [104313] Apache NiFi XML External Entity Injection and Denial of Service Vulnerability
13432| [104259] Apache Geode CVE-2017-12622 Authorization Bypass Vulnerability
13433| [104257] Apache Sling XSS Protection API CVE-2017-15717 Cross Site Scripting Vulnerability
13434| [104253] Apache ZooKeeper CVE-2018-8012 Security Bypass Vulnerability
13435| [104252] Apache Batik CVE-2018-8013 Information Disclosure Vulnerability
13436| [104239] Apache Solr CVE-2018-8010 XML External Entity Multiple Information Disclosure Vulnerabilities
13437| [104215] Apache ORC CVE-2018-8015 Denial of Service Vulnerability
13438| [104203] Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability
13439| [104161] Apache Ambari CVE-2018-8003 Directory Traversal Vulnerability
13440| [104140] Apache Derby CVE-2018-1313 Security Bypass Vulnerability
13441| [104135] Apache Tika CVE-2018-1338 Denial of Service Vulnerability
13442| [104008] Apache Fineract CVE-2018-1291 SQL Injection Vulnerability
13443| [104007] Apache Fineract CVE-2018-1292 SQL Injection Vulnerability
13444| [104005] Apache Fineract CVE-2018-1289 SQL Injection Vulnerability
13445| [104001] Apache Tika CVE-2018-1335 Remote Command Injection Vulnerability
13446| [103975] Apache Fineract CVE-2018-1290 SQL Injection Vulnerability
13447| [103974] Apache Solr CVE-2018-1308 XML External Entity Injection Vulnerability
13448| [103772] Apache Traffic Server CVE-2017-7671 Denial of Service Vulnerability
13449| [103770] Apache Traffic Server CVE-2017-5660 Security Bypass Vulnerability
13450| [103751] Apache Hive CVE-2018-1282 SQL Injection Vulnerability
13451| [103750] Apache Hive CVE-2018-1284 Security Bypass Vulnerability
13452| [103692] Apache Ignite CVE-2018-1295 Arbitrary Code Execution Vulnerability
13453| [103528] Apache HTTP Server CVE-2018-1302 Denial of Service Vulnerability
13454| [103525] Apache HTTP Server CVE-2017-15715 Remote Security Bypass Vulnerability
13455| [103524] Apache HTTP Server CVE-2018-1312 Remote Security Bypass Vulnerability
13456| [103522] Apache HTTP Server CVE-2018-1303 Denial of Service Vulnerability
13457| [103520] Apache HTTP Server CVE-2018-1283 Remote Security Vulnerability
13458| [103516] Apache Struts CVE-2018-1327 Denial of Service Vulnerability
13459| [103515] Apache HTTP Server CVE-2018-1301 Denial of Service Vulnerability
13460| [103512] Apache HTTP Server CVE-2017-15710 Denial of Service Vulnerability
13461| [103508] Apache Syncope CVE-2018-1321 Multiple Remote Code Execution Vulnerabilities
13462| [103507] Apache Syncope CVE-2018-1322 Multiple Information Disclosure Vulnerabilities
13463| [103490] Apache Commons Compress CVE-2018-1324 Multiple Denial Of Service Vulnerabilities
13464| [103434] APACHE Allura CVE-2018-1319 HTTP Response Splitting Vulnerability
13465| [103389] Apache Tomcat JK Connector CVE-2018-1323 Directory Traversal Vulnerability
13466| [103222] Apache CloudStack CVE-2013-4317 Information Disclosure Vulnerability
13467| [103219] Apache Xerces-C CVE-2017-12627 Null Pointer Dereference Denial of Service Vulnerability
13468| [103206] Apache Geode CVE-2017-15693 Remote Code Execution Vulnerability
13469| [103205] Apache Geode CVE-2017-15692 Remote Code Execution Vulnerability
13470| [103170] Apache Tomcat CVE-2018-1304 Security Bypass Vulnerability
13471| [103144] Apache Tomcat CVE-2018-1305 Security Bypass Vulnerability
13472| [103102] Apache Oozie CVE-2017-15712 Information Disclosure Vulnerability
13473| [103098] Apache Karaf CVE-2016-8750 LDAP Injection Vulnerability
13474| [103069] Apache Tomcat CVE-2017-15706 Remote Security Weakness
13475| [103068] Apache JMeter CVE-2018-1287 Security Bypass Vulnerability
13476| [103067] Apache Qpid Dispatch Router 'router_core/connections.c' Denial of Service Vulnerability
13477| [103036] Apache CouchDB CVE-2017-12636 Remote Code Execution Vulnerability
13478| [103025] Apache Thrift CVE-2016-5397 Remote Command Injection Vulnerability
13479| [102879] Apache POI CVE-2017-12626 Multiple Denial of Service Vulnerabilities
13480| [102842] Apache NiFi CVE-2017-12632 Host Header Injection Vulnerability
13481| [102815] Apache NiFi CVE-2017-15697 Multiple Cross Site Scripting Vulnerabilities
13482| [102488] Apache Geode CVE-2017-9795 Remote Code Execution Vulnerability
13483| [102229] Apache Sling CVE-2017-15700 Information Disclosure Vulnerability
13484| [102226] Apache Drill CVE-2017-12630 Cross Site Scripting Vulnerability
13485| [102154] Multiple Apache Products CVE-2017-15708 Remote Code Execution Vulnerability
13486| [102127] Apache CXF Fediz CVE-2017-12631 Multiple Cross Site Request Forgery Vulnerabilities
13487| [102041] Apache Qpid Broker-J CVE-2017-15701 Denial of Service Vulnerability
13488| [102040] Apache Qpid Broker CVE-2017-15702 Security Weakness
13489| [102021] Apache Struts CVE-2017-15707 Denial of Service Vulnerability
13490| [101980] EMC RSA Authentication Agent for Web: Apache Web Server Authentication Bypass Vulnerability
13491| [101876] Apache Camel CVE-2017-12634 Deserialization Remote Code Execution Vulnerability
13492| [101874] Apache Camel CVE-2017-12633 Deserialization Remote Code Execution Vulnerability
13493| [101872] Apache Karaf CVE-2014-0219 Local Denial of Service Vulnerability
13494| [101868] Apache CouchDB CVE-2017-12635 Remote Privilege Escalation Vulnerability
13495| [101859] Apache CXF CVE-2017-12624 Denial of Service Vulnerability
13496| [101844] Apache Sling Servlets Post CVE-2017-11296 Cross Site Scripting Vulnerability
13497| [101686] Apache Hive CVE-2017-12625 Information Disclosure Vulnerability
13498| [101644] Apache Wicket CVE-2012-5636 Cross Site Scripting Vulnerability
13499| [101631] Apache Traffic Server CVE-2015-3249 Multiple Remote Code Execution Vulnerabilities
13500| [101630] Apache Traffic Server CVE-2014-3624 Access Bypass Vulnerability
13501| [101625] Apache jUDDI CVE-2009-1197 Security Bypass Vulnerability
13502| [101623] Apache jUDDI CVE-2009-1198 Cross Site Scripting Vulnerability
13503| [101620] Apache Subversion 'libsvn_fs_fs/fs_fs.c' Denial of Service Vulnerability
13504| [101585] Apache OpenOffice Multiple Remote Code Execution Vulnerabilities
13505| [101577] Apache Wicket CVE-2016-6806 Cross Site Request Forgery Vulnerability
13506| [101575] Apache Wicket CVE-2014-0043 Information Disclosure Vulnerability
13507| [101570] Apache Geode CVE-2017-9797 Information Disclosure Vulnerability
13508| [101562] Apache Derby CVE-2010-2232 Arbitrary File Overwrite Vulnerability
13509| [101560] Apache Portable Runtime Utility CVE-2017-12613 Multiple Information Disclosure Vulnerabilities
13510| [101558] Apache Portable Runtime Utility Local Out-of-Bounds Read Denial of Service Vulnerability
13511| [101532] Apache James CVE-2017-12628 Arbitrary Command Execution Vulnerability
13512| [101516] Apache HTTP Server CVE-2017-12171 Security Bypass Vulnerability
13513| [101261] Apache Solr/Lucene CVE-2017-12629 Information Disclosure and Remote Code Execution Vulnerabilities
13514| [101230] Apache Roller CVE-2014-0030 XML External Entity Injection Vulnerability
13515| [101173] Apache IMPALA CVE-2017-9792 Information Disclosure Vulnerability
13516| [101052] Apache Commons Jelly CVE-2017-12621 Security Bypass Vulnerability
13517| [101027] Apache Mesos CVE-2017-7687 Denial of Service Vulnerability
13518| [101023] Apache Mesos CVE-2017-9790 Denial of Service Vulnerability
13519| [100954] Apache Tomcat CVE-2017-12617 Incomplete Fix Remote Code Execution Vulnerability
13520| [100946] Apache Wicket CVE-2014-7808 Cross Site Request Forgery Vulnerability
13521| [100901] Apache Tomcat CVE-2017-12615 Remote Code Execution Vulnerability
13522| [100897] Apache Tomcat CVE-2017-12616 Information Disclosure Vulnerability
13523| [100880] Apache Directory LDAP API CVE-2015-3250 Unspecified Information Disclosure Vulnerability
13524| [100872] Apache HTTP Server CVE-2017-9798 Information Disclosure Vulnerability
13525| [100870] Apache Solr CVE-2017-9803 Remote Privilege Escalation Vulnerability
13526| [100859] puppetlabs-apache CVE-2017-2299 Information Disclosure Vulnerability
13527| [100829] Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability
13528| [100823] Apache Spark CVE-2017-12612 Deserialization Remote Code Execution Vulnerability
13529| [100612] Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability
13530| [100611] Apache Struts CVE-2017-9793 Denial of Service Vulnerability
13531| [100609] Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability
13532| [100587] Apache Atlas CVE-2017-3155 Cross Frame Scripting Vulnerability
13533| [100581] Apache Atlas CVE-2017-3154 Information Disclosure Vulnerability
13534| [100578] Apache Atlas CVE-2017-3153 Cross Site Scripting Vulnerability
13535| [100577] Apache Atlas CVE-2017-3152 Cross Site Scripting Vulnerability
13536| [100547] Apache Atlas CVE-2017-3151 HTML Injection Vulnerability
13537| [100536] Apache Atlas CVE-2017-3150 Cross Site Scripting Vulnerability
13538| [100449] Apache Pony Mail CVE-2016-4460 Authentication Bypass Vulnerability
13539| [100447] Apache2Triad Multiple Security Vulnerabilities
13540| [100284] Apache Sling Servlets Post CVE-2017-9802 Cross Site Scripting Vulnerability
13541| [100280] Apache Tomcat CVE-2017-7674 Security Bypass Vulnerability
13542| [100259] Apache Subversion CVE-2017-9800 Remote Command Execution Vulnerability
13543| [100256] Apache Tomcat CVE-2017-7675 Directory Traversal Vulnerability
13544| [100235] Apache Storm CVE-2017-9799 Remote Code Execution Vulnerability
13545| [100082] Apache Commons Email CVE-2017-9801 SMTP Header Injection Vulnerability
13546| [99873] Apache Sling XSS Protection API CVE-2016-6798 XML External Entity Injection Vulnerability
13547| [99870] Apache Sling API CVE-2016-5394 Cross Site Scripting Vulnerability
13548| [99603] Apache Spark CVE-2017-7678 Cross Site Scripting Vulnerability
13549| [99592] Apache OpenMeetings CVE-2017-7685 Security Bypass Vulnerability
13550| [99587] Apache OpenMeetings CVE-2017-7673 Security Bypass Vulnerability
13551| [99586] Apache OpenMeetings CVE-2017-7688 Security Bypass Vulnerability
13552| [99584] Apache OpenMeetings CVE-2017-7684 Denial of Service Vulnerability
13553| [99577] Apache OpenMeetings CVE-2017-7663 Cross Site Scripting Vulnerability
13554| [99576] Apache OpenMeetings CVE-2017-7664 XML External Entity Injection Vulnerability
13555| [99569] Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability
13556| [99568] Apache HTTP Server CVE-2017-9789 Denial of Service Vulnerability
13557| [99563] Apache Struts CVE-2017-7672 Denial of Service Vulnerability
13558| [99562] Apache Struts Spring AOP Functionality Denial of Service Vulnerability
13559| [99509] Apache Impala CVE-2017-5652 Information Disclosure Vulnerability
13560| [99508] Apache IMPALA CVE-2017-5640 Authentication Bypass Vulnerability
13561| [99486] Apache Traffic Control CVE-2017-7670 Denial of Service Vulnerability
13562| [99485] Apache Solr CVE-2017-7660 Security Bypass Vulnerability
13563| [99484] Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability
13564| [99292] Apache Ignite CVE-2017-7686 Information Disclosure Vulnerability
13565| [99170] Apache HTTP Server CVE-2017-7679 Buffer Overflow Vulnerability
13566| [99137] Apache HTTP Server CVE-2017-7668 Denial of Service Vulnerability
13567| [99135] Apache HTTP Server CVE-2017-3167 Authentication Bypass Vulnerability
13568| [99134] Apache HTTP Server CVE-2017-3169 Denial of Service Vulnerability
13569| [99132] Apache HTTP Server CVE-2017-7659 Denial of Service Vulnerability
13570| [99112] Apache Thrift CVE-2015-3254 Denial of Service Vulnerability
13571| [99067] Apache Ranger CVE-2016-8751 HTML Injection Vulnerability
13572| [99018] Apache NiFi CVE-2017-7667 Cross Frame Scripting Vulnerability
13573| [99009] Apache NiFi CVE-2017-7665 Cross Site Scripting Vulnerability
13574| [98961] Apache Ranger CVE-2017-7677 Security Bypass Vulnerability
13575| [98958] Apache Ranger CVE-2017-7676 Security Bypass Vulnerability
13576| [98888] Apache Tomcat CVE-2017-5664 Security Bypass Vulnerability
13577| [98814] Apache Zookeeper CVE-2017-5637 Denial of Service Vulnerability
13578| [98795] Apache Hadoop CVE-2017-7669 Remote Privilege Escalation Vulnerability
13579| [98739] Apache Knox CVE-2017-5646 User Impersonation Vulnerability
13580| [98669] Apache Hive CVE-2016-3083 Security Bypass Vulnerability
13581| [98646] Apache Atlas CVE-2016-8752 Information Disclosure Vulnerability
13582| [98570] Apache Archiva CVE-2017-5657 Multiple Cross-Site Request Forgery Vulnerabilities
13583| [98489] Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities
13584| [98485] Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability
13585| [98466] Apache Ambari CVE-2017-5655 Insecure Temporary File Handling Vulnerability
13586| [98365] Apache Cordova For Android CVE-2016-6799 Information Disclosure Vulnerability
13587| [98025] Apache Hadoop CVE-2017-3161 Cross Site Scripting Vulnerability
13588| [98017] Apache Hadoop CVE-2017-3162 Input Validation Vulnerability
13589| [97971] Apache CXF CVE-2017-5656 Information Disclosure Vulnerability
13590| [97968] Apache CXF CVE-2017-5653 Spoofing Vulnerability
13591| [97967] Apache ActiveMQ CVE-2015-7559 Denial of Service Vulnerability
13592| [97949] Apache Traffic Server CVE-2017-5659 Denial of Service Vulnerability
13593| [97948] Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability
13594| [97947] Apache FOP CVE-2017-5661 XML External Entity Information Disclosure Vulnerability
13595| [97945] Apache Traffic Server CVE-2016-5396 Denial of Service Vulnerability
13596| [97702] Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability
13597| [97582] Apache CXF CVE-2016-6812 Cross Site Scripting Vulnerability
13598| [97579] Apache CXF JAX-RS CVE-2016-8739 XML External Entity Injection Vulnerability
13599| [97544] Apache Tomcat CVE-2017-5651 Information Disclosure Vulnerability
13600| [97531] Apache Tomcat CVE-2017-5650 Denial of Service Vulnerability
13601| [97530] Apache Tomcat CVE-2017-5648 Information Disclosure Vulnerability
13602| [97509] Apache Ignite CVE-2016-6805 Information Disclosure and XML External Entity Injection Vulnerabilities
13603| [97383] Apache Flex BlazeDS CVE-2017-5641 Remote Code Execution Vulnerability
13604| [97378] Apache Geode CVE-2017-5649 Information Disclosure Vulnerability
13605| [97229] Apache Ambari CVE-2016-4976 Local Information Disclosure Vulnerability
13606| [97226] Apache Camel CVE-2017-5643 Server Side Request Forgery Security Bypass Vulnerability
13607| [97184] Apache Ambari CVE-2016-6807 Remote Command Execution Vulnerability
13608| [97179] Apache Camel CVE-2016-8749 Java Deserialization Multiple Remote Code Execution Vulnerabilities
13609| [96983] Apache POI CVE-2017-5644 Denial Of Service Vulnerability
13610| [96895] Apache Tomcat CVE-2016-8747 Information Disclosure Vulnerability
13611| [96731] Apache NiFi CVE-2017-5636 Remote Code Injection Vulnerability
13612| [96730] Apache NiFi CVE-2017-5635 Security Bypass Vulnerability
13613| [96729] Apache Struts CVE-2017-5638 Remote Code Execution Vulnerability
13614| [96540] IBM Development Package for Apache Spark CVE-2016-4970 Denial of Service Vulnerability
13615| [96398] Apache CXF CVE-2017-3156 Information Disclosure Vulnerability
13616| [96321] Apache Camel CVE-2017-3159 Remote Code Execution Vulnerability
13617| [96293] Apache Tomcat 'http11/AbstractInputBuffer.java' Denial of Service Vulnerability
13618| [96228] Apache Brooklyn Cross Site Request Forgery and Multiple Cross Site Scripting Vulnerabilities
13619| [95998] Apache Ranger CVE-2016-8746 Security Bypass Vulnerability
13620| [95929] Apache Groovy CVE-2016-6497 Information Disclosure Vulnerability
13621| [95838] Apache Cordova For Android CVE-2017-3160 Man in the Middle Security Bypass Vulnerability
13622| [95675] Apache Struts Remote Code Execution Vulnerability
13623| [95621] Apache NiFi CVE-2106-8748 Cross Site Scripting Vulnerability
13624| [95429] Apache Groovy CVE-2016-6814 Remote Code Execution Vulnerability
13625| [95335] Apache Hadoop CVE-2016-3086 Information Disclosure Vulnerability
13626| [95168] Apache Wicket CVE-2016-6793 Denial of Service Vulnerability
13627| [95136] Apache Qpid Broker for Java CVE-2016-8741 Remote Information Disclosure Vulnerability
13628| [95078] Apache HTTP Server CVE-2016-0736 Remote Security Vulnerability
13629| [95077] Apache HTTP Server CVE-2016-8743 Security Bypass Vulnerability
13630| [95076] Apache HTTP Server CVE-2016-2161 Denial of Service Vulnerability
13631| [95020] Apache Tika CVE-2015-3271 Remote Information Disclosure Vulnerability
13632| [94950] Apache Hadoop CVE-2016-5001 Local Information Disclosure Vulnerability
13633| [94882] Apache ActiveMQ CVE-2016-6810 HTML Injection Vulnerability
13634| [94828] Apache Tomcat CVE-2016-8745 Information Disclosure Vulnerability
13635| [94766] Apache CouchDB CVE-2016-8742 Local Privilege Escalation Vulnerability
13636| [94657] Apache Struts CVE-2016-8738 Denial of Service Vulnerability
13637| [94650] Apache HTTP Server CVE-2016-8740 Denial of Service Vulnerability
13638| [94588] Apache Subversion CVE-2016-8734 XML External Entity Denial of Service Vulnerability
13639| [94513] Apache Karaf CVE-2016-8648 Remote Code Execution Vulnerability
13640| [94463] Apache Tomcat CVE-2016-8735 Remote Code Execution Vulnerability
13641| [94462] Apache Tomcat CVE-2016-6817 Denial of Service Vulnerability
13642| [94461] Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability
13643| [94418] Apache OpenOffice CVE-2016-6803 Local Privilege Escalation Vulnerability
13644| [94247] Apache Tika CVE-2016-6809 Remote Code Execution Vulnerability
13645| [94221] Apache Ranger CVE-2016-6815 Local Privilege Escalation Vulnerability
13646| [94145] Apache OpenMeetings CVE-2016-8736 Remote Code Execution Vulnerability
13647| [93945] Apache CloudStack CVE-2016-6813 Authorization Bypass Vulnerability
13648| [93944] Apache Tomcat Security Manager CVE-2016-6796 Security Bypass Vulnerability
13649| [93943] Apache Tomcat CVE-2016-6794 Security Bypass Vulnerability
13650| [93942] Apache Tomcat Security Manager CVE-2016-5018 Security Bypass Vulnerability
13651| [93940] Apache Tomcat CVE-2016-6797 Security Bypass Vulnerability
13652| [93939] Apache Tomcat CVE-2016-0762 Information Disclosure Vulnerability
13653| [93774] Apache OpenOffice CVE-2016-6804 DLL Loading Remote Code Execution Vulnerability
13654| [93773] Apache Struts CVE-2016-6795 Directory Traversal Vulnerability
13655| [93478] Apache Tomcat CVE-2016-6325 Local Privilege Escalation Vulnerability
13656| [93472] Apache Tomcat CVE-2016-5425 Insecure File Permissions Vulnerability
13657| [93429] Apache Tomcat JK Connector CVE-2016-6808 Remote Buffer Overflow Vulnerability
13658| [93263] Apache Tomcat CVE-2016-1240 Local Privilege Escalation Vulnerability
13659| [93236] Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability
13660| [93142] Apache ActiveMQ Artemis CVE-2016-4978 Remote Code Execution Vulnerability
13661| [93132] Apache Derby CVE-2015-1832 XML External Entity Information Disclosure Vulnerability
13662| [93044] Apache Zookeeper CVE-2016-5017 Buffer Overflow Vulnerability
13663| [92966] Apache Jackrabbit CVE-2016-6801 Cross-Site Request Forgery Vulnerability
13664| [92947] Apache Shiro CVE-2016-6802 Remote Security Bypass Vulnerability
13665| [92905] Apache CXF Fediz CVE-2016-4464 Security Bypass Vulnerability
13666| [92577] Apache Ranger CVE-2016-5395 HTML Injection Vulnerability
13667| [92331] Apache HTTP Server CVE-2016-1546 Remote Denial of Service Vulnerability
13668| [92328] Apache Hive CVE-2016-0760 Multiple Remote Code Execution Vulnerabilities
13669| [92320] Apache APR-util and httpd CVE-2016-6312 Denial of Service Vulnerability
13670| [92100] Apache POI CVE-2016-5000 XML External Entity Injection Vulnerability
13671| [92079] Apache OpenOffice CVE-2016-1513 Remote Code Execution Vulnerability
13672| [91818] Apache Tomcat CVE-2016-5388 Security Bypass Vulnerability
13673| [91816] Apache HTTP Server CVE-2016-5387 Security Bypass Vulnerability
13674| [91788] Apache Qpid Proton CVE-2016-4467 Certificate Verification Security Bypass Vulnerability
13675| [91738] Apache XML-RPC CVE-2016-5003 Remote Code Execution Vulnerability
13676| [91736] Apache XML-RPC Multiple Security Vulnerabilities
13677| [91707] Apache Archiva CVE-2016-5005 HTML Injection Vulnerability
13678| [91703] Apache Archiva CVE-2016-4469 Multiple Cross-Site Request Forgery Vulnerabilities
13679| [91566] Apache HTTP Server CVE-2016-4979 Authentication Bypass Vulnerability
13680| [91537] Apache QPID CVE-2016-4974 Deserialization Security Bypass Vulnerability
13681| [91501] Apache Xerces-C CVE-2016-4463 Stack Buffer Overflow Vulnerability
13682| [91453] Apache Commons FileUpload CVE-2016-3092 Denial Of Service Vulnerability
13683| [91284] Apache Struts CVE-2016-4431 Security Bypass Vulnerability
13684| [91282] Apache Struts CVE-2016-4433 Security Bypass Vulnerability
13685| [91281] Apache Struts CVE-2016-4430 Cross-Site Request Forgery Vulnerability
13686| [91280] Apache Struts CVE-2016-4436 Security Bypass Vulnerability
13687| [91278] Apache Struts CVE-2016-4465 Denial of Service Vulnerability
13688| [91277] Apache Struts Incomplete Fix Remote Code Execution Vulnerability
13689| [91275] Apache Struts CVE-2016-4438 Remote Code Execution Vulnerability
13690| [91217] Apache Continuum 'saveInstallation.action' Command Execution Vulnerability
13691| [91141] Apache CloudStack CVE-2016-3085 Authentication Bypass Vulnerability
13692| [91068] Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability
13693| [91067] Apache Struts CVE-2016-1182 Security Bypass Vulnerability
13694| [91024] Apache Shiro CVE-2016-4437 Information Disclosure Vulnerability
13695| [90988] Apache Ranger CVE-2016-2174 SQL Injection Vulnerability
13696| [90961] Apache Struts CVE-2016-3093 Denial of Service Vulnerability
13697| [90960] Apache Struts CVE-2016-3087 Remote Code Execution Vulnerability
13698| [90921] Apache Qpid CVE-2016-4432 Authentication Bypass Vulnerability
13699| [90920] Apache Qpid CVE-2016-3094 Denial of Service Vulnerability
13700| [90902] Apache PDFBox CVE-2016-2175 XML External Entity Injection Vulnerability
13701| [90897] Apache Tika CVE-2016-4434 XML External Entity Injection Vulnerability
13702| [90827] Apache ActiveMQ CVE-2016-3088 Multiple Arbitrary File Upload Vulnerabilities
13703| [90755] Apache Ambari CVE-2016-0707 Multiple Local Information Disclosure Vulnerabilities
13704| [90482] Apache CVE-2004-1387 Local Security Vulnerability
13705| [89762] Apache CVE-2001-1556 Remote Security Vulnerability
13706| [89417] Apache Subversion CVE-2016-2167 Authentication Bypass Vulnerability
13707| [89326] RETIRED: Apache Subversion CVE-2016-2167 Security Bypass Vulnerability
13708| [89320] Apache Subversion CVE-2016-2168 Remote Denial of Service Vulnerability
13709| [88826] Apache Struts CVE-2016-3082 Remote Code Execution Vulnerability
13710| [88797] Apache Cordova For iOS CVE-2015-5208 Arbitrary Code Execution Vulnerability
13711| [88764] Apache Cordova iOS CVE-2015-5207 Multiple Security Bypass Vulnerabilities
13712| [88701] Apache CVE-2001-1449 Remote Security Vulnerability
13713| [88635] Apache CVE-2000-1204 Remote Security Vulnerability
13714| [88590] Apache WWW server CVE-1999-1199 Denial-Of-Service Vulnerability
13715| [88496] Apache CVE-2000-1206 Remote Security Vulnerability
13716| [87828] Apache CVE-1999-1237 Remote Security Vulnerability
13717| [87784] Apache CVE-1999-1293 Denial-Of-Service Vulnerability
13718| [87327] Apache Struts CVE-2016-3081 Remote Code Execution Vulnerability
13719| [86622] Apache Stats CVE-2007-0975 Remote Security Vulnerability
13720| [86399] Apache CVE-2007-1743 Local Security Vulnerability
13721| [86397] Apache CVE-2007-1742 Local Security Vulnerability
13722| [86311] Apache Struts CVE-2016-4003 Cross Site Scripting Vulnerability
13723| [86174] Apache Wicket CVE-2015-5347 Cross Site Scripting Vulnerability
13724| [85971] Apache OFBiz CVE-2016-2170 Java Deserialization Remote Code Execution Vulnerability
13725| [85967] Apache OFBiz CVE-2015-3268 HTML Injection Vulnerability
13726| [85759] Apache Jetspeed CVE-2016-2171 Unauthorized Access Vulnerability
13727| [85758] Apache Jetspeed CVE-2016-0712 Cross Site Scripting Vulnerability
13728| [85756] Apache Jetspeed CVE-2016-0710 Multiple SQL Injection Vulnerabilities
13729| [85755] Apache Jetspeed CVE-2016-0711 Mulitple HTML Injection Vulnerabilities
13730| [85754] Apache Jetspeed CVE-2016-0709 Directory Traversal Vulnerability
13731| [85730] Apache Subversion CVE-2015-5343 Integer Overflow Vulnerability
13732| [85691] Apache Ranger CVE-2016-0735 Security Bypass Vulnerability
13733| [85578] Apache ActiveMQ CVE-2010-1244 Cross-Site Request Forgery Vulnerability
13734| [85554] Apache OpenMeetings CVE-2016-2164 Multiple Information Disclosure Vulnerabilities
13735| [85553] Apache OpenMeetings CVE-2016-0783 Information Disclosure Vulnerability
13736| [85552] Apache OpenMeetings CVE-2016-2163 HTML Injection Vulnerability
13737| [85550] Apache OpenMeetings CVE-2016-0784 Directory Traversal Vulnerability
13738| [85386] Apache Hadoop CVE-2015-7430 Local Privilege Escalation Vulnerability
13739| [85377] Apache Qpid Proton Python API CVE-2016-2166 Man in the Middle Security Bypass Vulnerability
13740| [85205] Apache Solr CVE-2015-8796 Cross Site Scripting Vulnerability
13741| [85203] Apache Solr CVE-2015-8795 Mulitple HTML Injection Vulnerabilities
13742| [85163] Apache Geronimo CVE-2008-0732 Local Security Vulnerability
13743| [85131] Apache Struts 'TextParseUtil.translateVariables()' Method Remote Code Execution Vulnerability
13744| [85070] Apache Struts CVE-2016-2162 Cross Site Scripting Vulnerability
13745| [85066] Apache Struts CVE-2016-0785 Remote Code Execution Vulnerability
13746| [84422] Apache TomEE CVE-2016-0779 Unspecified Security Vulnerability
13747| [84321] Apache ActiveMQ CVE-2016-0734 Clickjacking Vulnerability
13748| [84316] Apache ActiveMQ CVE-2016-0782 Multiple Cross Site Scripting Vulnerabilities
13749| [83910] Apache Wicket CVE-2015-7520 Cross Site Scripting Vulnerability
13750| [83423] Apache Xerces-C CVE-2016-0729 Buffer Overflow Vulnerability
13751| [83330] Apache Tomcat CVE-2015-5351 Cross Site Request Forgery Vulnerability
13752| [83329] Apache Tomcat CVE-2015-5174 Directory Traversal Vulnerability
13753| [83328] Apache Tomcat CVE-2015-5345 Directory Traversal Vulnerability
13754| [83327] Apache Tomcat Security Manager CVE-2016-0714 Remote Code Execution Vulnerability
13755| [83326] Apache Tomcat CVE-2016-0763 Security Bypass Vulnerability
13756| [83324] Apache Tomcat Security Manager CVE-2016-0706 Information Disclosure Vulnerability
13757| [83323] Apache Tomcat CVE-2015-5346 Session Fixation Vulnerability
13758| [83259] Apache Hadoop CVE-2015-1776 Information Disclosure Vulnerability
13759| [83243] Apache Solr CVE-2015-8797 Cross Site Scripting Vulnerability
13760| [83119] Apache Sling CVE-2016-0956 Information Disclosure Vulnerability
13761| [83002] Apache CVE-2000-1205 Cross-Site Scripting Vulnerability
13762| [82871] Apache Ranger Authentication Bypass and Security Bypass Vulnerabilities
13763| [82800] Apache CloudStack CVE-2015-3251 Information Disclosure Vulnerability
13764| [82798] Apache CloudStack CVE-2015-3252 Authentication Bypass Vulnerability
13765| [82732] Apache Gallery CVE-2003-0771 Local Security Vulnerability
13766| [82676] Apache CVE-2003-1581 Cross-Site Scripting Vulnerability
13767| [82550] Apache Struts CVE-2015-5209 Security Bypass Vulnerability
13768| [82300] Apache Subversion CVE-2015-5259 Integer Overflow Vulnerability
13769| [82260] Apache Camel CVE-2015-5344 Remote Code Execution Vulnerability
13770| [82234] Apache Hive CVE-2015-7521 Security Bypass Vulnerability
13771| [82082] Apache CVE-1999-0289 Remote Security Vulnerability
13772| [81821] Apache Distribution for Solaris CVE-2007-2080 SQL-Injection Vulnerability
13773| [80696] Apache Camel CVE-2015-5348 Information Disclosure Vulnerability
13774| [80525] Apache CVE-2003-1580 Remote Security Vulnerability
13775| [80354] Drupal Apache Solr Search Module Access Bypass Vulnerability
13776| [80193] Apache CVE-1999-0107 Denial-Of-Service Vulnerability
13777| [79812] Apache Directory Studio CVE-2015-5349 Command Injection Vulnerability
13778| [79744] Apache HBase CVE-2015-1836 Unauthorized Access Vulnerability
13779| [79204] Apache TomEE 'EjbObjectInputStream' Remote Code Execution Vulnerability
13780| [77679] Apache Cordova For Android CVE-2015-8320 Weak Randomization Security Bypass Vulnerability
13781| [77677] Apache Cordova For Android CVE-2015-5256 Security Bypass Vulnerability
13782| [77591] Apache CXF SAML SSO Processing CVE-2015-5253 Security Bypass Vulnerability
13783| [77521] Apache Commons Collections 'InvokerTransformer.java' Remote Code Execution Vulnerability
13784| [77110] Apache HttpComponents HttpClient CVE-2015-5262 Denial of Service Vulnerability
13785| [77086] Apache Ambari CVE-2015-1775 Server Side Request Forgery Security Bypass Vulnerability
13786| [77085] Apache Ambari CVE-2015-3270 Remote Privilege Escalation Vulnerability
13787| [77082] Apache Ambari 'targetURI' Parameter Open Redirection Vulnerability
13788| [77059] Apache Ambari CVE-2015-3186 Cross Site Scripting Vulnerability
13789| [76933] Apache James Server Unspecified Command Execution Vulnerability
13790| [76832] Apache cordova-plugin-file-transfer CVE-2015-5204 HTTP Header Injection Vulnerability
13791| [76625] Apache Struts CVE-2015-5169 Cross Site Scripting Vulnerability
13792| [76624] Apache Struts CVE-2015-2992 Cross Site Scripting Vulnerability
13793| [76522] Apache Tapestry CVE-2014-1972 Security Bypass Vulnerability
13794| [76486] Apache CXF Fediz CVE-2015-5175 Denial of Service Vulnerability
13795| [76452] Apache ActiveMQ CVE-2015-1830 Directory Traversal Vulnerability
13796| [76446] Apache Subversion 'libsvn_fs_fs/tree.c' Denial of Service Vulnerability
13797| [76274] Apache Subversion CVE-2015-3184 Information Disclosure Vulnerability
13798| [76273] Apache Subversion CVE-2015-3187 Information Disclosure Vulnerability
13799| [76272] Apache ActiveMQ CVE-2014-3576 Denial of Service Vulnerability
13800| [76221] Apache Ranger CVE-2015-0266 Access Bypass Vulnerability
13801| [76208] Apache Ranger CVE-2015-0265 JavaScript Code Injection Vulnerability
13802| [76025] Apache ActiveMQ Artemis CVE-2015-3208 XML External Entity Information Disclosure Vulnerability
13803| [75965] Apache HTTP Server CVE-2015-3185 Security Bypass Vulnerability
13804| [75964] Apache HTTP Server CVE-2015-0253 Remote Denial of Service Vulnerability
13805| [75963] Apache HTTP Server CVE-2015-3183 Security Vulnerability
13806| [75940] Apache Struts CVE-2015-1831 Security Bypass Vulnerability
13807| [75919] Apache Groovy CVE-2015-3253 Remote Code Execution Vulnerability
13808| [75338] Apache Storm CVE-2015-3188 Remote Code Execution Vulnerability
13809| [75275] Drupal Apache Solr Real-Time Module Access Bypass Vulnerability
13810| [74866] Apache Cordova For Android CVE-2015-1835 Security Bypass Vulnerability
13811| [74839] Apache Sling API and Sling Servlets CVE-2015-2944 Cross Site Scripting Vulnerability
13812| [74761] Apache Jackrabbit CVE-2015-1833 XML External Entity Information Disclosure Vulnerability
13813| [74686] Apache Ambari '/var/lib/ambari-server/ambari-env.sh' Local Privilege Escalation Vulnerability
13814| [74665] Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability
13815| [74475] Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability
13816| [74423] Apache Struts CVE-2015-0899 Security Bypass Vulnerability
13817| [74338] Apache OpenOffice HWP Filter Memory Corruption Vulnerability
13818| [74265] Apache Tomcat 'mod_jk' CVE-2014-8111 Information Disclosure Vulnerability
13819| [74260] Apache Subversion CVE-2015-0248 Multiple Denial of Service Vulnerabilities
13820| [74259] Apache Subversion 'deadprops.c' Security Bypass Vulnerability
13821| [74204] PHP 'sapi/apache2handler/sapi_apache2.c' Remote Code Execution Vulnerability
13822| [74158] Apache HTTP Server 'protocol.c' Remote Denial of Service Vulnerability
13823| [73954] Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability
13824| [73851] Apache2 CVE-2012-0216 Cross-Site Scripting Vulnerability
13825| [73478] Apache Cassandra CVE-2015-0225 Remote Code Execution Vulnerability
13826| [73041] Apache HTTP Server 'mod_lua' Module Denial of Service Vulnerability
13827| [73040] Apache HTTP Server 'mod_lua.c' Local Access Bypass Vulnerability
13828| [72809] Apache Standard Taglibs CVE-2015-0254 XML External Entity Injection Vulnerability
13829| [72717] Apache Tomcat CVE-2014-0227 Chunk Request Remote Denial Of Service Vulnerability
13830| [72557] Apache WSS4J CVE-2015-0227 Security Bypass Vulnerability
13831| [72553] Apache WSS4J CVE-2015-0226 Information Disclosure Vulnerability
13832| [72513] Apache ActiveMQ CVE-2014-3612 LDAP Authentication Bypass Vulnerability
13833| [72511] Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities
13834| [72510] Apache ActiveMQ CVE-2014-3600 XML External Entity Injection Vulnerability
13835| [72508] Apache ActiveMQ Apollo CVE-2014-3579 XML External Entity Injection Vulnerability
13836| [72319] Apache Qpid CVE-2015-0223 Security Bypass Vulnerability
13837| [72317] Apache Qpid CVE-2015-0224 Incomplete Fix Multiple Denial of Service Vulnerabilities
13838| [72115] Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability
13839| [72053] Apache HTTP Server 'mod_remoteip.c' IP Address Spoofing Vulnerability
13840| [72030] Apache Qpid CVE-2015-0203 Multiple Denial of Service Vulnerabilities
13841| [71879] Apache Traffic Server 'HttpTransact.cc' Denial of Service Vulnerability
13842| [71726] Apache Subversion CVE-2014-3580 Remote Denial of Service Vulnerability
13843| [71725] Apache Subversion CVE-2014-8108 Remote Denial of Service Vulnerability
13844| [71657] Apache HTTP Server 'mod_proxy_fcgi' Module Denial of Service Vulnerability
13845| [71656] Apache HTTP Server 'mod_cache' Module Denial of Service Vulnerability
13846| [71548] Apache Struts CVE-2014-7809 Security Bypass Vulnerability
13847| [71466] Apache Hadoop CVE-2014-3627 Information Disclosure Vulnerability
13848| [71353] Apache HTTP Server 'LuaAuthzProvider' Authorization Bypass Vulnerability
13849| [71004] Apache Qpid CVE-2014-3629 XML External Entity Injection Vulnerability
13850| [70970] Apache Traffic Server Cross Site Scripting Vulnerability
13851| [70738] Apache CXF CVE-2014-3584 Denial of Service Vulnerability
13852| [70736] Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
13853| [69728] Apache Tomcat CVE-2013-4444 Arbitrary File Upload Vulnerability
13854| [69648] Apache POI CVE-2014-3574 Denial Of Service Vulnerability
13855| [69647] Apache POI OpenXML parser CVE-2014-3529 XML External Entity Information Disclosure Vulnerability
13856| [69351] Apache OpenOffice Calc CVE-2014-3524 Command Injection Vulnerability
13857| [69295] Apache Axis Incomplete Fix CVE-2014-3596 SSL Certificate Validation Security Bypass Vulnerability
13858| [69286] Apache OFBiz CVE-2014-0232 Multiple Cross Site Scripting Vulnerabilities
13859| [69258] Apache HttpComponents Incomplete Fix CVE-2014-3577 SSL Validation Security Bypass Vulnerability
13860| [69257] Apache HttpComponents Incomplete Fix SSL Certificate Validation Security Bypass Vulnerability
13861| [69248] Apache HTTP Server CVE-2013-4352 Remote Denial of Service Vulnerability
13862| [69237] Apache Subversion CVE-2014-3522 SSL Certificate Validation Information Disclosure Vulnerability
13863| [69173] Apache Traffic Server CVE-2014-3525 Unspecified Security Vulnerability
13864| [69046] Apache Cordova For Android CVE-2014-3502 Information Disclosure Vulnerability
13865| [69041] Apache Cordova For Android CVE-2014-3501 Security Bypass Vulnerability
13866| [69038] Apache Cordova For Android CVE-2014-3500 Security Bypass Vulnerability
13867| [68995] Apache Subversion CVE-2014-3528 Insecure Authentication Weakness
13868| [68966] Apache Subversion 'irkerbridge.py' Local Privilege Escalation Vulnerability
13869| [68965] Apache Subversion 'svnwcsub.py' Local Privilege Escalation Vulnerability
13870| [68863] Apache HTTP Server 'mod_cache' Module Remote Denial of Service Vulnerability
13871| [68747] Apache HTTP Server CVE-2014-3523 Remote Denial of Service Vulnerability
13872| [68745] Apache HTTP Server CVE-2014-0118 Remote Denial of Service Vulnerability
13873| [68742] Apache HTTP Server CVE-2014-0231 Remote Denial of Service Vulnerability
13874| [68740] Apache HTTP Server CVE-2014-0117 Remote Denial of Service Vulnerability
13875| [68678] Apache HTTP Server 'mod_status' CVE-2014-0226 Remote Code Execution Vulnerability
13876| [68445] Apache CXF UsernameToken Information Disclosure Vulnerability
13877| [68441] Apache CXF SAML Tokens Validation Security Bypass Vulnerability
13878| [68431] Apache Syncope CVE-2014-3503 Insecure Password Generation Weakness
13879| [68229] Apache Harmony PRNG Entropy Weakness
13880| [68111] Apache 'mod_wsgi' Module Privilege Escalation Vulnerability
13881| [68072] Apache Tomcat CVE-2014-0186 Remote Denial of Service Vulnerability
13882| [68039] Apache Hive CVE-2014-0228 Security Bypass Vulnerability
13883| [67673] Apache Tomcat CVE-2014-0095 AJP Request Remote Denial Of Service Vulnerability
13884| [67671] Apache Tomcat CVE-2014-0075 Chunk Request Remote Denial Of Service Vulnerability
13885| [67669] Apache Tomcat CVE-2014-0119 XML External Entity Information Disclosure Vulnerability
13886| [67668] Apache Tomcat CVE-2014-0099 Request Processing Information Disclosure Vulnerability
13887| [67667] Apache Tomcat CVE-2014-0096 XML External Entity Information Disclosure Vulnerability
13888| [67534] Apache 'mod_wsgi' Module CVE-2014-0242 Information Disclosure Vulnerability
13889| [67532] Apache 'mod_wsgi' Module Local Privilege Escalation Vulnerability
13890| [67530] Apache Solr Search Template Cross Site Scripting Vulnerability
13891| [67236] Apache CXF CVE-2014-0109 Remote Denial of Service Vulnerability
13892| [67232] Apache CXF CVE-2014-0110 Denial of Service Vulnerability
13893| [67121] Apache Struts ClassLoader Manipulation CVE-2014-0114 Security Bypass Vulnerability
13894| [67081] Apache Struts 'getClass()' Method Security Bypass Vulnerability
13895| [67064] Apache Struts ClassLoader Manipulation Incomplete Fix Security Bypass Vulnerability
13896| [67013] Apache Zookeeper CVE-2014-0085 Local Information Disclosure Vulnerability
13897| [66998] Apache Archiva CVE-2013-2187 Unspecified Cross Site Scripting Vulnerability
13898| [66991] Apache Archiva CVE-2013-2187 HTML Injection Vulnerability
13899| [66927] Apache Syncope CVE-2014-0111 Remote Code Execution Vulnerability
13900| [66474] Apache CouchDB Universally Unique IDentifier (UUID) Remote Denial of Service Vulnerability
13901| [66397] Apache Xalan-Java Library CVE-2014-0107 Security Bypass Vulnerability
13902| [66303] Apache HTTP Server Multiple Denial of Service Vulnerabilities
13903| [66041] RETIRED: Apache Struts CVE-2014-0094 Classloader Manipulation Security Bypass Vulnerability
13904| [65999] Apache Struts ClassLoader Manipulation CVE-2014-0094 Security Bypass Vulnerability
13905| [65967] Apache Cordova File-Transfer Unspecified Security Vulnerability
13906| [65959] Apache Cordova InAppBrowser Remote Privilege Escalation Vulnerability
13907| [65935] Apache Shiro 'login.jsp' Authentication Bypass Vulnerability
13908| [65902] Apache Camel CVE-2014-0003 Remote Code Execution Vulnerability
13909| [65901] Apache Camel CVE-2014-0002 XML External Entity Information Disclosure Vulnerability
13910| [65773] Apache Tomcat CVE-2013-4286 Security Bypass Vulnerability
13911| [65769] Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability
13912| [65768] Apache Tomcat CVE-2013-4590 XML External Entity Information Disclosure Vulnerability
13913| [65767] Apache Tomcat CVE-2013-4322 Incomplete Fix Denial of Service Vulnerability
13914| [65615] Apache ActiveMQ 'refresh' Parameter Cross Site Scripting Vulnerability
13915| [65434] Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability
13916| [65431] Apache Wicket CVE-2013-2055 Information Disclosure Vulnerability
13917| [65400] Apache Commons FileUpload CVE-2014-0050 Denial Of Service Vulnerability
13918| [64782] Apache CloudStack Virtual Router Component Security Bypass Vulnerability
13919| [64780] Apache CloudStack Unauthorized Access Vulnerability
13920| [64617] Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
13921| [64437] Apache Santuario XML Security For JAVA XML Signature Denial of Service Vulnerability
13922| [64427] Apache Solr Multiple XML External Entity Injection Vulnerabilities
13923| [64009] Apache Solr CVE-2013-6408 XML External Entity Injection Vulnerability
13924| [64008] Apache Solr CVE-2013-6407 XML External Entity Injection Vulnerability
13925| [63981] Apache Subversion 'mod_dav_svn' Module Denial of Service Vulnerability
13926| [63966] Apache Subversion CVE-2013-4505 Security Bypass Vulnerability
13927| [63963] Apache Roller CVE-2013-4171 Cross Site Scripting Vulnerability
13928| [63935] Apache Solr 'SolrResourceLoader' Directory Traversal Vulnerability
13929| [63928] Apache Roller CVE-2013-4212 OGNL Expression Injection Remote Code Execution Vulnerability
13930| [63515] Apache Tomcat Manager Component CVE-2013-6357 Cross Site Request Forgery Vulnerability
13931| [63403] Apache Struts Multiple Cross Site Scripting Vulnerabilities
13932| [63400] Apache 'mod_pagespeed' Module Unspecified Cross Site Scripting Vulnerability
13933| [63260] Apache Shindig CVE-2013-4295 XML External Entity Information Disclosure Vulnerability
13934| [63241] Apache Sling 'AbstractAuthenticationFormServlet' Open Redirection Vulnerability
13935| [63174] Apache Commons FileUpload 'DiskFileItem' Class Null Byte Arbitrary File Write Vulnerability
13936| [62939] Apache 'mod_fcgid' Module CVE-2013-4365 Heap Buffer Overflow Vulnerability
13937| [62903] Apache Sling 'deepGetOrCreateNode()' Function Denial Of Service Vulnerability
13938| [62706] Apache Camel CVE-2013-4330 Information Disclosure Vulnerability
13939| [62677] Apache 'mod_accounting' Module CVE-2013-5697 SQL Injection Vulnerability
13940| [62674] TYPO3 Apache Solr Unspecified Cross Site Scripting and PHP Code Execution Vulnerabilities
13941| [62587] Apache Struts CVE-2013-4316 Remote Code Execution Vulnerability
13942| [62584] Apache Struts CVE-2013-4310 Security Bypass Vulnerability
13943| [62266] Apache Subversion CVE-2013-4277 Insecure Temporary File Creation Vulnerability
13944| [61984] Apache Hadoop RPC Authentication CVE-2013-2192 Man in the Middle Security Bypass Vulnerability
13945| [61981] Apache HBase RPC Authentication Man In The Middle Security Bypass Vulnerability
13946| [61638] Apache CloudStack CVE-2013-2136 Multiple Cross Site Scripting Vulnerabilities
13947| [61454] Apache Subversion CVE-2013-4131 Denial Of Service Vulnerability
13948| [61379] Apache HTTP Server CVE-2013-2249 Unspecified Remote Security Vulnerability
13949| [61370] Apache OFBiz CVE-2013-2317 'View Log' Cross Site Scripting Vulnerability
13950| [61369] Apache OFBiz Nested Expression Remote Code Execution Vulnerability
13951| [61196] Apache Struts CVE-2013-2248 Multiple Open Redirection Vulnerabilities
13952| [61189] Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities
13953| [61129] Apache HTTP Server CVE-2013-1896 Remote Denial of Service Vulnerability
13954| [61030] Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities
13955| [60875] Apache Geronimo RMI Classloader Security Bypass Vulnerability
13956| [60846] Apache Santuario XML Security for JAVA XML Signature CVE-2013-2172 Security Bypass Vulnerability
13957| [60817] Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability
13958| [60800] Apache Qpid Python Client SSL Certificate Verification Information Disclosure Vulnerability
13959| [60599] Apache Santuario XML Security for C++ CVE-2013-2156 Remote Heap Buffer Overflow Vulnerability
13960| [60595] Apache Santuario XML Security for C++ XML Signature CVE-2013-2155 Denial of Service Vulnerability
13961| [60594] Apache Santuario XML Security for C++ CVE-2013-2154 Stack Buffer Overflow Vulnerability
13962| [60592] Apache Santuario XML Security for C++ XML Signature CVE-2013-2153 Security Bypass Vulnerability
13963| [60534] Apache OpenJPA Object Deserialization Arbitrary File Creation or Overwrite Vulnerability
13964| [60346] Apache Struts CVE-2013-2134 OGNL Expression Injection Vulnerability
13965| [60345] Apache Struts CVE-2013-2135 OGNL Expression Injection Vulnerability
13966| [60267] Apache Subversion CVE-2013-1968 Remote Denial of Service Vulnerability
13967| [60265] Apache Subversion CVE-2013-2088 Command Injection Vulnerability
13968| [60264] Apache Subversion CVE-2013-2112 Remote Denial of Service Vulnerability
13969| [60187] Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness
13970| [60186] Apache Tomcat CVE-2013-1976 Insecure Temporary File Handling Vulnerability
13971| [60167] Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability
13972| [60166] Apache Struts 'includeParams' CVE-2013-1966 Security Bypass Vulnerability
13973| [60082] Apache Struts 'ParameterInterceptor' Class OGNL CVE-2013-1965 Security Bypass Vulnerability
13974| [59826] Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability
13975| [59799] Apache Tomcat CVE-2013-2067 Session Fixation Vulnerability
13976| [59798] Apache Tomcat CVE-2013-2071 Information Disclosure Vulnerability
13977| [59797] Apache Tomcat CVE-2012-3544 Denial of Service Vulnerability
13978| [59670] Apache VCL Multiple Input Validation Vulnerabilities
13979| [59464] Apache CloudStack CVE-2013-2758 Hash Information Disclosure Vulnerability
13980| [59463] Apache CloudStack CVE-2013-2756 Authentication Bypass Vulnerability
13981| [59402] Apache ActiveMQ CVE-2013-3060 Information Disclosure and Denial of Service Vulnerability
13982| [59401] Apache ActiveMQ CVE-2012-6551 Denial of Service Vulnerability
13983| [59400] Apache ActiveMQ CVE-2012-6092 Multiple Cross Site Scripting Vulnerabilities
13984| [58898] Apache Subversion CVE-2013-1884 Remote Denial of Service Vulnerability
13985| [58897] Apache Subversion 'mod_dav_svn/lock.c' Remote Denial of Service Vulnerability
13986| [58895] Apache Subversion 'mod_dav_svn' Remote Denial of Service Vulnerability
13987| [58455] Apache Rave User RPC API CVE-2013-1814 Information Disclosure Vulnerability
13988| [58379] Apache Qpid CVE-2012-4446 Authentication Bypass Vulnerability
13989| [58378] Apache Qpid CVE-2012-4460 Denial of Service Vulnerability
13990| [58376] Apache Qpid CVE-2012-4458 Denial of Service Vulnerability
13991| [58337] Apache Qpid CVE-2012-4459 Denial of Service Vulnerability
13992| [58326] Apache Commons FileUpload CVE-2013-0248 Insecure Temporary File Creation Vulnerability
13993| [58325] Debian Apache HTTP Server CVE-2013-1048 Symlink Attack Local Privilege Escalation Vulnerability
13994| [58323] Apache Subversion 'svn_fs_file_length()' Remote Denial of Service Vulnerability
13995| [58165] Apache HTTP Server Multiple Cross Site Scripting Vulnerabilities
13996| [58136] Apache Maven CVE-2013-0253 SSL Certificate Validation Security Bypass Vulnerability
13997| [58124] Apache Tomcat 'log/logdir' Directory Insecure File Permissions Vulnerability
13998| [58073] Apache Commons HttpClient CVE-2012-5783 SSL Certificate Validation Security Bypass Vulnerability
13999| [57876] Apache CXF WS-SecurityPolicy Authentication Bypass Vulnerability
14000| [57874] Apache CXF CVE-2012-5633 Security Bypass Vulnerability
14001| [57463] Apache OFBiz CVE-2013-0177 Multiple Cross Site Scripting Vulnerabilities
14002| [57425] Apache CXF CVE-2012-5786 SSL Certificate Validation Security Bypass Vulnerability
14003| [57321] Apache CouchDB CVE-2012-5650 Cross Site Scripting Vulnerability
14004| [57314] Apache CouchDB CVE-2012-5649 Remote Code Execution Vulnerability
14005| [57267] Apache Axis2/C SSL Certificate Validation Security Bypass Vulnerability
14006| [57259] Apache CloudStack CVE-2012-5616 Local Information Disclosure Vulnerability
14007| [56814] Apache Tomcat CVE-2012-4431 Cross-Site Request Forgery Vulnerability
14008| [56813] Apache Tomcat CVE-2012-4534 Denial of Service Vulnerability
14009| [56812] Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability
14010| [56753] Apache Apache HTTP Server 'mod_proxy_ajp Module Denial Of Service Vulnerability
14011| [56686] Apache Tomcat CVE-2012-5568 Denial of Service Vulnerability
14012| [56408] Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability
14013| [56403] Apache Tomcat DIGEST Authentication Multiple Security Weaknesses
14014| [56402] Apache Tomcat CVE-2012-2733 Denial of Service Vulnerability
14015| [56171] Apache OFBiz CVE-2012-3506 Unspecified Security Vulnerability
14016| [55876] Apache CloudStack CVE-2012-4501 Security Bypass Vulnerability
14017| [55628] Apache CXF SOAP Action Spoofing Security Bypass Vulnerability
14018| [55608] Apache Qpid (qpidd) Denial of Service Vulnerability
14019| [55536] Apache 'mod_pagespeed' Module Cross Site Scripting and Security Bypass Vulnerabilities
14020| [55508] Apache Axis2 XML Signature Wrapping Security Vulnerability
14021| [55445] Apache Wicket CVE-2012-3373 Cross Site Scripting Vulnerability
14022| [55346] Apache Struts Cross Site Request Forgery and Denial of Service Vulnerabilities
14023| [55290] Drupal Apache Solr Autocomplete Module Cross Site Scripting Vulnerability
14024| [55165] Apache Struts2 Skill Name Remote Code Execution Vulnerability
14025| [55154] Apache 'mod-rpaf' Module Denial of Service Vulnerability
14026| [55131] Apache HTTP Server HTML-Injection And Information Disclosure Vulnerabilities
14027| [54954] Apache QPID NullAuthenticator Authentication Bypass Vulnerability
14028| [54798] Apache Libcloud Man In The Middle Vulnerability
14029| [54358] Apache Hadoop CVE-2012-3376 Information Disclosure Vulnerability
14030| [54341] Apache Sling CVE-2012-2138 Denial Of Service Vulnerability
14031| [54268] Apache Hadoop Symlink Attack Local Privilege Escalation Vulnerability
14032| [54189] Apache Roller Cross Site Request Forgery Vulnerability
14033| [54187] Apache Roller CVE-2012-2381 Cross Site Scripting Vulnerability
14034| [53880] Apache CXF Child Policies Security Bypass Vulnerability
14035| [53877] Apache CXF Elements Validation Security Bypass Vulnerability
14036| [53676] Apache Commons Compress and Apache Ant CVE-2012-2098 Denial Of Service Vulnerability
14037| [53487] Apache POI CVE-2012-0213 Denial Of Service Vulnerability
14038| [53455] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability
14039| [53305] Apache Qpid CVE-2011-3620 Unauthorized Access Security Bypass Vulnerability
14040| [53046] Apache HTTP Server 'LD_LIBRARY_PATH' Insecure Library Loading Arbitrary Code Execution Vulnerability
14041| [53025] Apache OFBiz Unspecified Remote Code Execution Vulnerability
14042| [53023] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
14043| [52939] Apache Hadoop CVE-2012-1574 Unspecified User Impersonation Vulnerability
14044| [52702] Apache Struts2 'XSLTResult.java' Remote Arbitrary File Upload Vulnerability
14045| [52696] Apache Traffic Server HTTP Host Header Handling Heap Based Buffer Overflow Vulnerability
14046| [52680] Apache Wicket 'pageMapName' Parameter Cross Site Scripting Vulnerability
14047| [52679] Apache Wicket Hidden Files Information Disclosure Vulnerability
14048| [52565] Apache 'mod_fcgid' Module Denial Of Service Vulnerability
14049| [52146] TYPO3 Apache Solr Extension Unspecified Cross Site Scripting Vulnerability
14050| [51939] Apache MyFaces 'ln' Parameter Information Disclosure Vulnerability
14051| [51917] Apache APR Hash Collision Denial Of Service Vulnerability
14052| [51902] Apache Struts Multiple HTML Injection Vulnerabilities
14053| [51900] Apache Struts CVE-2012-1007 Multiple Cross Site Scripting Vulnerabilities
14054| [51886] Apache CXF UsernameToken Policy Validation Security Bypass Vulnerability
14055| [51869] Apache HTTP Server CVE-2011-3639 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
14056| [51706] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
14057| [51705] Apache HTTP Server CVE-2012-0021 mod_log_config Denial Of Service Vulnerability
14058| [51628] Apache Struts 'ParameterInterceptor' Class OGNL (CVE-2011-3923) Security Bypass Vulnerability
14059| [51447] Apache Tomcat Parameter Handling Denial of Service Vulnerability
14060| [51442] Apache Tomcat Request Object Security Bypass Vulnerability
14061| [51407] Apache HTTP Server Scoreboard Local Security Bypass Vulnerability
14062| [51257] Apache Struts Remote Command Execution and Arbitrary File Overwrite Vulnerabilities
14063| [51238] Apache Geronimo Hash Collision Denial Of Service Vulnerability
14064| [51200] Apache Tomcat Hash Collision Denial Of Service Vulnerability
14065| [50940] Apache Struts Session Tampering Security Bypass Vulnerability
14066| [50912] RETIRED: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability
14067| [50904] Apache ActiveMQ Failover Mechanism Remote Denial Of Service Vulnerability
14068| [50848] Apache MyFaces EL Expression Evaluation Security Bypass Vulnerability
14069| [50802] Apache HTTP Server 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
14070| [50639] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
14071| [50603] Apache Tomcat Manager Application Security Bypass Vulnerability
14072| [50494] Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
14073| [49957] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
14074| [49762] Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses
14075| [49728] Apache Struts Conversion Error OGNL Expression Evaluation Vulnerability
14076| [49616] Apache HTTP Server CVE-2011-3348 Denial Of Service Vulnerability
14077| [49470] Apache Tomcat CVE-2007-6286 Duplicate Request Processing Security Vulnerability
14078| [49353] Apache Tomcat AJP Protocol Security Bypass Vulnerability
14079| [49303] Apache HTTP Server CVE-2011-3192 Denial Of Service Vulnerability
14080| [49290] Apache Wicket Cross Site Scripting Vulnerability
14081| [49147] Apache Tomcat CVE-2011-2481 Information Disclosure Vulnerability
14082| [49143] Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability
14083| [48667] Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
14084| [48653] Apache 'mod_authnz_external' Module SQL Injection Vulnerability
14085| [48611] Apache XML Security for C++ Signature Key Parsing Denial of Service Vulnerability
14086| [48456] Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability
14087| [48015] Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities
14088| [48011] Apache Archiva Multiple Cross Site Scripting and HTML Injection Vulnerabilities
14089| [47929] Apache APR 'apr_fnmatch.c' Denial of Service Vulnerability
14090| [47890] Apache Struts 'javatemplates' Plugin Multiple Cross Site Scripting Vulnerabilities
14091| [47886] Apache Tomcat SecurityConstraints Security Bypass Vulnerability
14092| [47820] Apache APR 'apr_fnmatch()' Denial of Service Vulnerability
14093| [47784] Apache Struts XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability
14094| [47199] Apache Tomcat HTTP BIO Connector Information Disclosure Vulnerability
14095| [47196] Apache Tomcat Login Constraints Security Bypass Vulnerability
14096| [46974] Apache HttpComponents 'HttpClient' Information Disclosure Vulnerability
14097| [46953] Apache MPM-ITK Module Security Weakness
14098| [46734] Subversion 'mod_dav_svn' Apache Server NULL Pointer Dereference Denial Of Service Vulnerability
14099| [46685] Apache Tomcat '@ServletSecurity' Annotations Security Bypass Vulnerability
14100| [46311] Apache Continuum and Archiva Cross Site Scripting Vulnerability
14101| [46177] Apache Tomcat SecurityManager Security Bypass Vulnerability
14102| [46174] Apache Tomcat HTML Manager Interface HTML Injection Vulnerability
14103| [46166] Apache Tomcat JVM Denial of Service Vulnerability
14104| [46164] Apache Tomcat NIO Connector Denial of Service Vulnerability
14105| [46066] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
14106| [45655] Apache Subversion Server Component Multiple Remote Denial Of Service Vulnerabilities
14107| [45123] Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
14108| [45095] Apache Archiva Cross Site Request Forgery Vulnerability
14109| [45015] Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities
14110| [44900] Apache 'mod_fcgid' Module Unspecified Stack Buffer Overflow Vulnerability
14111| [44616] Apache Shiro Directory Traversal Vulnerability
14112| [44355] Apache MyFaces Encrypted View State Oracle Padding Security Vulnerability
14113| [44068] Apache::AuthenHook Local Information Disclosure Vulnerability
14114| [43862] Apache QPID SSL Connection Denial of Service Vulnerability
14115| [43673] Apache APR-util 'apr_brigade_split_line()' Denial of Service Vulnerability
14116| [43637] Apache XML-RPC SAX Parser Information Disclosure Vulnerability
14117| [43111] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
14118| [42637] Apache Derby 'BUILTIN' Authentication Insecure Password Hashing Vulnerability
14119| [42501] Apache CouchDB Cross Site Request Forgery Vulnerability
14120| [42492] Apache CXF XML DTD Processing Security Vulnerability
14121| [42121] Apache SLMS Insufficient Quoting Cross Site Request Forgery Vulnerability
14122| [42102] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
14123| [41963] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
14124| [41544] Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities
14125| [41076] Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability
14126| [40976] Apache Axis2 Document Type Declaration Processing Security Vulnerability
14127| [40827] Apache 'mod_proxy_http' Timeout Handling Information Disclosure Vulnerability
14128| [40343] Apache Axis2 'xsd' Parameter Directory Traversal Vulnerability
14129| [40327] Apache Axis2 'engagingglobally' Cross-Site Scripting Vulnerability
14130| [39771] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
14131| [39636] Apache ActiveMQ Source Code Information Disclosure Vulnerability
14132| [39635] Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability
14133| [39538] Apache mod_auth_shadow Race Condition Security Bypass Vulnerability
14134| [39489] Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities
14135| [39119] Apache ActiveMQ 'createDestination.action' HTML Injection Vulnerability
14136| [38580] Apache Subrequest Handling Information Disclosure Vulnerability
14137| [38494] Apache 'mod_isapi' Memory Corruption Vulnerability
14138| [38491] Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability
14139| [37966] Apache 1.3 mod_proxy HTTP Chunked Encoding Integer Overflow Vulnerability
14140| [37945] Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability
14141| [37944] Apache Tomcat WAR File Directory Traversal Vulnerability
14142| [37942] Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability
14143| [37149] Apache Tomcat 404 Error Page Cross Site Scripting Vulnerability
14144| [37027] RETIRED: Apache APR 'apr_uri_parse_hostinfo' Off By One Remote Code Execution Vulnerability
14145| [36990] Apache HTTP TRACE Cross Site Scripting Vulnerability
14146| [36954] Apache Tomcat Windows Installer Insecure Password Vulnerability
14147| [36889] TYPO3 Apache Solr Search Extension Unspecified Cross Site Scripting Vulnerability
14148| [36596] Apache HTTP Server Solaris Event Port Pollset Support Remote Denial Of Service Vulnerability
14149| [36260] Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
14150| [36254] Apache mod_proxy_ftp Remote Command Injection Vulnerability
14151| [35949] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
14152| [35840] Apache HTTP Server HTTP-Basic Authentication Bypass Vulnerability
14153| [35623] Apache 'mod_deflate' Remote Denial Of Service Vulnerability
14154| [35565] Apache 'mod_proxy' Remote Denial Of Service Vulnerability
14155| [35416] Apache Tomcat XML Parser Information Disclosure Vulnerability
14156| [35263] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
14157| [35253] Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
14158| [35251] Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
14159| [35221] Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
14160| [35196] Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
14161| [35193] Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
14162| [35115] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
14163| [34686] Apache Struts Multiple Cross Site Scripting Vulnerabilities
14164| [34663] Apache 'mod_proxy_ajp' Information Disclosure Vulnerability
14165| [34657] Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities
14166| [34562] Apache Geronimo Application Server Multiple Remote Vulnerabilities
14167| [34552] Apache ActiveMQ Web Console Multiple Unspecified HTML Injection Vulnerabilities
14168| [34412] Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability
14169| [34399] Apache Struts Unspecified Cross Site Scripting Vulnerability
14170| [34383] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
14171| [33913] Apache Tomcat POST Data Information Disclosure Vulnerability
14172| [33360] Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities
14173| [33110] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
14174| [32657] Novell NetWare ApacheAdmin Security Bypass Vulnerability
14175| [31805] Apache HTTP Server OS Fingerprinting Unspecified Security Vulnerability
14176| [31761] Oracle WebLogic Server Apache Connector Stack Based Buffer Overflow Vulnerability
14177| [31698] Apache Tomcat 'RemoteFilterValve' Security Bypass Vulnerability
14178| [31165] Kolab Groupware Server Apache Log File User Password Information Disclosure Vulnerability
14179| [30560] Apache 'mod_proxy_ftp' Wildcard Characters Cross-Site Scripting Vulnerability
14180| [30496] Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability
14181| [30494] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
14182| [29653] Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
14183| [29502] Apache Tomcat Host Manager Cross Site Scripting Vulnerability
14184| [28576] Apache-SSL Environment Variable Information Disclosure and Privilege Escalation Vulnerability
14185| [28484] Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability
14186| [28483] Apache Tomcat 'allowLinking' Accepts NULL Byte in URI Information Disclosure Vulnerability
14187| [28482] Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability
14188| [28481] Apache Tomcat Cross-Site Scripting Vulnerability
14189| [28477] Apache Tomcat AJP Connector Information Disclosure Vulnerability
14190| [27752] Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulnerabilities
14191| [27706] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
14192| [27703] Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
14193| [27409] Apache 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
14194| [27365] Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
14195| [27237] Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
14196| [27236] Apache 'mod_proxy_balancer' Multiple Vulnerabilities
14197| [27234] Apache 'mod_proxy_ftp' Undefined Charset UTF-7 Cross-Site Scripting Vulnerability
14198| [27006] Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
14199| [26939] Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
14200| [26838] Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
14201| [26762] Apache::AuthCAS Cookie SQL Injection Vulnerability
14202| [26663] Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness
14203| [26287] Apache Geronimo SQLLoginModule Authentication Bypass Vulnerability
14204| [26070] Apache Tomcat WebDav Remote Information Disclosure Vulnerability
14205| [25804] Apache Geronimo Management EJB Security Bypass Vulnerability
14206| [25653] Apache Mod_AutoIndex.C Undefined Charset Cross-Site Scripting Vulnerability
14207| [25531] Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
14208| [25489] Apache HTTP Server Mod_Proxy Denial of Service Vulnerability
14209| [25316] Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
14210| [25314] Apache Tomcat Host Manager Servlet Cross Site Scripting Vulnerability
14211| [25174] Apache Tomcat Error Message Reporting Cross Site Scripting Vulnerability
14212| [24999] Apache Tomcat SendMailServlet Cross-Site Scripting Vulnerability
14213| [24759] MySQLDumper Apache Access Control Authentication Bypass Vulnerability
14214| [24649] Apache HTTP Server Mod_Cache Denial of Service Vulnerability
14215| [24645] Apache HTTP Server Mod_Status Cross-Site Scripting Vulnerability
14216| [24553] Apache Mod_Mem_Cache Information Disclosure Vulnerability
14217| [24524] Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
14218| [24480] Apache MyFaces Tomahawk JSF Framework Autoscroll Parameter Cross Site Scripting Vulnerability
14219| [24476] Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
14220| [24475] Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability
14221| [24215] Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
14222| [24147] Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
14223| [24058] Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
14224| [23687] Apache AXIS Non-Existent WSDL Path Information Disclosure Vulnerability
14225| [23438] Apache HTTPD suEXEC Local Multiple Privilege Escalation Weaknesses
14226| [22960] Apache HTTP Server Tomcat Directory Traversal Vulnerability
14227| [22849] Apache mod_python Output Filter Mode Information Disclosure Vulnerability
14228| [22791] Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability
14229| [22732] Debian Apache Root Shell Local Privilege Escalation Vulnerabilities
14230| [22388] Apache Stats Extract Function Multiple Input Validation Vulnerabilities
14231| [21865] Apache And Microsoft IIS Range Denial of Service Vulnerability
14232| [21214] Apache Mod_Auth_Kerb Off-By-One Denial of Service Vulnerability
14233| [20527] Apache Mod_TCL Remote Format String Vulnerability
14234| [19661] Apache HTTP Server Arbitrary HTTP Request Headers Security Weakness
14235| [19447] Apache CGI Script Source Code Information Disclosure Vulnerability
14236| [19204] Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
14237| [19106] Apache Tomcat Information Disclosure Vulnerability
14238| [18138] Apache James SMTP Denial Of Service Vulnerability
14239| [17342] Apache Struts Multiple Remote Vulnerabilities
14240| [17095] Apache Log4Net Denial Of Service Vulnerability
14241| [16916] Apache mod_python FileSession Code Execution Vulnerability
14242| [16710] Apache Libapreq2 Quadratic Behavior Denial of Service Vulnerability
14243| [16260] Apache Geronimo Multiple Input Validation Vulnerabilities
14244| [16153] Apache mod_auth_pgsql Multiple Format String Vulnerabilities
14245| [16152] Apache Mod_SSL Custom Error Document Remote Denial Of Service Vulnerability
14246| [15834] Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability
14247| [15765] Apache James Spooler Memory Leak Denial Of Service Vulnerability
14248| [15762] Apache MPM Worker.C Denial Of Service Vulnerability
14249| [15512] Apache Struts Error Response Cross-Site Scripting Vulnerability
14250| [15413] PHP Apache 2 Virtual() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
14251| [15325] Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
14252| [15224] Apache Mod_Auth_Shadow Authentication Bypass Vulnerability
14253| [15177] PHP Apache 2 Local Denial of Service Vulnerability
14254| [14982] ApacheTop Insecure Temporary File Creation Vulnerability
14255| [14721] Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
14256| [14660] Apache CGI Byterange Request Denial of Service Vulnerability
14257| [14366] Apache mod_ssl CRL Handling Off-By-One Buffer Overflow Vulnerability
14258| [14106] Apache HTTP Request Smuggling Vulnerability
14259| [13778] Apache HTPasswd Password Command Line Argument Buffer Overflow Vulnerability
14260| [13777] Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability
14261| [13756] Apache Tomcat Java Security Manager Bypass Vulnerability
14262| [13537] Apache HTDigest Realm Command Line Argument Buffer Overflow Vulnerability
14263| [12877] Apache mod_ssl ssl_io_filter_cleanup Remote Denial Of Service Vulnerability
14264| [12795] Apache Tomcat Remote Malformed Request Denial Of Service Vulnerability
14265| [12619] Apache Software Foundation Batik Squiggle Browser Access Validation Vulnerability
14266| [12519] Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
14267| [12308] Apache Utilities Insecure Temporary File Creation Vulnerability
14268| [12217] Apache mod_auth_radius Malformed RADIUS Server Reply Integer Overflow Vulnerability
14269| [12181] Mod_DOSEvasive Apache Module Local Insecure Temporary File Creation Vulnerability
14270| [11803] Apache Jakarta Results.JSP Remote Cross-Site Scripting Vulnerability
14271| [11471] Apache mod_include Local Buffer Overflow Vulnerability
14272| [11360] Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
14273| [11239] Apache Satisfy Directive Access Control Bypass Vulnerability
14274| [11187] Apache Web Server Remote IPv6 Buffer Overflow Vulnerability
14275| [11185] Apache Mod_DAV LOCK Denial Of Service Vulnerability
14276| [11182] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
14277| [11154] Apache mod_ssl Remote Denial of Service Vulnerability
14278| [11094] Apache mod_ssl Denial Of Service Vulnerability
14279| [10789] Apache mod_userdir Module Information Disclosure Vulnerability
14280| [10736] Apache 'mod_ssl' Log Function Format String Vulnerability
14281| [10619] Apache ap_escape_html Memory Allocation Denial Of Service Vulnerability
14282| [10508] Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
14283| [10478] ClueCentral Apache Suexec Patch Security Weakness
14284| [10355] Apache 'mod_ssl' 'ssl_util_uuencode_binary()' Stack Buffer Overflow Vulnerability
14285| [10212] Apache mod_auth Malformed Password Potential Memory Corruption Vulnerability
14286| [9933] Apache mod_disk_cache Module Client Authentication Credential Storage Weakness
14287| [9930] Apache Error and Access Logs Escape Sequence Injection Vulnerability
14288| [9921] Apache Connection Blocking Denial Of Service Vulnerability
14289| [9885] Apache Mod_Security Module SecFilterScanPost Off-By-One Buffer Overflow Vulnerability
14290| [9874] Apache HTAccess LIMIT Directive Bypass Configuration Error Weakness
14291| [9829] Apache Mod_Access Access Control Rule Bypass Vulnerability
14292| [9826] Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnerability
14293| [9733] Apache Cygwin Directory Traversal Vulnerability
14294| [9599] Apache mod_php Global Variables Information Disclosure Weakness
14295| [9590] Apache-SSL Client Certificate Forging Vulnerability
14296| [9571] Apache mod_digest Client-Supplied Nonce Verification Vulnerability
14297| [9471] Apache mod_perl Module File Descriptor Leakage Vulnerability
14298| [9404] Mod-Auth-Shadow Apache Module Expired User Credential Weakness
14299| [9302] Apache mod_php Module File Descriptor Leakage Vulnerability
14300| [9129] Apache mod_python Module Malformed Query Denial of Service Vulnerability
14301| [8926] Apache Web Server mod_cgid Module CGI Data Redirection Vulnerability
14302| [8919] Apache Mod_Security Module Heap Corruption Vulnerability
14303| [8911] Apache Web Server Multiple Module Local Buffer Overflow Vulnerability
14304| [8898] Red Hat Apache Directory Index Default Configuration Error
14305| [8883] Apache Cocoon Directory Traversal Vulnerability
14306| [8824] Apache Tomcat Non-HTTP Request Denial Of Service Vulnerability
14307| [8822] Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
14308| [8725] Apache2 MOD_CGI STDERR Denial Of Service Vulnerability
14309| [8707] Apache htpasswd Password Entropy Weakness
14310| [8561] Apache::Gallery Insecure Local File Storage Privilege Escalation Vulnerability
14311| [8287] Mod_Mylo Apache Module REQSTR Buffer Overflow Vulnerability
14312| [8226] Apache HTTP Server Multiple Vulnerabilities
14313| [8138] Apache Web Server Type-Map Recursive Loop Denial Of Service Vulnerability
14314| [8137] Apache Web Server Prefork MPM Denial Of Service Vulnerability
14315| [8136] Macromedia Apache Web Server Encoded Space Source Disclosure Vulnerability
14316| [8135] Apache Web Server FTP Proxy IPV6 Denial Of Service Vulnerability
14317| [8134] Apache Web Server SSLCipherSuite Weak CipherSuite Renegotiation Weakness
14318| [7768] Apache Tomcat Insecure Directory Permissions Vulnerability
14319| [7725] Apache Basic Authentication Module Valid User Login Denial Of Service Vulnerability
14320| [7723] Apache APR_PSPrintf Memory Corruption Vulnerability
14321| [7448] Apache Mod_Auth_Any Remote Command Execution Vulnerability
14322| [7375] Apache Mod_Access_Referer NULL Pointer Dereference Denial of Service Vulnerability
14323| [7332] Apache Web Server OS2 Filestat Denial Of Service Vulnerability
14324| [7255] Apache Web Server File Descriptor Leakage Vulnerability
14325| [7254] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
14326| [6943] Apache Web Server MIME Boundary Information Disclosure Vulnerability
14327| [6939] Apache Web Server ETag Header Information Disclosure Weakness
14328| [6722] Apache Tomcat Web.XML File Contents Disclosure Vulnerability
14329| [6721] Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
14330| [6720] Apache Tomcat Example Web Application Cross Site Scripting Vulnerability
14331| [6662] Apache Web Server MS-DOS Device Name Denial Of Service Vulnerability
14332| [6661] Apache Web Server Default Script Mapping Bypass Vulnerability
14333| [6660] Apache Web Server Illegal Character HTTP Request File Disclosure Vulnerability
14334| [6659] Apache Web Server MS-DOS Device Name Arbitrary Code Execution Vulnerability
14335| [6562] Apache Tomcat Invoker Servlet File Disclosure Vulnerability
14336| [6320] Apache/Tomcat Mod_JK Chunked Encoding Denial Of Service Vulnerability
14337| [6117] Apache mod_php File Descriptor Leakage Vulnerability
14338| [6065] Apache 2 WebDAV CGI POST Request Information Disclosure Vulnerability
14339| [5996] Apache AB.C Web Benchmarking Buffer Overflow Vulnerability
14340| [5995] Apache AB.C Web Benchmarking Read_Connection() Buffer Overflow Vulnerability
14341| [5993] Multiple Apache HTDigest Buffer Overflow Vulnerabilities
14342| [5992] Apache HTDigest Insecure Temporary File Vulnerability
14343| [5991] Apache HTDigest Arbitrary Command Execution Vulnerability
14344| [5990] Apache HTPasswd Insecure Temporary File Vulnerability
14345| [5981] Multiple Apache HTDigest and HTPassWD Component Vulnerabilites
14346| [5884] Apache Web Server Scoreboard Memory Segment Overwriting SIGUSR1 Sending Vulnerability
14347| [5847] Apache Server Side Include Cross Site Scripting Vulnerability
14348| [5838] Apache Tomcat 3.2 Directory Disclosure Vulnerability
14349| [5816] Apache 2 mod_dav Denial Of Service Vulnerability
14350| [5791] HP VirtualVault Apache mod_ssl Denial Of Service Vulnerability
14351| [5787] Apache Oversized STDERR Buffer Denial Of Service Vulnerability
14352| [5786] Apache Tomcat DefaultServlet File Disclosure Vulnerability
14353| [5542] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
14354| [5486] Apache 2.0 CGI Path Disclosure Vulnerability
14355| [5485] Apache 2.0 Path Disclosure Vulnerability
14356| [5434] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
14357| [5256] Apache httpd 2.0 CGI Error Path Disclosure Vulnerability
14358| [5194] Apache Tomcat DOS Device Name Cross Site Scripting Vulnerability
14359| [5193] Apache Tomcat Servlet Mapping Cross Site Scripting Vulnerability
14360| [5067] Apache Tomcat Null Character Malformed Request Denial Of Service Vulnerability
14361| [5054] Apache Tomcat Web Root Path Disclosure Vulnerability
14362| [5033] Apache Chunked-Encoding Memory Corruption Vulnerability
14363| [4995] Apache Tomcat JSP Engine Denial of Service Vulnerability
14364| [4878] Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
14365| [4877] Apache Tomcat Example Files Web Root Path Disclosure Vulnerability
14366| [4876] Apache Tomcat Source.JSP Malformed Request Information Disclosure Vulnerability
14367| [4575] Apache Tomcat Servlet Path Disclosure Vulnerability
14368| [4557] Apache Tomcat System Path Information Disclosure Vulnerability
14369| [4437] Apache Error Message Cross-Site Scripting Vulnerability
14370| [4431] Apache PrintEnv/Test_CGI Script Injection Vulnerability
14371| [4358] Apache Double-Reverse Lookup Log Entry Spoofing Vulnerability
14372| [4335] Apache Win32 Batch File Remote Command Execution Vulnerability
14373| [4292] Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
14374| [4189] Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
14375| [4057] Apache 2 for Windows OPTIONS request Path Disclosure Vulnerability
14376| [4056] Apache 2 for Windows php.exe Path Disclosure Vulnerability
14377| [4037] Oracle 9iAS Apache PL/SQL Module Denial of Service Vulnerability
14378| [4032] Oracle 9iAS Apache PL/SQL Module Multiple Buffer Overflows Vulnerability
14379| [3796] Apache HTTP Request Unexpected Behavior Vulnerability
14380| [3790] Apache Non-Existent Log Directory Denial Of Service Vulnerability
14381| [3786] Apache Win32 PHP.EXE Remote File Disclosure Vulnerability
14382| [3727] Oracle 9I Application Server PL/SQL Apache Module Directory Traversal Vulnerability
14383| [3726] Oracle 9I Application Server PL/SQL Apache Module Buffer Overflow Vulnerability
14384| [3596] Apache Split-Logfile File Append Vulnerability
14385| [3521] Apache mod_usertrack Predictable ID Generation Vulnerability
14386| [3335] Red Hat Linux Apache Remote Username Enumeration Vulnerability
14387| [3316] MacOS X Client Apache Directory Contents Disclosure Vulnerability
14388| [3256] Apache mod_auth_oracle Remote SQL Query Manipulation Vulnerability
14389| [3255] Apache mod_auth_mysql Remote SQL Query Manipulation Vulnerability
14390| [3254] Apache AuthPG Remote SQL Query Manipulation Vulnerability
14391| [3253] Apache mod_auth_pgsql_sys Remote SQL Query Manipulation Vulnerability
14392| [3251] Apache mod_auth_pgsql Remote SQL Query Manipulation Vulnerability
14393| [3176] Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
14394| [3169] Apache Server Address Disclosure Vulnerability
14395| [3009] Apache Possible Directory Index Disclosure Vulnerability
14396| [2982] Apache Tomcat Cross-Site Scripting Vulnerability
14397| [2852] MacOS X Client Apache File Protection Bypass Vulnerability
14398| [2740] Apache Web Server HTTP Request Denial of Service Vulnerability
14399| [2518] Apache Tomcat 3.0 Directory Traversal Vulnerability
14400| [2503] Apache Artificially Long Slash Path Directory Listing Vulnerability
14401| [2300] NCSA/Apache httpd ScriptAlias Source Retrieval Vulnerability
14402| [2216] Apache Web Server DoS Vulnerability
14403| [2182] Apache /tmp File Race Vulnerability
14404| [2171] Oracle Apache+WebDB Documented Backdoor Vulnerability
14405| [2060] Apache Web Server with Php 3 File Disclosure Vulnerability
14406| [1821] Apache mod_cookies Buffer Overflow Vulnerability
14407| [1728] Apache Rewrite Module Arbitrary File Disclosure Vulnerability
14408| [1658] SuSE Apache CGI Source Code Viewing Vulnerability
14409| [1656] SuSE Apache WebDAV Directory Listings Vulnerability
14410| [1575] Trustix Apache-SSL RPM Permissions Vulnerability
14411| [1548] Apache Jakarta-Tomcat /admin Context Vulnerability
14412| [1532] Apache Tomcat Snoop Servlet Information Disclosure Vulnerability
14413| [1531] Apache Tomcat 3.1 Path Revealing Vulnerability
14414| [1457] Apache::ASP source.asp Example Script Vulnerability
14415| [1284] Apache HTTP Server (win32) Root Directory Access Vulnerability
14416| [1083] Cobalt Raq Apache .htaccess Disclosure Vulnerability
14417|
14418| IBM X-Force - https://exchange.xforce.ibmcloud.com:
14419| [86258] Apache CloudStack text fields cross-site scripting
14420| [85983] Apache Subversion mod_dav_svn module denial of service
14421| [85875] Apache OFBiz UEL code execution
14422| [85874] Apache OFBiz Webtools View Log screen cross-site scripting
14423| [85871] Apache HTTP Server mod_session_dbd unspecified
14424| [85756] Apache Struts OGNL expression command execution
14425| [85755] Apache Struts DefaultActionMapper class open redirect
14426| [85586] Apache ActiveMQ CVE-2013-1879 cross-site scripting
14427| [85574] Apache HTTP Server mod_dav denial of service
14428| [85573] Apache Struts Showcase App OGNL code execution
14429| [85496] Apache CXF denial of service
14430| [85423] Apache Geronimo RMI classloader code execution
14431| [85326] Apache Santuario XML Security for C++ buffer overflow
14432| [85323] Apache Santuario XML Security for Java spoofing
14433| [85319] Apache Qpid Python client SSL spoofing
14434| [85019] Apache Santuario XML Security for C++ CVE-2013-2156 buffer overflow
14435| [85018] Apache Santuario XML Security for C++ CVE-2013-2155 denial of service
14436| [85017] Apache Santuario XML Security for C++ CVE-2013-2154 buffer overflow
14437| [85016] Apache Santuario XML Security for C++ CVE-2013-2153 spoofing
14438| [84952] Apache Tomcat CVE-2012-3544 denial of service
14439| [84763] Apache Struts CVE-2013-2135 security bypass
14440| [84762] Apache Struts CVE-2013-2134 security bypass
14441| [84719] Apache Subversion CVE-2013-2088 command execution
14442| [84718] Apache Subversion CVE-2013-2112 denial of service
14443| [84717] Apache Subversion CVE-2013-1968 denial of service
14444| [84577] Apache Tomcat security bypass
14445| [84576] Apache Tomcat symlink
14446| [84543] Apache Struts CVE-2013-2115 security bypass
14447| [84542] Apache Struts CVE-2013-1966 security bypass
14448| [84154] Apache Tomcat session hijacking
14449| [84144] Apache Tomcat denial of service
14450| [84143] Apache Tomcat information disclosure
14451| [84111] Apache HTTP Server command execution
14452| [84043] Apache Virtual Computing Lab cross-site scripting
14453| [84042] Apache Virtual Computing Lab cross-site scripting
14454| [83782] Apache CloudStack information disclosure
14455| [83781] Apache CloudStack security bypass
14456| [83720] Apache ActiveMQ cross-site scripting
14457| [83719] Apache ActiveMQ denial of service
14458| [83718] Apache ActiveMQ denial of service
14459| [83263] Apache Subversion denial of service
14460| [83262] Apache Subversion denial of service
14461| [83261] Apache Subversion denial of service
14462| [83259] Apache Subversion denial of service
14463| [83035] Apache mod_ruid2 security bypass
14464| [82852] Apache Qpid federation_tag security bypass
14465| [82851] Apache Qpid qpid::framing::Buffer denial of service
14466| [82758] Apache Rave User RPC API information disclosure
14467| [82663] Apache Subversion svn_fs_file_length() denial of service
14468| [82642] Apache Qpid qpid::framing::Buffer::checkAvailable() denial of service
14469| [82641] Apache Qpid AMQP denial of service
14470| [82626] Apache HTTP Server on Debian GNU/Linux Debian apache2ctl symlink
14471| [82618] Apache Commons FileUpload symlink
14472| [82360] Apache HTTP Server manager interface cross-site scripting
14473| [82359] Apache HTTP Server hostnames cross-site scripting
14474| [82338] Apache Tomcat log/logdir information disclosure
14475| [82328] Apache Maven and Apache Maven Wagon SSL spoofing
14476| [82268] Apache OpenJPA deserialization command execution
14477| [81981] Apache CXF UsernameTokens security bypass
14478| [81980] Apache CXF WS-Security security bypass
14479| [81398] Apache OFBiz cross-site scripting
14480| [81240] Apache CouchDB directory traversal
14481| [81226] Apache CouchDB JSONP code execution
14482| [81225] Apache CouchDB Futon user interface cross-site scripting
14483| [81211] Apache Axis2/C SSL spoofing
14484| [81167] Apache CloudStack DeployVM information disclosure
14485| [81166] Apache CloudStack AddHost API information disclosure
14486| [81165] Apache CloudStack createSSHKeyPair API information disclosure
14487| [80518] Apache Tomcat cross-site request forgery security bypass
14488| [80517] Apache Tomcat FormAuthenticator security bypass
14489| [80516] Apache Tomcat NIO denial of service
14490| [80408] Apache Tomcat replay-countermeasure security bypass
14491| [80407] Apache Tomcat HTTP Digest Access Authentication security bypass
14492| [80317] Apache Tomcat slowloris denial of service
14493| [79984] Apache Commons HttpClient SSL spoofing
14494| [79983] Apache CXF SSL spoofing
14495| [79830] Apache Axis2/Java SSL spoofing
14496| [79829] Apache Axis SSL spoofing
14497| [79809] Apache Tomcat DIGEST security bypass
14498| [79806] Apache Tomcat parseHeaders() denial of service
14499| [79540] Apache OFBiz unspecified
14500| [79487] Apache Axis2 SAML security bypass
14501| [79212] Apache Cloudstack code execution
14502| [78734] Apache CXF SOAP Action security bypass
14503| [78730] Apache Qpid broker denial of service
14504| [78617] Eucalyptus Apache Santuario (XML Security for Java) denial of service
14505| [78563] Apache mod_pagespeed module unspecified cross-site scripting
14506| [78562] Apache mod_pagespeed module security bypass
14507| [78454] Apache Axis2 security bypass
14508| [78452] Websense Web Security and Web Filter Apache Tomcat information disclosure
14509| [78451] Websense Web Security and Web Filter Apache Tomcat cross-site scripting
14510| [78321] Apache Wicket unspecified cross-site scripting
14511| [78183] Apache Struts parameters denial of service
14512| [78182] Apache Struts cross-site request forgery
14513| [78153] Apache Solr Autocomplete module for Drupal autocomplete results cross-site scripting
14514| [77987] mod_rpaf module for Apache denial of service
14515| [77958] Apache Struts skill name code execution
14516| [77914] Apache HTTP Server mod_negotiation module cross-site scripting
14517| [77913] Apache HTTP Server mod_proxy_ajp information disclosure
14518| [77568] Apache Qpid broker security bypass
14519| [77421] Apache Libcloud spoofing
14520| [77059] Oracle Solaris Cluster Apache Tomcat Agent unspecified
14521| [77046] Oracle Solaris Apache HTTP Server information disclosure
14522| [76837] Apache Hadoop information disclosure
14523| [76802] Apache Sling CopyFrom denial of service
14524| [76692] Apache Hadoop symlink
14525| [76535] Apache Roller console cross-site request forgery
14526| [76534] Apache Roller weblog cross-site scripting
14527| [76152] Apache CXF elements security bypass
14528| [76151] Apache CXF child policies security bypass
14529| [75983] MapServer for Windows Apache file include
14530| [75857] Apache Commons Compress and Apache Ant bzip2 denial of service
14531| [75558] Apache POI denial of service
14532| [75545] PHP apache_request_headers() buffer overflow
14533| [75302] Apache Qpid SASL security bypass
14534| [75211] Debian GNU/Linux apache 2 cross-site scripting
14535| [74901] Apache HTTP Server LD_LIBRARY_PATH privilege escalation
14536| [74871] Apache OFBiz FlexibleStringExpander code execution
14537| [74870] Apache OFBiz multiple cross-site scripting
14538| [74750] Apache Hadoop unspecified spoofing
14539| [74319] Apache Struts XSLTResult.java file upload
14540| [74313] Apache Traffic Server header buffer overflow
14541| [74276] Apache Wicket directory traversal
14542| [74273] Apache Wicket unspecified cross-site scripting
14543| [74181] Apache HTTP Server mod_fcgid module denial of service
14544| [73690] Apache Struts OGNL code execution
14545| [73432] Apache Solr extension for TYPO3 unspecified cross-site scripting
14546| [73100] Apache MyFaces in directory traversal
14547| [73096] Apache APR hash denial of service
14548| [73052] Apache Struts name cross-site scripting
14549| [73030] Apache CXF UsernameToken security bypass
14550| [72888] Apache Struts lastName cross-site scripting
14551| [72758] Apache HTTP Server httpOnly information disclosure
14552| [72757] Apache HTTP Server MPM denial of service
14553| [72585] Apache Struts ParameterInterceptor security bypass
14554| [72438] Apache Tomcat Digest security bypass
14555| [72437] Apache Tomcat Digest security bypass
14556| [72436] Apache Tomcat DIGEST security bypass
14557| [72425] Apache Tomcat parameter denial of service
14558| [72422] Apache Tomcat request object information disclosure
14559| [72377] Apache HTTP Server scoreboard security bypass
14560| [72345] Apache HTTP Server HTTP request denial of service
14561| [72229] Apache Struts ExceptionDelegator command execution
14562| [72089] Apache Struts ParameterInterceptor directory traversal
14563| [72088] Apache Struts CookieInterceptor command execution
14564| [72047] Apache Geronimo hash denial of service
14565| [72016] Apache Tomcat hash denial of service
14566| [71711] Apache Struts OGNL expression code execution
14567| [71654] Apache Struts interfaces security bypass
14568| [71620] Apache ActiveMQ failover denial of service
14569| [71617] Apache HTTP Server mod_proxy module information disclosure
14570| [71508] Apache MyFaces EL security bypass
14571| [71445] Apache HTTP Server mod_proxy security bypass
14572| [71203] Apache Tomcat servlets privilege escalation
14573| [71181] Apache HTTP Server ap_pregsub() denial of service
14574| [71093] Apache HTTP Server ap_pregsub() buffer overflow
14575| [70336] Apache HTTP Server mod_proxy information disclosure
14576| [69804] Apache HTTP Server mod_proxy_ajp denial of service
14577| [69472] Apache Tomcat AJP security bypass
14578| [69396] Apache HTTP Server ByteRange filter denial of service
14579| [69394] Apache Wicket multi window support cross-site scripting
14580| [69176] Apache Tomcat XML information disclosure
14581| [69161] Apache Tomcat jsvc information disclosure
14582| [68799] mod_authnz_external module for Apache mysql-auth.pl SQL injection
14583| [68541] Apache Tomcat sendfile information disclosure
14584| [68420] Apache XML Security denial of service
14585| [68238] Apache Tomcat JMX information disclosure
14586| [67860] Apache Rampart/C rampart_timestamp_token_validate security bypass
14587| [67804] Apache Subversion control rules information disclosure
14588| [67803] Apache Subversion control rules denial of service
14589| [67802] Apache Subversion baselined denial of service
14590| [67672] Apache Archiva multiple cross-site scripting
14591| [67671] Apache Archiva multiple cross-site request forgery
14592| [67564] Apache APR apr_fnmatch() denial of service
14593| [67532] IBM WebSphere Application Server org.apache.jasper.runtime.JspWriterImpl.response denial of service
14594| [67515] Apache Tomcat annotations security bypass
14595| [67480] Apache Struts s:submit information disclosure
14596| [67414] Apache APR apr_fnmatch() denial of service
14597| [67356] Apache Struts javatemplates cross-site scripting
14598| [67354] Apache Struts Xwork cross-site scripting
14599| [66676] Apache Tomcat HTTP BIO information disclosure
14600| [66675] Apache Tomcat web.xml security bypass
14601| [66640] Apache HttpComponents HttpClient Proxy-Authorization information disclosure
14602| [66241] Apache HttpComponents information disclosure
14603| [66154] Apache Tomcat ServletSecurity security bypass
14604| [65971] Apache Tomcat ServletSecurity security bypass
14605| [65876] Apache Subversion mod_dav_svn denial of service
14606| [65343] Apache Continuum unspecified cross-site scripting
14607| [65162] Apache Tomcat NIO connector denial of service
14608| [65161] Apache Tomcat javax.servlet.ServletRequest.getLocale() denial of service
14609| [65160] Apache Tomcat HTML Manager interface cross-site scripting
14610| [65159] Apache Tomcat ServletContect security bypass
14611| [65050] Apache CouchDB web-based administration UI cross-site scripting
14612| [64773] Oracle HTTP Server Apache Plugin unauthorized access
14613| [64473] Apache Subversion blame -g denial of service
14614| [64472] Apache Subversion walk() denial of service
14615| [64407] Apache Axis2 CVE-2010-0219 code execution
14616| [63926] Apache Archiva password privilege escalation
14617| [63785] Apache CouchDB LD_LIBRARY_PATH privilege escalation
14618| [63493] Apache Archiva credentials cross-site request forgery
14619| [63477] Apache Tomcat HttpOnly session hijacking
14620| [63422] Apache Tomcat sessionsList.jsp cross-site scripting
14621| [63303] Apache mod_fcgid module fcgid_header_bucket_read() buffer overflow
14622| [62959] Apache Shiro filters security bypass
14623| [62790] Apache Perl cgi module denial of service
14624| [62576] Apache Qpid exchange denial of service
14625| [62575] Apache Qpid AMQP denial of service
14626| [62354] Apache Qpid SSL denial of service
14627| [62235] Apache APR-util apr_brigade_split_line() denial of service
14628| [62181] Apache XML-RPC SAX Parser information disclosure
14629| [61721] Apache Traffic Server cache poisoning
14630| [61202] Apache Derby BUILTIN authentication functionality information disclosure
14631| [61186] Apache CouchDB Futon cross-site request forgery
14632| [61169] Apache CXF DTD denial of service
14633| [61070] Apache Jackrabbit search.jsp SQL injection
14634| [61006] Apache SLMS Quoting cross-site request forgery
14635| [60962] Apache Tomcat time cross-site scripting
14636| [60883] Apache mod_proxy_http information disclosure
14637| [60671] Apache HTTP Server mod_cache and mod_dav denial of service
14638| [60264] Apache Tomcat Transfer-Encoding denial of service
14639| [59746] Apache Axis2 axis2/axis2-admin page session hijacking
14640| [59588] Apache Axis2/Java XML DTD (Document Type Declaration) data denial of service
14641| [59413] Apache mod_proxy_http timeout information disclosure
14642| [59058] Apache MyFaces unencrypted view state cross-site scripting
14643| [58827] Apache Axis2 xsd file include
14644| [58790] Apache Axis2 modules cross-site scripting
14645| [58299] Apache ActiveMQ queueBrowse cross-site scripting
14646| [58169] Apache Tomcat Web Application Manager / Host Manager cross-site request forgery
14647| [58056] Apache ActiveMQ .jsp source code disclosure
14648| [58055] Apache Tomcat realm name information disclosure
14649| [58046] Apache HTTP Server mod_auth_shadow security bypass
14650| [57841] Apache Open For Business Project (OFBiz) subject cross-site scripting
14651| [57840] Apache Open For Business Project (OFBiz) multiple parameters cross-site scripting
14652| [57429] Apache CouchDB algorithms information disclosure
14653| [57398] Apache ActiveMQ Web console cross-site request forgery
14654| [57397] Apache ActiveMQ createDestination.action cross-site scripting
14655| [56653] Apache HTTP Server DNS spoofing
14656| [56652] Apache HTTP Server DNS cross-site scripting
14657| [56625] Apache HTTP Server request header information disclosure
14658| [56624] Apache HTTP Server mod_isapi orphaned callback pointer code execution
14659| [56623] Apache HTTP Server mod_proxy_ajp denial of service
14660| [55941] mod_proxy module for Apache ap_proxy_send_fb() buffer overflow
14661| [55857] Apache Tomcat WAR files directory traversal
14662| [55856] Apache Tomcat autoDeploy attribute security bypass
14663| [55855] Apache Tomcat WAR directory traversal
14664| [55210] Intuit component for Joomla! Apache information disclosure
14665| [54533] Apache Tomcat 404 error page cross-site scripting
14666| [54182] Apache Tomcat admin default password
14667| [53878] Apache Solr Search (solr) extension for TYPO3 unspecified cross-site scripting
14668| [53666] Apache HTTP Server Solaris pollset support denial of service
14669| [53650] Apache HTTP Server HTTP basic-auth module security bypass
14670| [53124] mod_proxy_ftp module for Apache HTTP header security bypass
14671| [53041] mod_proxy_ftp module for Apache denial of service
14672| [52540] Apache Portable Runtime and Apache Portable Utility library multiple buffer overflow
14673| [51953] Apache Tomcat Path Disclosure
14674| [51952] Apache Tomcat Path Traversal
14675| [51951] Apache stronghold-status Information Disclosure
14676| [51950] Apache stronghold-info Information Disclosure
14677| [51949] Apache PHP Source Code Disclosure
14678| [51948] Apache Multiviews Attack
14679| [51946] Apache JServ Environment Status Information Disclosure
14680| [51945] Apache error_log Information Disclosure
14681| [51944] Apache Default Installation Page Pattern Found
14682| [51943] Apache AXIS XML Parser echoheaders.jws Sample Web Service Denial of Service
14683| [51942] Apache AXIS XML External Entity File Retrieval
14684| [51941] Apache AXIS Sample Servlet Information Leak
14685| [51940] Apache access_log Information Disclosure
14686| [51626] Apache mod_deflate denial of service
14687| [51532] mod_proxy module for the Apache HTTP Server stream_reqbody_cl denial of service
14688| [51365] Apache Tomcat RequestDispatcher security bypass
14689| [51273] Apache HTTP Server Incomplete Request denial of service
14690| [51195] Apache Tomcat XML information disclosure
14691| [50994] Apache APR-util xml/apr_xml.c denial of service
14692| [50993] Apache APR-util apr_brigade_vprintf denial of service
14693| [50964] Apache APR-util apr_strmatch_precompile() denial of service
14694| [50930] Apache Tomcat j_security_check information disclosure
14695| [50928] Apache Tomcat AJP denial of service
14696| [50884] Apache HTTP Server XML ENTITY denial of service
14697| [50808] Apache HTTP Server AllowOverride privilege escalation
14698| [50108] Apache Struts s:a tag and s:url tag cross-site scripting
14699| [50059] Apache mod_proxy_ajp information disclosure
14700| [49951] Apache Tiles Expression Language (EL) expressions cross-site scripting
14701| [49925] Apache Geronimo Web Administrative Console cross-site request forgery
14702| [49924] Apache Geronimo console/portal/Server/Monitoring cross-site scripting
14703| [49921] Apache ActiveMQ Web interface cross-site scripting
14704| [49898] Apache Geronimo Services/Repository directory traversal
14705| [49725] Apache Tomcat mod_jk module information disclosure
14706| [49715] Apache mod_perl Apache::Status and Apache2::Status modules cross-site scripting
14707| [49712] Apache Struts unspecified cross-site scripting
14708| [49213] Apache Tomcat cal2.jsp cross-site scripting
14709| [48934] Apache Tomcat POST doRead method information disclosure
14710| [48211] Apache Tomcat header HTTP request smuggling
14711| [48163] libapache2-mod-auth-mysql module for Debian multibyte encoding SQL injection
14712| [48110] Apache Jackrabbit search.jsp and swr.jsp cross-site scripting
14713| [47709] Apache Roller "
14714| [47104] Novell Netware ApacheAdmin console security bypass
14715| [47086] Apache HTTP Server OS fingerprinting unspecified
14716| [46329] Apache Struts FilterDispatcher and DefaultStaticContentLoader class directory traversal
14717| [45791] Apache Tomcat RemoteFilterValve security bypass
14718| [44435] Oracle WebLogic Apache Connector buffer overflow
14719| [44411] Apache Tomcat allowLinking UTF-8 directory traversal
14720| [44223] Apache HTTP Server mod_proxy_ftp cross-site scripting
14721| [44156] Apache Tomcat RequestDispatcher directory traversal
14722| [44155] Apache Tomcat HttpServletResponse.sendError() cross-site scripting
14723| [43885] Oracle WebLogic Server Apache Connector buffer overflow
14724| [42987] Apache HTTP Server mod_proxy module denial of service
14725| [42915] Apache Tomcat JSP files path disclosure
14726| [42914] Apache Tomcat MS-DOS path disclosure
14727| [42892] Apache Tomcat unspecified unauthorized access
14728| [42816] Apache Tomcat Host Manager cross-site scripting
14729| [42303] Apache 403 error cross-site scripting
14730| [41618] Apache-SSL ExpandCert() authentication bypass
14731| [40761] Apache Derby RDBNAM parameter and DatabaseMetaData.getURL information disclosure
14732| [40736] Apache Tomcat HTTP/1.1 connector information disclosure
14733| [40614] Apache mod_jk2 HTTP Host header buffer overflow
14734| [40562] Apache Geronimo init information disclosure
14735| [40478] Novell Web Manager webadmin-apache.conf security bypass
14736| [40411] Apache Tomcat exception handling information disclosure
14737| [40409] Apache Tomcat native (APR based) connector weak security
14738| [40403] Apache Tomcat quotes and %5C cookie information disclosure
14739| [40388] Sun Java Plug-In org.apache.crimson.tree.XmlDocument security bypass
14740| [39893] Apache HTTP Server mod_negotiation HTTP response splitting
14741| [39867] Apache HTTP Server mod_negotiation cross-site scripting
14742| [39804] Apache Tomcat SingleSignOn information disclosure
14743| [39615] Apache HTTP Server mod_proxy_ftp.c UTF-7 cross-site scripting
14744| [39612] Apache HTTP Server mod_proxy_balancer buffer overflow
14745| [39608] Apache HTTP Server balancer manager cross-site request forgery
14746| [39476] Apache mod_proxy_balancer balancer_handler function denial of service
14747| [39474] Apache HTTP Server mod_proxy_balancer cross-site scripting
14748| [39472] Apache HTTP Server mod_status cross-site scripting
14749| [39201] Apache Tomcat JULI logging weak security
14750| [39158] Apache HTTP Server Windows SMB shares information disclosure
14751| [39001] Apache HTTP Server mod_imap and mod_imagemap module cross-site scripting
14752| [38951] Apache::AuthCAS Perl module cookie SQL injection
14753| [38800] Apache HTTP Server 413 error page cross-site scripting
14754| [38211] Apache Geronimo SQLLoginModule authentication bypass
14755| [37243] Apache Tomcat WebDAV directory traversal
14756| [37178] RHSA update for Apache HTTP Server mod_status module cross-site scripting not installed
14757| [37177] RHSA update for Apache HTTP Server Apache child process denial of service not installed
14758| [37119] RHSA update for Apache mod_auth_kerb off-by-one buffer overflow not installed
14759| [37100] RHSA update for Apache and IBM HTTP Server Expect header cross-site scripting not installed
14760| [36782] Apache Geronimo MEJB unauthorized access
14761| [36586] Apache HTTP Server UTF-7 cross-site scripting
14762| [36468] Apache Geronimo LoginModule security bypass
14763| [36467] Apache Tomcat functions.jsp cross-site scripting
14764| [36402] Apache Tomcat calendar cross-site request forgery
14765| [36354] Apache HTTP Server mod_proxy module denial of service
14766| [36352] Apache HTTP Server ap_proxy_date_canon() denial of service
14767| [36336] Apache Derby lock table privilege escalation
14768| [36335] Apache Derby schema privilege escalation
14769| [36006] Apache Tomcat "
14770| [36001] Apache Tomcat Host Manager Servlet alias cross-site scripting
14771| [35999] Apache Tomcat \"
14772| [35795] Apache Tomcat CookieExample cross-site scripting
14773| [35536] Apache Tomcat SendMailServlet example cross-site scripting
14774| [35384] Apache HTTP Server mod_cache module denial of service
14775| [35097] Apache HTTP Server mod_status module cross-site scripting
14776| [35095] Apache HTTP Server Prefork MPM module denial of service
14777| [34984] Apache HTTP Server recall_headers information disclosure
14778| [34966] Apache HTTP Server MPM content spoofing
14779| [34965] Apache HTTP Server MPM information disclosure
14780| [34963] Apache HTTP Server MPM multiple denial of service
14781| [34872] Apache MyFaces Tomahawk autoscroll parameter cross-site scripting
14782| [34869] Apache Tomcat JSP example Web application cross-site scripting
14783| [34868] Apache Tomcat Manager and Host Manager cross-site scripting
14784| [34496] Apache Tomcat JK Connector security bypass
14785| [34377] Apache Tomcat hello.jsp cross-site scripting
14786| [34212] Apache Tomcat SSL configuration security bypass
14787| [34210] Apache Tomcat Accept-Language cross-site scripting
14788| [34209] Apache Tomcat calendar application cross-site scripting
14789| [34207] Apache Tomcat implicit-objects.jsp cross-site scripting
14790| [34167] Apache Axis WSDL file path disclosure
14791| [34068] Apache Tomcat AJP connector information disclosure
14792| [33584] Apache HTTP Server suEXEC privilege escalation
14793| [32988] Apache Tomcat proxy module directory traversal
14794| [32794] Apache Tomcat JK Web Server Connector map_uri_to_worker() buffer overflow
14795| [32708] Debian Apache tty privilege escalation
14796| [32441] ApacheStats extract() PHP call unspecified
14797| [32128] Apache Tomcat default account
14798| [31680] Apache Tomcat RequestParamExample cross-site scripting
14799| [31649] Apache Tomcat Sample Servlet TroubleShooter detected
14800| [31557] BEA WebLogic Server and WebLogic Express Apache proxy plug-in denial of service
14801| [31236] Apache HTTP Server htpasswd.c strcpy buffer overflow
14802| [30456] Apache mod_auth_kerb off-by-one buffer overflow
14803| [29550] Apache mod_tcl set_var() format string
14804| [28620] Apache and IBM HTTP Server Expect header cross-site scripting
14805| [28357] Apache HTTP Server mod_alias script source information disclosure
14806| [28063] Apache mod_rewrite off-by-one buffer overflow
14807| [27902] Apache Tomcat URL information disclosure
14808| [26786] Apache James SMTP server denial of service
14809| [25680] libapache2 /tmp/svn file upload
14810| [25614] Apache Struts lookupMap cross-site scripting
14811| [25613] Apache Struts ActionForm denial of service
14812| [25612] Apache Struts isCancelled() security bypass
14813| [24965] Apache mod_python FileSession command execution
14814| [24716] Apache James spooler memory leak denial of service
14815| [24159] Apache Geronimo Web-Access-Log Viewer cross-site scripting
14816| [24158] Apache Geronimo jsp-examples cross-site scripting
14817| [24030] Apache auth_ldap module multiple format strings
14818| [24008] Apache mod_ssl custom error message denial of service
14819| [24003] Apache mod_auth_pgsql module multiple syslog format strings
14820| [23612] Apache mod_imap referer field cross-site scripting
14821| [23173] Apache Struts error message cross-site scripting
14822| [22942] Apache Tomcat directory listing denial of service
14823| [22858] Apache Multi-Processing Module code allows denial of service
14824| [22602] RHSA-2005:582 updates for Apache httpd not installed
14825| [22520] Apache mod-auth-shadow "
14826| [22466] ApacheTop symlink
14827| [22109] Apache HTTP Server ssl_engine_kernel client certificate validation
14828| [22006] Apache HTTP Server byte-range filter denial of service
14829| [21567] Apache mod_ssl off-by-one buffer overflow
14830| [21195] Apache HTTP Server header HTTP request smuggling
14831| [20383] Apache HTTP Server htdigest buffer overflow
14832| [19681] Apache Tomcat AJP12 request denial of service
14833| [18993] Apache HTTP server check_forensic symlink attack
14834| [18790] Apache Tomcat Manager cross-site scripting
14835| [18349] Apache HTTP server Apple HFS+ filesystem obtain information
14836| [18348] Apache HTTP server Apple HFS+ filesystem .DS_Store and .ht file disclosure
14837| [18347] Apache HTTP server Apple Mac OS X Server mod_digest_apple module could allow an attacker to replay responses
14838| [17961] Apache Web server ServerTokens has not been set
14839| [17930] Apache HTTP Server HTTP GET request denial of service
14840| [17785] Apache mod_include module buffer overflow
14841| [17671] Apache HTTP Server SSLCipherSuite bypass restrictions
14842| [17473] Apache HTTP Server Satisfy directive allows access to resources
14843| [17413] Apache htpasswd buffer overflow
14844| [17384] Apache HTTP Server environment variable configuration file buffer overflow
14845| [17382] Apache HTTP Server IPv6 apr_util denial of service
14846| [17366] Apache HTTP Server mod_dav module LOCK denial of service
14847| [17273] Apache HTTP Server speculative mode denial of service
14848| [17200] Apache HTTP Server mod_ssl denial of service
14849| [16890] Apache HTTP Server server-info request has been detected
14850| [16889] Apache HTTP Server server-status request has been detected
14851| [16705] Apache mod_ssl format string attack
14852| [16524] Apache HTTP Server ap_get_mime_headers_core denial of service
14853| [16387] Apache HTTP Server mod_proxy Content-Length buffer overflow
14854| [16230] Apache HTTP Server PHP denial of service
14855| [16214] Apache mod_ssl ssl_util_uuencode_binary buffer overflow
14856| [15958] Apache HTTP Server authentication modules memory corruption
14857| [15547] Apache HTTP Server mod_disk_cache local information disclosure
14858| [15540] Apache HTTP Server socket starvation denial of service
14859| [15467] Novell GroupWise WebAccess using Apache Web server allows viewing of files on the server
14860| [15422] Apache HTTP Server mod_access information disclosure
14861| [15419] Apache HTTP Server mod_ssl plain HTTP request denial of service
14862| [15293] Apache for Cygwin "
14863| [15065] Apache-SSL has a default password
14864| [15041] Apache HTTP Server mod_digest module could allow an attacker to replay responses
14865| [15015] Apache httpd server httpd.conf could allow a local user to bypass restrictions
14866| [14751] Apache Mod_python output filter information disclosure
14867| [14125] Apache HTTP Server mod_userdir module information disclosure
14868| [14075] Apache HTTP Server mod_php file descriptor leak
14869| [13703] Apache HTTP Server account
14870| [13689] Apache HTTP Server configuration allows symlinks
14871| [13688] Apache HTTP Server configuration allows SSI
14872| [13687] Apache HTTP Server Server: header value
14873| [13685] Apache HTTP Server ServerTokens value
14874| [13684] Apache HTTP Server ServerSignature value
14875| [13672] Apache HTTP Server config allows directory autoindexing
14876| [13671] Apache HTTP Server default content
14877| [13670] Apache HTTP Server config file directive references outside content root
14878| [13668] Apache HTTP Server httpd not running in chroot environment
14879| [13666] Apache HTTP Server CGI directory contains possible command interpreter or compiler
14880| [13664] Apache HTTP Server config file contains ScriptAlias entry
14881| [13663] Apache HTTP Server CGI support modules loaded
14882| [13661] Apache HTTP Server config file contains AddHandler entry
14883| [13660] Apache HTTP Server 500 error page not CGI script
14884| [13659] Apache HTTP Server 413 error page not CGI script
14885| [13658] Apache HTTP Server 403 error page not CGI script
14886| [13657] Apache HTTP Server 401 error page not CGI script
14887| [13552] Apache HTTP Server mod_cgid module information disclosure
14888| [13550] Apache GET request directory traversal
14889| [13516] Apache Cocoon XMLForm and JXForm could allow execution of code
14890| [13499] Apache Cocoon directory traversal allows downloading of boot.ini file
14891| [13429] Apache Tomcat non-HTTP request denial of service
14892| [13400] Apache HTTP server mod_alias and mod_rewrite buffer overflow
14893| [13295] Apache weak password encryption
14894| [13254] Apache Tomcat .jsp cross-site scripting
14895| [13125] Apache::Gallery Inline::C could allow arbitrary code execution
14896| [13086] Apache Jakarta Tomcat mod_jk format string allows remote access
14897| [12681] Apache HTTP Server mod_proxy could allow mail relaying
14898| [12662] Apache HTTP Server rotatelogs denial of service
14899| [12554] Apache Tomcat stores password in plain text
14900| [12553] Apache HTTP Server redirects and subrequests denial of service
14901| [12552] Apache HTTP Server FTP proxy server denial of service
14902| [12551] Apache HTTP Server prefork MPM denial of service
14903| [12550] Apache HTTP Server weaker than expected encryption
14904| [12549] Apache HTTP Server type-map file denial of service
14905| [12206] Apache Tomcat /opt/tomcat directory insecure permissions
14906| [12102] Apache Jakarta Tomcat MS-DOS device name request denial of service
14907| [12091] Apache HTTP Server apr_password_validate denial of service
14908| [12090] Apache HTTP Server apr_psprintf code execution
14909| [11804] Apache HTTP Server mod_access_referer denial of service
14910| [11750] Apache HTTP Server could leak sensitive file descriptors
14911| [11730] Apache HTTP Server error log and access log terminal escape sequence injection
14912| [11703] Apache long slash path allows directory listing
14913| [11695] Apache HTTP Server LF (Line Feed) denial of service
14914| [11694] Apache HTTP Server filestat.c denial of service
14915| [11438] Apache HTTP Server MIME message boundaries information disclosure
14916| [11412] Apache HTTP Server error log terminal escape sequence injection
14917| [11196] Apache Tomcat examples and ROOT Web applications cross-site scripting
14918| [11195] Apache Tomcat web.xml could be used to read files
14919| [11194] Apache Tomcat URL appended with a null character could list directories
14920| [11139] Apache HTTP Server mass virtual hosting with mod_rewrite or mod_vhost_alias could allow an attacker to obtain files
14921| [11126] Apache HTTP Server illegal character file disclosure
14922| [11125] Apache HTTP Server DOS device name HTTP POST code execution
14923| [11124] Apache HTTP Server DOS device name denial of service
14924| [11088] Apache HTTP Server mod_vhost_alias CGI source disclosure
14925| [10938] Apache HTTP Server printenv test CGI cross-site scripting
14926| [10771] Apache Tomcat mod_jk module multiple HTTP GET request buffer overflow
14927| [10575] Apache mod_php module could allow an attacker to take over the httpd process
14928| [10499] Apache HTTP Server WebDAV HTTP POST view source
14929| [10457] Apache HTTP Server mod_ssl "
14930| [10415] Apache HTTP Server htdigest insecure system() call could allow command execution
14931| [10414] Apache HTTP Server htdigest multiple buffer overflows
14932| [10413] Apache HTTP Server htdigest temporary file race condition
14933| [10412] Apache HTTP Server htpasswd temporary file race condition
14934| [10376] Apache Tomcat invoker servlet used in conjunction with the default servlet reveals source code
14935| [10348] Apache Tomcat HTTP GET request DOS device reference could cause a denial of service
14936| [10281] Apache HTTP Server ab.c ApacheBench long response buffer overflow
14937| [10280] Apache HTTP Server shared memory scorecard overwrite
14938| [10263] Apache Tomcat mod_jk or mod_jserv connector directory disclosure
14939| [10241] Apache HTTP Server Host: header cross-site scripting
14940| [10230] Slapper worm variants A, B, and C target OpenSSL/Apache systems
14941| [10208] Apache HTTP Server mod_dav denial of service
14942| [10206] HP VVOS Apache mod_ssl denial of service
14943| [10200] Apache HTTP Server stderr denial of service
14944| [10175] Apache Tomcat org.apache.catalina.servlets.DefaultServlet reveals source code
14945| [10169] Slapper worm variant (Slapper.C) targets OpenSSL/Apache systems
14946| [10154] Slapper worm variant (Slapper.B) targets OpenSSL/Apache systems
14947| [10098] Slapper worm targets OpenSSL/Apache systems
14948| [9876] Apache HTTP Server cgi/cgid request could disclose the path to a requested script
14949| [9875] Apache HTTP Server .var file request could disclose installation path
14950| [9863] Apache Tomcat web.xml file could allow a remote attacker to bypass restrictions
14951| [9808] Apache HTTP Server non-Unix version URL encoded directory traversal
14952| [9623] Apache HTTP Server ap_log_rerror() path disclosure
14953| [9520] Apache Tomcat /servlet/ mapping cross-site scripting
14954| [9415] Apache HTTP Server mod_ssl .htaccess off-by-one buffer overflow
14955| [9396] Apache Tomcat null character to threads denial of service
14956| [9394] Apache Tomcat HTTP request for LPT9 reveals Web root path
14957| [9249] Apache HTTP Server chunked encoding heap buffer overflow
14958| [9208] Apache Tomcat sample file requests could reveal directory listing and path to Web root directory
14959| [8932] Apache Tomcat example class information disclosure
14960| [8633] Apache HTTP Server with mod_rewrite could allow an attacker to bypass directives
14961| [8629] Apache HTTP Server double-reverse DNS lookup spoofing
14962| [8589] Apache HTTP Server for Windows DOS batch file remote command execution
14963| [8457] Oracle9i Application Server Apache PL/SQL HTTP Location header buffer overflow
14964| [8455] Oracle9i Application Server default installation could allow an attacker to access certain Apache Services
14965| [8400] Apache HTTP Server mod_frontpage buffer overflows
14966| [8326] Apache HTTP Server multiple MIME headers (sioux) denial of service
14967| [8308] Apache "
14968| [8275] Apache HTTP Server with Multiviews enabled could disclose directory contents
14969| [8119] Apache and PHP OPTIONS request reveals "
14970| [8054] Apache is running on the system
14971| [8029] Mandrake Linux default Apache configuration could allow an attacker to browse files and directories
14972| [8027] Mandrake Linux default Apache configuration has remote management interface enabled
14973| [8026] Mandrake Linux Apache sample programs could disclose sensitive information about the server
14974| [7836] Apache HTTP Server log directory denial of service
14975| [7815] Apache for Windows "
14976| [7810] Apache HTTP request could result in unexpected behavior
14977| [7599] Apache Tomcat reveals installation path
14978| [7494] Apache "
14979| [7419] Apache Web Server could allow remote attackers to overwrite .log files
14980| [7363] Apache Web Server hidden HTTP requests
14981| [7249] Apache mod_proxy denial of service
14982| [7129] Linux with Apache Web server could allow an attacker to determine if a specified username exists
14983| [7103] Apple Mac OS X used with Apache Web server could disclose directory contents
14984| [7059] Apache "
14985| [7057] Apache "
14986| [7056] Apache "
14987| [7055] Apache "
14988| [7054] Apache "
14989| [6997] Apache Jakarta Tomcat error message may reveal information
14990| [6971] Apache Jakarta Tomcat may reveal JSP source code with missing HTTP protocol specification
14991| [6970] Apache crafted HTTP request could reveal the internal IP address
14992| [6921] Apache long slash path allows directory listing
14993| [6687] Apple Mac OS X used with Apache Web server could allow arbitrary file disclosure
14994| [6527] Apache Web Server for Windows and OS2 denial of service
14995| [6316] Apache Jakarta Tomcat may reveal JSP source code
14996| [6305] Apache Jakarta Tomcat directory traversal
14997| [5926] Linux Apache symbolic link
14998| [5659] Apache Web server discloses files when used with php script
14999| [5310] Apache mod_rewrite allows attacker to view arbitrary files
15000| [5204] Apache WebDAV directory listings
15001| [5197] Apache Web server reveals CGI script source code
15002| [5160] Apache Jakarta Tomcat default installation
15003| [5099] Trustix Secure Linux installs Apache with world writable access
15004| [4968] Apache Jakarta Tomcat snoop servlet gives out information which could be used in attack
15005| [4967] Apache Jakarta Tomcat 404 error reveals the pathname of the requested file
15006| [4931] Apache source.asp example file allows users to write to files
15007| [4575] IBM HTTP Server running Apache allows users to directory listing and file retrieval
15008| [4205] Apache Jakarta Tomcat delivers file contents
15009| [2084] Apache on Debian by default serves the /usr/doc directory
15010| [1630] MessageMedia UnityMail and Apache Web server MIME header flood denial of service
15011| [697] Apache HTTP server beck exploit
15012| [331] Apache cookies buffer overflow
15013|
15014| Exploit-DB - https://www.exploit-db.com:
15015| [31130] Apache Tomcat <= 6.0.15 Cookie Quote Handling Remote Information Disclosure Vulnerability
15016| [31052] Apache <= 2.2.6 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
15017| [30901] Apache HTTP Server 2.2.6 Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
15018| [30835] Apache HTTP Server <= 2.2.4 413 Error HTTP Request Method Cross-Site Scripting Weakness
15019| [30563] Apache Tomcat <= 5.5.15 Cal2.JSP Cross-Site Scripting Vulnerability
15020| [30496] Apache Tomcat <= 6.0.13 Cookie Handling Quote Delimiter Session ID Disclosure
15021| [30495] Apache Tomcat <= 6.0.13 Host Manager Servlet Cross Site Scripting Vulnerability
15022| [30191] Apache MyFaces Tomahawk JSF Framework 1.1.5 Autoscroll Parameter Cross Site Scripting Vulnerability
15023| [30189] Apache Tomcat <= 6.0.13 JSP Example Web Applications Cross Site Scripting Vulnerability
15024| [30052] Apache Tomcat 6.0.10 Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
15025| [29930] Apache AXIS 1.0 Non-Existent WSDL Path Information Disclosure Vulnerability
15026| [29859] Apache Roller OGNL Injection
15027| [29739] Apache HTTP Server Tomcat 5.x/6.0.x Directory Traversal Vulnerability
15028| [29435] Apache Tomcat 5.5.25 - CSRF Vulnerabilities
15029| [29316] Apache + PHP 5.x - Remote Code Execution (Multithreaded Scanner) (2)
15030| [29290] Apache / PHP 5.x Remote Code Execution Exploit
15031| [28713] Apache Tomcat/JBoss EJBInvokerServlet / JMXInvokerServlet (RMI over HTTP) Marshalled Object RCE
15032| [28424] Apache 2.x HTTP Server Arbitrary HTTP Request Headers Security Weakness
15033| [28365] Apache 2.2.2 CGI Script Source Code Information Disclosure Vulnerability
15034| [28254] Apache Tomcat 5 Information Disclosure Vulnerability
15035| [27915] Apache James 2.2 SMTP Denial of Service Vulnerability
15036| [27397] Apache suEXEC Privilege Elevation / Information Disclosure
15037| [27135] Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
15038| [27096] Apache Geronimo 1.0 Error Page XSS
15039| [27095] Apache Tomcat / Geronimo 1.0 Sample Script cal2.jsp time Parameter XSS
15040| [26710] Apache CXF prior to 2.5.10, 2.6.7 and 2.7.4 - Denial of Service
15041| [26542] Apache Struts 1.2.7 Error Response Cross-Site Scripting Vulnerability
15042| [25986] Plesk Apache Zeroday Remote Exploit
15043| [25980] Apache Struts includeParams Remote Code Execution
15044| [25625] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (2)
15045| [25624] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (1)
15046| [24874] Apache Struts ParametersInterceptor Remote Code Execution
15047| [24744] Apache Rave 0.11 - 0.20 - User Information Disclosure
15048| [24694] Apache 1.3.x mod_include Local Buffer Overflow Vulnerability
15049| [24590] Apache 2.0.x mod_ssl Remote Denial of Service Vulnerability
15050| [23751] Apache Cygwin 1.3.x/2.0.x Directory Traversal Vulnerability
15051| [23581] Apache 2.0.4x mod_perl Module File Descriptor Leakage Vulnerability
15052| [23482] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (2)
15053| [23481] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (1)
15054| [23296] Red Hat Apache 2.0.40 Directory Index Default Configuration Error
15055| [23282] apache cocoon 2.14/2.2 - Directory Traversal vulnerability
15056| [23245] Apache Tomcat 4.0.x Non-HTTP Request Denial of Service Vulnerability
15057| [23119] Apache::Gallery 0.4/0.5/0.6 Insecure Local File Storage Privilege Escalation Vulnerability
15058| [22505] Apache Mod_Access_Referer 1.0.2 NULL Pointer Dereference Denial of Service Vulnerability
15059| [22205] Apache Tomcat 3.x Null Byte Directory/File Disclosure Vulnerability
15060| [22191] Apache Web Server 2.0.x MS-DOS Device Name Denial of Service Vulnerability
15061| [22068] Apache 1.3.x,Tomcat 4.0.x/4.1.x Mod_JK Chunked Encoding Denial of Service Vulnerability
15062| [21885] Apache 1.3/2.0.x Server Side Include Cross Site Scripting Vulnerability
15063| [21882] Apache Tomcat 3.2 Directory Disclosure Vulnerability
15064| [21854] Apache 2.0.39/40 Oversized STDERR Buffer Denial of Service Vulnerability
15065| [21853] Apache Tomcat 3/4 DefaultServlet File Disclosure Vulnerability
15066| [21734] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
15067| [21719] Apache 2.0 Path Disclosure Vulnerability
15068| [21697] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
15069| [21605] Apache Tomcat 4.0.3 DoS Device Name Cross Site Scripting Vulnerability
15070| [21604] Apache Tomcat 4.0.3 Servlet Mapping Cross Site Scripting Vulnerability
15071| [21560] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (2)
15072| [21559] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (1)
15073| [21534] Apache Tomcat 3/4 JSP Engine Denial of Service Vulnerability
15074| [21492] Apache Tomcat 3.2.3/3.2.4 RealPath.JSP Malformed Request Information Disclosure
15075| [21491] Apache Tomcat 3.2.3/3.2.4 Example Files Web Root Path Disclosure
15076| [21490] Apache Tomcat 3.2.3/3.2.4 Source.JSP Malformed Request Information Disclosure
15077| [21412] Apache Tomcat 4.0/4.1 Servlet Path Disclosure Vulnerability
15078| [21350] Apache Win32 1.3.x/2.0.x Batch File Remote Command Execution Vulnerability
15079| [21204] Apache 1.3.20 Win32 PHP.EXE Remote File Disclosure Vulnerability
15080| [21112] Red Hat Linux 7.0 Apache Remote Username Enumeration Vulnerability
15081| [21067] Apache 1.0/1.2/1.3 Server Address Disclosure Vulnerability
15082| [21002] Apache 1.3 Possible Directory Index Disclosure Vulnerability
15083| [20911] Apache 1.3.14 Mac File Protection Bypass Vulnerability
15084| [20716] apache tomcat 3.0 - Directory Traversal vulnerability
15085| [20695] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (4)
15086| [20694] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (3)
15087| [20693] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (2)
15088| [20692] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (1)
15089| [20595] NCSA 1.3/1.4.x/1.5,Apache httpd 0.8.11/0.8.14 ScriptAlias Source Retrieval Vulnerability
15090| [20558] Apache 1.2 Web Server DoS Vulnerability
15091| [20466] Apache 1.3 Web Server with Php 3 File Disclosure Vulnerability
15092| [20435] Apache 0.8.x/1.0.x,NCSA httpd 1.x test-cgi Directory Listing Vulnerability
15093| [20272] Apache 1.2.5/1.3.1,UnityMail 2.0 MIME Header DoS Vulnerability
15094| [20210] Apache 1.3.12 WebDAV Directory Listings Vulnerability
15095| [20131] Apache Tomcat 3.1 Path Revealing Vulnerability
15096| [19975] Apache 1.3.6/1.3.9/1.3.11/1.3.12/1.3.20 Root Directory Access Vulnerability
15097| [19828] Cobalt RaQ 2.0/3.0 Apache .htaccess Disclosure Vulnerability
15098| [19536] Apache <= 1.1,NCSA httpd <= 1.5.2,Netscape Server 1.12/1.1/2.0 a nph-test-cgi Vulnerability
15099| [19231] PHP apache_request_headers Function Buffer Overflow
15100| [18984] Apache Struts <= 2.2.1.1 - Remote Command Execution
15101| [18897] Oracle Weblogic Apache Connector POST Request Buffer Overflow
15102| [18619] Apache Tomcat Remote Exploit (PUT Request) and Account Scanner
15103| [18452] Apache Struts Multiple Persistent Cross-Site Scripting Vulnerabilities
15104| [18442] Apache httpOnly Cookie Disclosure
15105| [18329] Apache Struts2 <= 2.3.1 - Multiple Vulnerabilities
15106| [18221] Apache HTTP Server Denial of Service
15107| [17969] Apache mod_proxy Reverse Proxy Exposure Vulnerability PoC
15108| [17696] Apache httpd Remote Denial of Service (memory exhaustion)
15109| [17691] Apache Struts < 2.2.0 - Remote Command Execution
15110| [16798] Apache mod_jk 1.2.20 Buffer Overflow
15111| [16782] Apache Win32 Chunked Encoding
15112| [16752] Apache module mod_rewrite LDAP protocol Buffer Overflow
15113| [16317] Apache Tomcat Manager Application Deployer Authenticated Code Execution
15114| [15710] Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability
15115| [15319] Apache 2.2 (Windows) Local Denial of Service
15116| [14617] Apache JackRabbit 2.0.0 webapp XPath Injection
15117| [14489] Apache Tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
15118| [12721] Apache Axis2 1.4.1 - Local File Inclusion Vulnerability
15119| [12689] Authenticated Cross-Site Scripting Vulnerability (XSS) within Apache Axis2 administration console
15120| [12343] Apache Tomcat 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 - Information Disclosure Vulnerability
15121| [12330] Apache OFBiz - Multiple XSS
15122| [12264] Apache OFBiz - FULLADMIN Creator PoC Payload
15123| [12263] Apache OFBiz - SQL Remote Execution PoC Payload
15124| [11662] Apache Spamassassin Milter Plugin Remote Root Command Execution
15125| [11650] Apache 2.2.14 mod_isapi Dangling Pointer Remote SYSTEM Exploit
15126| [10811] Joomla.Tutorials GHDB: Apache directory listing Download Vulnerability
15127| [10292] Apache Tomcat 3.2.1 - 404 Error Page Cross Site Scripting Vulnerability
15128| [9995] Apache Tomcat Form Authentication Username Enumeration Weakness
15129| [9994] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
15130| [9993] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
15131| [8842] Apache mod_dav / svn Remote Denial of Service Exploit
15132| [8458] Apache Geronimo <= 2.1.3 - Multiple Directory Traversal Vulnerabilities
15133| [7264] Apache Tomcat runtime.getRuntime().exec() Privilege Escalation (win)
15134| [6229] apache tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
15135| [6100] Apache mod_jk 1.2.19 Remote Buffer Overflow Exploit (win32)
15136| [6089] Bea Weblogic Apache Connector Code Exec / Denial of Service Exploit
15137| [5386] Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit
15138| [5330] Apache 2.0 mod_jk2 2.0.2 - Remote Buffer Overflow Exploit (win32)
15139| [4552] Apache Tomcat (webdav) Remote File Disclosure Exploit (ssl support)
15140| [4530] Apache Tomcat (webdav) Remote File Disclosure Exploit
15141| [4162] Apache Tomcat Connector (mod_jk) Remote Exploit (exec-shield)
15142| [4093] Apache mod_jk 1.2.19/1.2.20 Remote Buffer Overflow Exploit
15143| [3996] Apache 2.0.58 mod_rewrite Remote Overflow Exploit (win2k3)
15144| [3680] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
15145| [3384] Ubuntu/Debian Apache 1.3.33/1.3.34 (CGI TTY) Local Root Exploit
15146| [2237] Apache < 1.3.37, 2.0.59, 2.2.3 (mod_rewrite) Remote Overflow PoC
15147| [2061] Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
15148| [1056] Apache <= 2.0.49 Arbitrary Long HTTP Headers Denial of Service
15149| [855] Apache <= 2.0.52 HTTP GET request Denial of Service Exploit
15150| [764] Apache OpenSSL - Remote Exploit (Multiple Targets) (OpenFuckV2.c)
15151| [587] Apache <= 1.3.31 mod_include Local Buffer Overflow Exploit
15152| [466] htpasswd Apache 1.3.31 - Local Exploit
15153| [371] Apache HTTPd Arbitrary Long HTTP Headers DoS (c version)
15154| [360] Apache HTTPd Arbitrary Long HTTP Headers DoS
15155| [132] Apache 1.3.x - 2.0.48 - mod_userdir Remote Users Disclosure Exploit
15156| [126] Apache mod_gzip (with debug_mode) <= 1.2.26.1a Remote Exploit
15157| [67] Apache 1.3.x mod_mylo Remote Code Execution Exploit
15158| [38] Apache <= 2.0.45 APR Remote Exploit -Apache-Knacker.pl
15159| [34] Webfroot Shoutbox < 2.32 (Apache) Remote Exploit
15160| [11] Apache <= 2.0.44 Linux Remote Denial of Service Exploit
15161| [9] Apache HTTP Server 2.x Memory Leak Exploit
15162|
15163| OpenVAS (Nessus) - http://www.openvas.org:
15164| [902924] Apache Struts2 Showcase Skill Name Remote Code Execution Vulnerability
15165| [902837] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability (Windows)
15166| [902830] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
15167| [902664] Apache Traffic Server HTTP Host Header Denial of Service Vulnerability
15168| [901203] Apache httpd Web Server Range Header Denial of Service Vulnerability
15169| [901110] Apache ActiveMQ Source Code Information Disclosure Vulnerability
15170| [901105] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
15171| [900842] Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux)
15172| [900841] Apache 'mod_proxy_ftp' Module Denial Of Service Vulnerability (Linux)
15173| [900573] Apache APR-Utils XML Parser Denial of Service Vulnerability
15174| [900572] Apache APR-Utils Multiple Denial of Service Vulnerabilities
15175| [900571] Apache APR-Utils Version Detection
15176| [900499] Apache mod_proxy_ajp Information Disclosure Vulnerability
15177| [900496] Apache Tiles Multiple XSS Vulnerability
15178| [900493] Apache Tiles Version Detection
15179| [900107] Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability
15180| [900021] Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities
15181| [880086] CentOS Update for apache CESA-2008:0004-01 centos2 i386
15182| [870175] RedHat Update for apache RHSA-2008:0004-01
15183| [864591] Fedora Update for apache-poi FEDORA-2012-10835
15184| [864383] Fedora Update for apache-commons-compress FEDORA-2012-8428
15185| [864280] Fedora Update for apache-commons-compress FEDORA-2012-8465
15186| [864250] Fedora Update for apache-poi FEDORA-2012-7683
15187| [864249] Fedora Update for apache-poi FEDORA-2012-7686
15188| [863993] Fedora Update for apache-commons-daemon FEDORA-2011-10880
15189| [863466] Fedora Update for apache-commons-daemon FEDORA-2011-10936
15190| [855821] Solaris Update for Apache 1.3 122912-19
15191| [855812] Solaris Update for Apache 1.3 122911-19
15192| [855737] Solaris Update for Apache 1.3 122911-17
15193| [855731] Solaris Update for Apache 1.3 122912-17
15194| [855695] Solaris Update for Apache 1.3 122911-16
15195| [855645] Solaris Update for Apache 1.3 122912-16
15196| [855587] Solaris Update for kernel update and Apache 108529-29
15197| [855566] Solaris Update for Apache 116973-07
15198| [855531] Solaris Update for Apache 116974-07
15199| [855524] Solaris Update for Apache 2 120544-14
15200| [855494] Solaris Update for Apache 1.3 122911-15
15201| [855478] Solaris Update for Apache Security 114145-11
15202| [855472] Solaris Update for Apache Security 113146-12
15203| [855179] Solaris Update for Apache 1.3 122912-15
15204| [855147] Solaris Update for kernel update and Apache 108528-29
15205| [855077] Solaris Update for Apache 2 120543-14
15206| [850196] SuSE Update for apache2 openSUSE-SU-2012:0314-1 (apache2)
15207| [850088] SuSE Update for apache2 SUSE-SA:2007:061
15208| [850009] SuSE Update for apache2,apache SUSE-SA:2008:021
15209| [841209] Ubuntu Update for apache2 USN-1627-1
15210| [840900] Ubuntu Update for apache2 USN-1368-1
15211| [840798] Ubuntu Update for apache2 USN-1259-1
15212| [840734] Ubuntu Update for apache2 USN-1199-1
15213| [840542] Ubuntu Update for apache2 vulnerabilities USN-1021-1
15214| [840504] Ubuntu Update for apache2 vulnerability USN-990-2
15215| [840399] Ubuntu Update for apache2 vulnerabilities USN-908-1
15216| [840304] Ubuntu Update for apache2 vulnerabilities USN-575-1
15217| [840118] Ubuntu Update for libapache2-mod-perl2 vulnerability USN-488-1
15218| [840092] Ubuntu Update for apache2 vulnerabilities USN-499-1
15219| [840039] Ubuntu Update for libapache2-mod-python vulnerability USN-430-1
15220| [835253] HP-UX Update for Apache Web Server HPSBUX02645
15221| [835247] HP-UX Update for Apache-based Web Server HPSBUX02612
15222| [835243] HP-UX Update for Apache Running Tomcat Servlet Engine HPSBUX02579
15223| [835236] HP-UX Update for Apache with PHP HPSBUX02543
15224| [835233] HP-UX Update for Apache-based Web Server HPSBUX02531
15225| [835224] HP-UX Update for Apache-based Web Server HPSBUX02465
15226| [835200] HP-UX Update for Apache Web Server Suite HPSBUX02431
15227| [835190] HP-UX Update for Apache Web Server Suite HPSBUX02401
15228| [835188] HP-UX Update for Apache HPSBUX02308
15229| [835181] HP-UX Update for Apache With PHP HPSBUX02332
15230| [835180] HP-UX Update for Apache with PHP HPSBUX02342
15231| [835172] HP-UX Update for Apache HPSBUX02365
15232| [835168] HP-UX Update for Apache HPSBUX02313
15233| [835148] HP-UX Update for Apache HPSBUX01064
15234| [835139] HP-UX Update for Apache with PHP HPSBUX01090
15235| [835131] HP-UX Update for Apache HPSBUX00256
15236| [835119] HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186
15237| [835104] HP-UX Update for Apache HPSBUX00224
15238| [835103] HP-UX Update for Apache mod_cgid HPSBUX00301
15239| [835101] HP-UX Update for Apache HPSBUX01232
15240| [835080] HP-UX Update for Apache HPSBUX02273
15241| [835078] HP-UX Update for ApacheStrong HPSBUX00255
15242| [835044] HP-UX Update for Apache HPSBUX01019
15243| [835040] HP-UX Update for Apache PHP HPSBUX00207
15244| [835025] HP-UX Update for Apache HPSBUX00197
15245| [835023] HP-UX Update for Apache HPSBUX01022
15246| [835022] HP-UX Update for Apache HPSBUX02292
15247| [835005] HP-UX Update for Apache HPSBUX02262
15248| [831759] Mandriva Update for apache-mod_security MDVSA-2012:182 (apache-mod_security)
15249| [831737] Mandriva Update for apache MDVSA-2012:154-1 (apache)
15250| [831534] Mandriva Update for apache MDVSA-2012:012 (apache)
15251| [831523] Mandriva Update for apache MDVSA-2012:003 (apache)
15252| [831491] Mandriva Update for apache MDVSA-2011:168 (apache)
15253| [831460] Mandriva Update for apache MDVSA-2011:144 (apache)
15254| [831449] Mandriva Update for apache MDVSA-2011:130 (apache)
15255| [831357] Mandriva Update for apache MDVSA-2011:057 (apache)
15256| [831132] Mandriva Update for apache MDVSA-2010:153 (apache)
15257| [831131] Mandriva Update for apache MDVSA-2010:152 (apache)
15258| [830989] Mandriva Update for apache-mod_auth_shadow MDVSA-2010:081 (apache-mod_auth_shadow)
15259| [830931] Mandriva Update for apache MDVSA-2010:057 (apache)
15260| [830926] Mandriva Update for apache MDVSA-2010:053 (apache)
15261| [830918] Mandriva Update for apache-mod_security MDVSA-2010:050 (apache-mod_security)
15262| [830799] Mandriva Update for apache-conf MDVSA-2009:300-2 (apache-conf)
15263| [830797] Mandriva Update for apache-conf MDVSA-2009:300-1 (apache-conf)
15264| [830791] Mandriva Update for apache-conf MDVA-2010:011 (apache-conf)
15265| [830652] Mandriva Update for apache MDVSA-2008:195 (apache)
15266| [830621] Mandriva Update for apache-conf MDVA-2008:129 (apache-conf)
15267| [830581] Mandriva Update for apache MDVSA-2008:016 (apache)
15268| [830294] Mandriva Update for apache MDKSA-2007:140 (apache)
15269| [830196] Mandriva Update for apache MDKSA-2007:235 (apache)
15270| [830112] Mandriva Update for apache MDKSA-2007:127 (apache)
15271| [830109] Mandriva Update for apache-mod_perl MDKSA-2007:083 (apache-mod_perl)
15272| [802425] Apache Struts2 Showcase Arbitrary Java Method Execution vulnerability
15273| [802423] Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities
15274| [802422] Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities
15275| [802415] Apache Tomcat Multiple Security Bypass Vulnerabilities (Win)
15276| [802385] Apache Tomcat Request Object Security Bypass Vulnerability (Win)
15277| [802384] Apache Tomcat Parameter Handling Denial of Service Vulnerability (Win)
15278| [802378] Apache Tomcat Hash Collision Denial Of Service Vulnerability
15279| [801942] Apache Archiva Multiple Vulnerabilities
15280| [801940] Apache Struts2 'XWork' Information Disclosure Vulnerability
15281| [801663] Apache Struts2/XWork Remote Command Execution Vulnerability
15282| [801521] Apache APR-util 'buckets/apr_brigade.c' Denial Of Service Vulnerability
15283| [801284] Apache Derby Information Disclosure Vulnerability
15284| [801203] Apache ActiveMQ Persistent Cross-Site Scripting Vulnerability
15285| [800837] Apache 'mod_deflate' Denial Of Service Vulnerability - July09
15286| [800827] Apache 'mod_proxy_http.c' Denial Of Service Vulnerability
15287| [800680] Apache APR Version Detection
15288| [800679] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
15289| [800678] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
15290| [800677] Apache Roller Version Detection
15291| [800279] Apache mod_jk Module Version Detection
15292| [800278] Apache Struts Cross Site Scripting Vulnerability
15293| [800277] Apache Tomcat mod_jk Information Disclosure Vulnerability
15294| [800276] Apache Struts Version Detection
15295| [800271] Apache Struts Directory Traversal Vulnerability
15296| [800024] Apache Tomcat RemoteFilterValve Security Bypass Vulnerability
15297| [103333] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
15298| [103293] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
15299| [103122] Apache Web Server ETag Header Information Disclosure Weakness
15300| [103074] Apache Continuum Cross Site Scripting Vulnerability
15301| [103073] Apache Continuum Detection
15302| [103053] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
15303| [101023] Apache Open For Business Weak Password security check
15304| [101020] Apache Open For Business HTML injection vulnerability
15305| [101019] Apache Open For Business service detection
15306| [100924] Apache Archiva Cross Site Request Forgery Vulnerability
15307| [100923] Apache Archiva Detection
15308| [100858] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
15309| [100814] Apache Axis2 Document Type Declaration Processing Security Vulnerability
15310| [100813] Apache Axis2 Detection
15311| [100797] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
15312| [100795] Apache Derby Detection
15313| [100762] Apache CouchDB Cross Site Request Forgery Vulnerability
15314| [100725] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
15315| [100613] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
15316| [100514] Apache Multiple Security Vulnerabilities
15317| [100211] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
15318| [100172] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
15319| [100171] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
15320| [100130] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
15321| [72626] Debian Security Advisory DSA 2579-1 (apache2)
15322| [72612] FreeBSD Ports: apache22
15323| [71551] Gentoo Security Advisory GLSA 201206-25 (apache)
15324| [71550] Gentoo Security Advisory GLSA 201206-24 (apache tomcat)
15325| [71512] FreeBSD Ports: apache
15326| [71485] Debian Security Advisory DSA 2506-1 (libapache-mod-security)
15327| [71256] Debian Security Advisory DSA 2452-1 (apache2)
15328| [71238] Debian Security Advisory DSA 2436-1 (libapache2-mod-fcgid)
15329| [70737] FreeBSD Ports: apache
15330| [70724] Debian Security Advisory DSA 2405-1 (apache2)
15331| [70600] FreeBSD Ports: apache
15332| [70253] FreeBSD Ports: apache, apache-event, apache-itk, apache-peruser, apache-worker
15333| [70235] Debian Security Advisory DSA 2298-2 (apache2)
15334| [70233] Debian Security Advisory DSA 2298-1 (apache2)
15335| [69988] Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)
15336| [69338] Debian Security Advisory DSA 2202-1 (apache2)
15337| [67868] FreeBSD Ports: apache
15338| [66816] FreeBSD Ports: apache
15339| [66553] Mandriva Security Advisory MDVSA-2009:189-1 (apache-mod_auth_mysql)
15340| [66414] Mandriva Security Advisory MDVSA-2009:323 (apache)
15341| [66106] SuSE Security Advisory SUSE-SA:2009:050 (apache2,libapr1)
15342| [66081] SLES11: Security update for Apache 2
15343| [66074] SLES10: Security update for Apache 2
15344| [66070] SLES9: Security update for Apache 2
15345| [65998] SLES10: Security update for apache2-mod_python
15346| [65893] SLES10: Security update for Apache 2
15347| [65888] SLES10: Security update for Apache 2
15348| [65575] SLES9: Security update for apache2,apache2-prefork,apache2-worker
15349| [65510] SLES9: Security update for Apache 2
15350| [65472] SLES9: Security update for Apache
15351| [65467] SLES9: Security update for Apache
15352| [65450] SLES9: Security update for apache2
15353| [65390] SLES9: Security update for Apache2
15354| [65363] SLES9: Security update for Apache2
15355| [65309] SLES9: Security update for Apache and mod_ssl
15356| [65296] SLES9: Security update for webdav apache module
15357| [65283] SLES9: Security update for Apache2
15358| [65249] SLES9: Security update for Apache 2
15359| [65230] SLES9: Security update for Apache 2
15360| [65228] SLES9: Security update for Apache 2
15361| [65212] SLES9: Security update for apache2-mod_python
15362| [65209] SLES9: Security update for apache2-worker
15363| [65207] SLES9: Security update for Apache 2
15364| [65168] SLES9: Security update for apache2-mod_python
15365| [65142] SLES9: Security update for Apache2
15366| [65136] SLES9: Security update for Apache 2
15367| [65132] SLES9: Security update for apache
15368| [65131] SLES9: Security update for Apache 2 oes/CORE
15369| [65113] SLES9: Security update for apache2
15370| [65072] SLES9: Security update for apache and mod_ssl
15371| [65017] SLES9: Security update for Apache 2
15372| [64950] Mandrake Security Advisory MDVSA-2009:240 (apache)
15373| [64783] FreeBSD Ports: apache
15374| [64774] Ubuntu USN-802-2 (apache2)
15375| [64653] Ubuntu USN-813-2 (apache2)
15376| [64559] Debian Security Advisory DSA 1834-2 (apache2)
15377| [64532] Mandrake Security Advisory MDVSA-2009:189 (apache-mod_auth_mysql)
15378| [64527] Mandrake Security Advisory MDVSA-2009:184 (apache-mod_security)
15379| [64526] Mandrake Security Advisory MDVSA-2009:183 (apache-mod_security)
15380| [64500] Mandrake Security Advisory MDVSA-2009:168 (apache)
15381| [64443] Ubuntu USN-802-1 (apache2)
15382| [64426] Gentoo Security Advisory GLSA 200907-04 (apache)
15383| [64423] Debian Security Advisory DSA 1834-1 (apache2)
15384| [64391] Mandrake Security Advisory MDVSA-2009:149 (apache)
15385| [64377] Mandrake Security Advisory MDVSA-2009:124-1 (apache)
15386| [64251] Debian Security Advisory DSA 1816-1 (apache2)
15387| [64201] Ubuntu USN-787-1 (apache2)
15388| [64140] Mandrake Security Advisory MDVSA-2009:124 (apache)
15389| [64136] Mandrake Security Advisory MDVSA-2009:102 (apache)
15390| [63565] FreeBSD Ports: apache
15391| [63562] Ubuntu USN-731-1 (apache2)
15392| [61381] Gentoo Security Advisory GLSA 200807-06 (apache)
15393| [61185] FreeBSD Ports: apache
15394| [60582] Gentoo Security Advisory GLSA 200803-19 (apache)
15395| [60387] Slackware Advisory SSA:2008-045-02 apache
15396| [58826] FreeBSD Ports: apache-tomcat
15397| [58825] FreeBSD Ports: apache-tomcat
15398| [58804] FreeBSD Ports: apache
15399| [58745] Gentoo Security Advisory GLSA 200711-06 (apache)
15400| [58360] Debian Security Advisory DSA 1312-1 (libapache-mod-jk)
15401| [57851] Gentoo Security Advisory GLSA 200608-01 (apache)
15402| [57788] Debian Security Advisory DSA 1247-1 (libapache-mod-auth-kerb)
15403| [57335] Debian Security Advisory DSA 1167-1 (apache)
15404| [57201] Debian Security Advisory DSA 1131-1 (apache)
15405| [57200] Debian Security Advisory DSA 1132-1 (apache2)
15406| [57168] Slackware Advisory SSA:2006-209-01 Apache httpd
15407| [57145] FreeBSD Ports: apache
15408| [56731] Slackware Advisory SSA:2006-129-01 Apache httpd
15409| [56729] Slackware Advisory SSA:2006-130-01 Apache httpd redux
15410| [56246] Gentoo Security Advisory GLSA 200602-03 (Apache)
15411| [56212] Debian Security Advisory DSA 952-1 (libapache-auth-ldap)
15412| [56115] Debian Security Advisory DSA 935-1 (libapache2-mod-auth-pgsql)
15413| [56067] FreeBSD Ports: apache
15414| [55803] Slackware Advisory SSA:2005-310-04 apache
15415| [55519] Debian Security Advisory DSA 839-1 (apachetop)
15416| [55392] Gentoo Security Advisory GLSA 200509-12 (Apache)
15417| [55355] FreeBSD Ports: apache
15418| [55284] Debian Security Advisory DSA 807-1 (libapache-mod-ssl)
15419| [55261] Debian Security Advisory DSA 805-1 (apache2)
15420| [55259] Debian Security Advisory DSA 803-1 (apache)
15421| [55129] Gentoo Security Advisory GLSA 200508-15 (apache)
15422| [54739] Gentoo Security Advisory GLSA 200411-18 (apache)
15423| [54724] Gentoo Security Advisory GLSA 200411-03 (apache)
15424| [54712] Gentoo Security Advisory GLSA 200410-21 (apache)
15425| [54689] Gentoo Security Advisory GLSA 200409-33 (net=www/apache)
15426| [54677] Gentoo Security Advisory GLSA 200409-21 (apache)
15427| [54610] Gentoo Security Advisory GLSA 200407-03 (Apache)
15428| [54601] Gentoo Security Advisory GLSA 200406-16 (Apache)
15429| [54590] Gentoo Security Advisory GLSA 200406-05 (Apache)
15430| [54582] Gentoo Security Advisory GLSA 200405-22 (Apache)
15431| [54529] Gentoo Security Advisory GLSA 200403-04 (Apache)
15432| [54499] Gentoo Security Advisory GLSA 200310-04 (Apache)
15433| [54498] Gentoo Security Advisory GLSA 200310-03 (Apache)
15434| [54439] FreeBSD Ports: apache
15435| [53931] Slackware Advisory SSA:2004-133-01 apache
15436| [53903] Slackware Advisory SSA:2004-299-01 apache, mod_ssl, php
15437| [53902] Slackware Advisory SSA:2004-305-01 apache+mod_ssl
15438| [53878] Slackware Advisory SSA:2003-308-01 apache security update
15439| [53851] Debian Security Advisory DSA 135-1 (libapache-mod-ssl)
15440| [53849] Debian Security Advisory DSA 132-1 (apache-ssl)
15441| [53848] Debian Security Advisory DSA 131-1 (apache)
15442| [53784] Debian Security Advisory DSA 021-1 (apache)
15443| [53738] Debian Security Advisory DSA 195-1 (apache-perl)
15444| [53737] Debian Security Advisory DSA 188-1 (apache-ssl)
15445| [53735] Debian Security Advisory DSA 187-1 (apache)
15446| [53703] Debian Security Advisory DSA 532-1 (libapache-mod-ssl)
15447| [53577] Debian Security Advisory DSA 120-1 (libapache-mod-ssl, apache-ssl)
15448| [53568] Debian Security Advisory DSA 067-1 (apache,apache-ssl)
15449| [53519] Debian Security Advisory DSA 689-1 (libapache-mod-python)
15450| [53433] Debian Security Advisory DSA 181-1 (libapache-mod-ssl)
15451| [53282] Debian Security Advisory DSA 594-1 (apache)
15452| [53248] Debian Security Advisory DSA 558-1 (libapache-mod-dav)
15453| [53224] Debian Security Advisory DSA 532-2 (libapache-mod-ssl)
15454| [53215] Debian Security Advisory DSA 525-1 (apache)
15455| [53151] Debian Security Advisory DSA 452-1 (libapache-mod-python)
15456| [52529] FreeBSD Ports: apache+ssl
15457| [52501] FreeBSD Ports: apache
15458| [52461] FreeBSD Ports: apache
15459| [52390] FreeBSD Ports: apache
15460| [52389] FreeBSD Ports: apache
15461| [52388] FreeBSD Ports: apache
15462| [52383] FreeBSD Ports: apache
15463| [52339] FreeBSD Ports: apache+mod_ssl
15464| [52331] FreeBSD Ports: apache
15465| [52329] FreeBSD Ports: ru-apache+mod_ssl
15466| [52314] FreeBSD Ports: apache
15467| [52310] FreeBSD Ports: apache
15468| [15588] Detect Apache HTTPS
15469| [15555] Apache mod_proxy content-length buffer overflow
15470| [15554] Apache mod_include priviledge escalation
15471| [14771] Apache <= 1.3.33 htpasswd local overflow
15472| [14177] Apache mod_access rule bypass
15473| [13644] Apache mod_rootme Backdoor
15474| [12293] Apache Input Header Folding and mod_ssl ssl_io_filter_cleanup DoS Vulnerabilities
15475| [12280] Apache Connection Blocking Denial of Service
15476| [12239] Apache Error Log Escape Sequence Injection
15477| [12123] Apache Tomcat source.jsp malformed request information disclosure
15478| [12085] Apache Tomcat servlet/JSP container default files
15479| [11438] Apache Tomcat Directory Listing and File disclosure
15480| [11204] Apache Tomcat Default Accounts
15481| [11092] Apache 2.0.39 Win32 directory traversal
15482| [11046] Apache Tomcat TroubleShooter Servlet Installed
15483| [11042] Apache Tomcat DOS Device Name XSS
15484| [11041] Apache Tomcat /servlet Cross Site Scripting
15485| [10938] Apache Remote Command Execution via .bat files
15486| [10839] PHP.EXE / Apache Win32 Arbitrary File Reading Vulnerability
15487| [10773] MacOS X Finder reveals contents of Apache Web files
15488| [10766] Apache UserDir Sensitive Information Disclosure
15489| [10756] MacOS X Finder reveals contents of Apache Web directories
15490| [10752] Apache Auth Module SQL Insertion Attack
15491| [10704] Apache Directory Listing
15492| [10678] Apache /server-info accessible
15493| [10677] Apache /server-status accessible
15494| [10440] Check for Apache Multiple / vulnerability
15495|
15496| SecurityTracker - https://www.securitytracker.com:
15497| [1028865] Apache Struts Bugs Permit Remote Code Execution and URL Redirection Attacks
15498| [1028864] Apache Struts Wildcard Matching and Expression Evaluation Bugs Let Remote Users Execute Arbitrary Code
15499| [1028824] Apache mod_dav_svn URI Processing Flaw Lets Remote Users Deny Service
15500| [1028823] Apache Unspecified Flaw in mod_session_dbd Has Unspecified Impact
15501| [1028724] (HP Issues Fix for HP-UX) Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
15502| [1028722] (Red Hat Issues Fix for JBoss) Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
15503| [1028693] (Red Hat Issues Fix) Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
15504| [1028622] Apache Struts 'includeParams' Bugs Permit Remote Command Execution and Cross-Site Scripting Attacks
15505| [1028621] Apache Subversion Bugs Let Remote Authenticated Users Execute Arbitrary Commands and Deny Service
15506| [1028540] Apache mod_rewrite Input Validation Flaw Lets Remote Users Execute Arbitrary Commands
15507| [1028534] Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
15508| [1028533] Apache Tomcat Lack of Chunked Transfer Encoding Extension Size Limit Lets Remote Users Deny Service
15509| [1028532] Apache Tomcat AsyncListeners Bug May Disclose Information from One Request to Another User
15510| [1028515] Apache VCL Input Validation Flaw Lets Remote Authenticated Users Gain Elevated Privileges
15511| [1028457] Apache ActiveMQ Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Deny Service, and Obtain Potentially Sensitive Information
15512| [1028287] Apache CXF WSS4JInInterceptor Grants Service Access to Remote Users
15513| [1028286] Apache CXF WS-Security UsernameToken Processing Flaw Lets Remote Users Bypass Authentication
15514| [1028252] Apache Commons FileUpload Unsafe Temporary File Lets Local Users Gain Elevated Privileges
15515| [1028207] Apache Input Validation Bugs Permit Cross-Site Scripting Attacks
15516| [1027836] Apache Tomcat Connection Processing Bug Lets Remote Users Deny Service
15517| [1027834] Apache Tomcat Bug Lets Remote Users Bypass Cross-Site Request Forgery Prevention Filter
15518| [1027833] Apache Tomcat Bug Lets Remote Users Bypass Security Constraints
15519| [1027729] Apache Tomcat Header Processing Bug Lets Remote Users Deny Service
15520| [1027728] Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
15521| [1027554] Apache CXF Lets Remote Authenticated Users Execute Unauthorized SOAP Actions
15522| [1027508] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
15523| [1027421] Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
15524| [1027096] Apache Commons Compress BZip2CompressorOutputStream() Sorting Algorithm Lets Remote or Local Users Deny Service
15525| [1026932] Apache LD_LIBRARY_PATH Processing Lets Local Users Gain Elevated Privileges
15526| [1026928] Apache OFBiz Unspecified Flaw Lets Remote Users Execute Arbitrary Code
15527| [1026927] Apache OFBiz Input Validation Flaws Permit Cross-Site Scripting Attacks
15528| [1026847] Apache Traffic Server Host Header Processing Flaw Lets Remote Users Deny Service
15529| [1026846] Apache Wicket Discloses Hidden Application Files to Remote Users
15530| [1026839] Apache Wicket Input Validation Flaw in 'wicket:pageMapName' Parameter Permits Cross-Site Scripting Attacks
15531| [1026616] Apache Bugs Let Remote Users Deny Service and Obtain Cookie Data
15532| [1026575] Apache Struts ParameterInterceptor() Flaw Lets Remote Users Execute Arbitrary Commands
15533| [1026484] Apache Struts Bug Lets Remote Users Overwrite Files and Execute Arbitrary Code
15534| [1026477] Apache Tomcat Hash Table Collision Bug Lets Remote Users Deny Service
15535| [1026402] Apache Struts Conversion Error Lets Remote Users Inject Arbitrary Commands
15536| [1026353] Apache mod_proxy/mod_rewrite Bug Lets Remote Users Access Internal Servers
15537| [1026295] Apache Tomcat Lets Untrusted Web Applications Gain Elevated Privileges
15538| [1026267] Apache .htaccess File Integer Overflow Lets Local Users Execute Arbitrary Code
15539| [1026144] Apache mod_proxy Pattern Matching Bug Lets Remote Users Access Internal Servers
15540| [1026095] Apache Tomcat HTTP DIGEST Authentication Weaknesses Let Remote Users Conduct Bypass Attacks
15541| [1026054] Apache mod_proxy_ajp HTTP Processing Error Lets Remote Users Deny Service
15542| [1025993] Apache Tomcat AJP Protocol Processing Bug Lets Remote Users Bypass Authentication or Obtain Information
15543| [1025976] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
15544| [1025960] Apache httpd Byterange Filter Processing Error Lets Remote Users Deny Service
15545| [1025925] Apache Tomcat Commons Daemon jsvc Lets Local Users Gain Elevated Privileges
15546| [1025924] Apache Tomcat XML Validation Flaw Lets Applications Obtain Potentially Sensitive Information
15547| [1025788] Apache Tomcat Lets Malicious Applications Obtain Information and Deny Service
15548| [1025755] Apache Santuario Buffer Overflow Lets Remote Users Deny Service
15549| [1025712] Apache Tomcat Discloses Passwords to Local Users in Certain Cases
15550| [1025577] Apache Archiva Input Validation Hole Permits Cross-Site Scripting Attacks
15551| [1025576] Apache Archiva Request Validation Flaw Permits Cross-Site Request Forgery Attacks
15552| [1025527] Apache APR Library apr_fnmatch() Flaw Lets Remote Users Execute Arbitrary Code
15553| [1025303] Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
15554| [1025215] Apache Tomcat May Ignore @ServletSecurity Annotation Protections
15555| [1025066] Apache Continuum Input Validation Flaw Permits Cross-Site Request Forgery Attacks
15556| [1025065] Apache Continuum Input Validation Hole Permits Cross-Site Scripting Attacks
15557| [1025027] Apache Tomcat maxHttpHeaderSize Parsing Error Lets Remote Users Deny Service
15558| [1025026] Apache Tomcat Manager Input Validation Hole Permits Cross-Site Scripting Attacks
15559| [1025025] Apache Tomcat Security Manager Lets Local Users Bypass File Permissions
15560| [1024764] Apache Tomcat Manager Input Validation Hole in 'sessionList.jsp' Permits Cross-Site Scripting Attacks
15561| [1024417] Apache Traffic Server Insufficient Randomization Lets Remote Users Poison the DNS Cache
15562| [1024332] Apache mod_cache and mod_dav Request Processing Flaw Lets Remote Users Deny Service
15563| [1024180] Apache Tomcat 'Transfer-Encoding' Header Processing Flaw Lets Remote Users Deny Service and Obtain Potentially Sensitive Information
15564| [1024096] Apache mod_proxy_http May Return Results for a Different Request
15565| [1023942] Apache mod_proxy_ajp Error Condition Lets Remote Users Deny Service
15566| [1023941] Apache ap_read_request() Memory Error May Let Remote Users Access Potentially Sensitive Information
15567| [1023778] Apache ActiveMQ Input Validation Flaw Permits Cross-Site Scripting Attacks
15568| [1023701] Apache mod_isapi Error Processing Flaw May Let Remote Users Deny Service
15569| [1023533] Apache mod_proxy Integer Overflow May Let Remote Users Execute Arbitrary Code
15570| [1022988] Apache Solaris Support Code Bug Lets Remote Users Deny Service
15571| [1022529] Apache mod_deflate Connection State Bug Lets Remote Users Deny Service
15572| [1022509] Apache mod_proxy stream_reqbody_cl() Infinite Loop Lets Remote Users Deny Service
15573| [1022296] Apache IncludesNoExec Options Restrictions Can Be Bypass By Local Users
15574| [1022264] Apache mod_proxy_ajp Bug May Disclose Another User's Response Data
15575| [1022001] Apache Tomcat mod_jk May Disclose Responses to the Wrong User
15576| [1021988] mod_perl Input Validation Flaw in Apache::Status and Apache2::Status Permits Cross-Site Scripting Attacks
15577| [1021350] NetWare Bug Lets Remote Users Access the ApacheAdmin Console
15578| [1020635] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
15579| [1020520] Oracle WebLogic Apache Connector Lets Remote Users Execute Arbitrary Code
15580| [1020267] Apache mod_proxy Interim Response Process Bug Lets Remote Users Deny Service
15581| [1019784] Apache-SSL Certificate Processing Bug May Let Remote Users View Portions of Kernel Memory
15582| [1019256] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks
15583| [1019194] Apache Input Validation Hole in Mod_AutoIndex When the Character Set is Undefined May Permit Cross-Site Scripting Attacks
15584| [1019185] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
15585| [1019154] Apache Input Validation Hole in mod_status Permits Cross-Site Scripting Attacks
15586| [1019093] Apache Input Validation Hole in mod_imap Permits Cross-Site Scripting Attacks
15587| [1019030] Apache Input Validation Hole in Default HTTP 413 Error Page Permits Cross-Site Scripting Attacks
15588| [1018633] Apache mod_proxy Bug Lets Remote Users Deny Service
15589| [1018304] Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
15590| [1018303] Apache HTTPD mod_cache May Let Remote Users Deny Service
15591| [1018302] Apache mod_status Input Validation Hole Permits Cross-Site Scripting Attacks
15592| [1018269] Apache Tomcat Input Validation Hole in Processing Accept-Language Header Permits Cross-Site Scripting Attacks
15593| [1017904] Apache suEXEC Bugs May Let Local Users Gain Elevated Privileges
15594| [1017719] Apache Tomcat JK Web Server Connector Buffer Overflow in map_uri_to_worker() Lets Remote Users Execute Arbitrary Code
15595| [1017062] Apache mod_tcl Format String Bug in set_var() Function May Let Remote Users Execute Arbitrary Code
15596| [1016601] Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code
15597| [1016576] Apache Tomcat Discloses Directory Listings to Remote Users
15598| [1015447] Apache mod_ssl Null Pointer Dereference May Let Remote Users Deny Service
15599| [1015344] Apache mod_imap Input Validation Flaw in Referer Field Lets Remote Users Conduct Cross-Site Scripting Attacks
15600| [1015093] Apache Memory Leak in MPM 'worker.c' Code May Let Remote Users Deny Service
15601| [1014996] ApacheTop Unsafe Temporary File May Let Local Users Gain Elevated Privileges
15602| [1014833] Apache ssl_hook_Access() Function May Fail to Verify Client Certificates
15603| [1014826] Apache Memory Leak in 'byterange filter' Lets Remote Users Deny Service
15604| [1014575] Apache mod_ssl Off-by-one Buffer Overflow in Processing CRLs May Let Remote Users Deny Service
15605| [1014323] Apache Chunked Transfer-Encoding and Content-Length Processing Lets Remote Users Smuggle HTTP Requests
15606| [1013156] Apache mod_python Publisher Handler Discloses Information to Remote Users
15607| [1012829] Apache mod_auth_radius radcpy() Integer Overflow Lets Remote Users Deny Service in Certain Cases
15608| [1012416] Apache on Apple OS X Lets Remote Users Bypass Apache File Handlers and Directly Access Files
15609| [1012415] Apache on Apple HFS+ Filesystems May Disclose '.DS_Store' Files to Remote Users
15610| [1012414] Apache mod_digest_apple Lets Remote Users Replay Authentication Credentials
15611| [1012083] Apache Web Server Error in Processing Requests With Many Space Characters Lets Remote Users Deny Service
15612| [1011783] Apache mod_include Buffer Overflow Lets Local Users Execute Arbitrary Code
15613| [1011557] Apache mod_ssl SSLCipherSuite Directive Can By Bypassed in Certain Cases
15614| [1011385] Apache Satsify Directive Error May Let Remote Users Access Restricted Resources
15615| [1011340] Apache SSL Connection Abort State Error Lets Remote Users Deny Service
15616| [1011303] Apache ap_resolve_env() Buffer Overflow in Reading Configuration Files May Let Local Users Gain Elevated Privileges
15617| [1011299] Apache IPv6 Address Parsing Flaw May Let Remote Users Deny Service
15618| [1011248] Apache mod_dav LOCK Method Error May Let Remote Users Deny Service
15619| [1011213] Apache mod_ssl Can Be Crashed By Remote Users When Reverse Proxying SSL Connections
15620| [1010674] Apache Can Be Crashed By PHP Code Invoking Nested Remote Sockets
15621| [1010599] Apache httpd Header Line Memory Allocation Lets Remote Users Crash the Server
15622| [1010462] Apache mod_proxy Buffer Overflow May Let Remote Users Execute Arbitrary Code
15623| [1010322] Apache mod_ssl Stack Overflow in ssl_util_uuencode_binary() May Let Remote Users Execute Arbitrary Code
15624| [1010270] cPanel Apache mod_phpsuexec Options Let Local Users Gain Elevated Privileges
15625| [1009934] Apache Web Server Has Buffer Overflow in ebcdic2ascii() on Older Processor Architectures
15626| [1009516] Apache mod_survey HTML Report Format Lets Remote Users Conduct Cross-Site Scripting Attacks
15627| [1009509] Apache mod_disk_cache Stores Authentication Credentials on Disk
15628| [1009495] Apache Web Server Socket Starvation Flaw May Let Remote Users Deny Service
15629| [1009417] GroupWise WebAccess With Apache on NetWare Has Configuration Flaw That May Grant Web Access to Remote Users
15630| [1009338] Apache mod_access Parsing Flaw May Fail to Enforce Allow/Deny Rules
15631| [1009337] Apache mod_ssl Memory Leak Lets Remote Users Crash the Daemon
15632| [1009182] Apache for Cygwin '..%5C' Input Validation Flaw Discloses Files to Remote Users
15633| [1008973] PHP May Apply Incorrect php_admin_* Settings To Requests for Apache Virtual Hosts
15634| [1008967] Apache-SSL 'SSLFakeBasicAuth' Lets Remote Users Forge Client Certificates to Be Authenticated
15635| [1008920] Apache mod_digest May Validate Replayed Client Responses
15636| [1008828] Apache mod_python String Processing Bug Still Lets Remote Users Crash the Web Server
15637| [1008822] Apache mod_perl File Descriptor Leak May Let Local Users Hijack the http and https Services
15638| [1008675] mod_auth_shadow Apache Module Authenticates Expired Passwords
15639| [1008559] Apache mod_php File Descriptor Leak May Let Local Users Hijack the https Service
15640| [1008335] Apache mod_python String Processing Bug Lets Remote Users Crash the Web Server
15641| [1008196] Apache 2.x on Windows May Return Unexpected Files For URLs Ending With Certain Characters
15642| [1008030] Apache mod_rewrite Contains a Buffer Overflow
15643| [1008029] Apache mod_alias Contains a Buffer Overflow
15644| [1008028] Apache mod_cgid May Disclose CGI Output to Another Client
15645| [1007995] Apache Cocoon Forms May Let Remote Users Execute Arbitrary Java Code on the System
15646| [1007993] Apache Cocoon 'view-source' Sample Script Discloses Files to Remote Users
15647| [1007823] Apache Web Server mod_cgi Error May Let Malicious CGI Scripts Crash the Web Service
15648| [1007664] Apache::Gallery Unsafe Temporary Files May Let Local Users Gain Apache Web Server Privileges
15649| [1007557] Apache Web Server Does Not Filter Terminal Escape Sequences From Log Files
15650| [1007230] Apache HTTP Server 'rotatelogs' Bug on Win32 and OS/2 May Cause the Logging to Stop
15651| [1007146] Apache HTTP Server FTP Proxy Bug May Cause Denial of Service Conditions
15652| [1007145] Apache 'accept()' Errors May Cause Denial of Service Conditions
15653| [1007144] Apache Web Server 'type-map' File Error Permits Local Denial of Service Attacks
15654| [1007143] Apache 2.0 Web Server May Use a Weaker Encryption Implementation Than Specified in Some Cases
15655| [1006864] Apache Web Server Can Be Crashed By Remote Users Via mod_dav Flaws and Also Via Basic Authentication
15656| [1006709] Apache mod_survey Input Validation Flaw Lets Remote Users Fill Up Disk Space
15657| [1006614] Apache mod_ntlm Buffer Overflow and Format String Flaw Let Remote Users Execute Arbitary Code
15658| [1006591] Apache mod_access_referer Module Null Pointer Dereference May Faciliate Denial of Service Attacks
15659| [1006444] Apache 2.0 Web Server Line Feed Buffer Allocation Flaw Lets Remote Users Deny Service
15660| [1006021] Apache Tomcat Server URL Parsing Error May Disclose Otherwise Inaccessible Web Directory Listings and Files to Remote Users
15661| [1005963] Apache Web Server 2.x Windows Device Access Flaw Lets Remote Users Crash the Server or Possibly Execute Arbitrary Code
15662| [1005962] Apache Web Server Path Parsing Flaw May Allow Remote Users to Execute Code in Certain Configurations
15663| [1005848] Apache 'printenv' Script Input Validation Bugs in Older Versions May Let Remote Users Conduct Cross-Site Scripting Attacks
15664| [1005765] Apache mod_jk Module Processing Bug When Used With Tomcat May Disclose Information to Remote Users or Crash
15665| [1005548] Apache mod_php Module May Allow Local Users to Gain Control of the Web Port
15666| [1005499] Apache Web Server (2.0.42) May Disclose CGI Source Code to Remote Users When Used With WebDAV
15667| [1005410] Apache Tomcat Java Servlet Engine Can Be Crashed Via Multiple Requests for DOS Device Names
15668| [1005351] Apache Web Server (1.3.x) Shared Memory Scoreboard Bug Lets Certain Local Users Issue Signals With Root Privileges
15669| [1005331] Apache Web Server (2.x) SSI Server Signature Filtering Hole Lets Remote Users Conduct Cross-Site Scripting Attacks
15670| [1005290] Apache Tomcat Java Server Default Servlet Returns JSP Source Code to Remote Users
15671| [1005285] Apache Web Server 'mod_dav' Has Null Pointer Bug That May Allow Remote Users to Cause Denial of Service Conditions
15672| [1005010] Apache Web Server (2.0) Has Unspecified Flaw That Allows Remote Users to Obtain Sensitive Data and Cause Denial of Service Conditions
15673| [1004770] Apache 2.x Web Server ap_log_rerror() Function May Disclose Full Installation Path to Remote Users
15674| [1004745] Apache Tomcat Java Server Allows Cross-Site Scripting Attacks
15675| [1004636] Apache mod_ssl 'Off-by-One' Bug May Let Local Users Crash the Web Server or Possibly Execute Arbitrary Code
15676| [1004602] Apache Tomcat Java Server for Windows Can Be Crashed By Remote Users Sending Malicious Requests to Hang All Available Working Threads
15677| [1004586] Apache Tomcat Java Server May Disclose the Installation Path to Remote Users
15678| [1004555] Apache Web Server Chunked Encoding Flaw May Let Remote Users Execute Arbitrary Code on the Server
15679| [1004209] Apache 'mod_python' Python Language Interpreter Bug in Publisher Handler May Allow Remote Users to Modify Files on the System
15680| [1003874] Apache Web Server for Windows Has Batch File Processing Hole That Lets Remote Users Execute Commands on the System
15681| [1003767] 'mod_frontpage' Module for Apache Web Server Has Buffer Overlow in 'fpexec.c' That Allows Remote Users to Execute Arbitrary Code on the System with Root Privileges
15682| [1003723] Apache-SSL for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
15683| [1003664] 'mod_ssl' Security Package for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
15684| [1003602] GNUJSP Java Server Pages Implementation Discloses Web Files and Source Code to Remote Users and Bypasses Apache Access Control Restrictions
15685| [1003465] PHP for Apache Web Server May Disclose Installation Path Information to Remote Users Making 'OPTIONS' Requests
15686| [1003451] Oracle Application Server PL/SQL Module for Apache Has Buffer Overflows That Allow Remote Users to Execute Arbitrary Code and Gain Access to the Server
15687| [1003131] Apache Web Server in Virtual Hosting Mode Can Be Crashed By a Local User Removing a Log Directory
15688| [1003104] PHP.EXE Windows CGI for Apache Web Server May Let Remote Users View Files on the Server Due to Configuration Error
15689| [1003008] Apache 'mod_bf' Module Lets Remote Users Execute Arbitrary Code
15690| [1002629] Apache suEXEC Wrapper Fails to Observe Minimum Group ID Security Settings in Certain Situations
15691| [1002542] Apache Web Server Virtual Hosting Split-Logfile Function Lets Remote Users Write Log Entries to Arbitrary Files on the System
15692| [1002400] Apache mod_gzip Module Has Buffer Overflow That Can Be Exploited By Local Users to Gain Elevated Privileges
15693| [1002303] Several 3rd Party Apache Authentication Modules Allow Remote Users to Execute Arbitrary Code to Gain Access to the System or Execute Stored Procedures to Obtain Arbitrary Database Information
15694| [1002188] Apache Web Server Discloses Internal IP Addresses to Remote Users in Certain Configurations
15695| [1001989] Apache Web Server May Disclose Directory Contents Even If an Index.html File is Present in the Directory
15696| [1001719] Apache Web Server on Mac OS X Client Fails to Enforce File and Directory Access Protections, Giving Remote Users Access to Restricted Pages
15697| [1001572] Apache Web Server on Microsoft Windows Platforms Allows Remote Users to Crash the Web Server
15698| [1001304] Apache Web Server for Windows Lets Remote Users Crash the Web Server Application
15699| [1001083] Apache Web Server May Display Directory Index Listings Even if Directory Listings Are Disabled
15700|
15701| OSVDB - http://www.osvdb.org:
15702| [96078] Apache CloudStack Infrastructure Menu Setup Network Multiple Field XSS
15703| [96077] Apache CloudStack Global Settings Multiple Field XSS
15704| [96076] Apache CloudStack Instances Menu Display Name Field XSS
15705| [96075] Apache CloudStack Instances Menu Add Instances Network Name Field XSS
15706| [96074] Apache CloudStack Instances Menu Add Instances Review Step Multiple Field XSS
15707| [96031] Apache HTTP Server suEXEC Symlink Arbitrary File Access
15708| [95888] Apache Archiva Single / Double Quote Character Handling XSS Weakness
15709| [95885] Apache Subversion mod_dav_svn Module Crafted HTTP Request Handling Remote DoS
15710| [95706] Apache OpenOffice.org (OOo) OOXML Document File XML Element Handling Memory Corruption
15711| [95704] Apache OpenOffice.org (OOo) DOC File PLCF Data Handling Memory Corruption
15712| [95603] Apache Continuum web/util/GenerateRecipentNotifier.java recipient Parameter XSS
15713| [95602] Apache Continuum web/action/notifier/JabberProjectNotifierEditAction-jabberProjectNotifierSave-validation.xml Multiple Parameter XSS
15714| [95601] Apache Continuum web/action/notifier/JabberGroupNotifierEditAction-jabberProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
15715| [95600] Apache Continuum web/action/ScheduleAction-saveSchedule-validation.xml Multiple Parameter XSS
15716| [95599] Apache Continuumweb/action/BuildDefinitionAction-saveBuildDefinition-validation.xml Multiple Parameter XSS
15717| [95598] Apache Continuum web/action/AddProjectAction-addProject-validation.xml Multiple Parameter XSS
15718| [95597] Apache Continuum web/action/ProjectEditAction-projectSave-validation.xml Multiple Parameter XSS
15719| [95596] Apache Continuum web/action/notifier/IrcGroupNotifierEditAction-ircProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
15720| [95595] Apache Continuum web/action/notifier/IrcProjectNotifierEditAction-ircProjectNotifierSave-validation.xml Multiple Parameter XSS
15721| [95594] Apache Continuum web/action/ProjectGroupAction.java Multiple Parameter XSS
15722| [95593] Apache Continuum web/action/AddProjectGroupAction.java Multiple Parameter XSS
15723| [95592] Apache Continuum web/action/AddProjectAction.java Multiple Parameter XSS
15724| [95523] Apache OFBiz Webtools Application View Log Screen Unspecified XSS
15725| [95522] Apache OFBiz Nested Expression Evaluation Arbitrary UEL Function Execution
15726| [95521] Apache HTTP Server mod_session_dbd Session Saving Unspecified Issue
15727| [95498] Apache HTTP Server mod_dav.c Crafted MERGE Request Remote DoS
15728| [95406] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Arbitrary Site Redirect
15729| [95405] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Remote Code Execution
15730| [95011] Apache CXF XML Parser SOAP Message Handling CPU Resource Exhaustion Remote DoS
15731| [94705] Apache Geronimo RMI Classloader Exposure Serialized Object Handling Remote Code Execution
15732| [94651] Apache Santuario (XML Security for C++) XML Signature CanonicalizationMethod Parameter Spoofing Weakness
15733| [94636] Apache Continuum workingCopy.action userDirectory Traversal Arbitrary File Access
15734| [94635] Apache Maven SCM SvnCommandlineUtils Process Listing Local Password Disclosure
15735| [94632] Apache Maven Wagon SSH (wagon-ssh) Host Verification Failure MitM Weakness
15736| [94625] Apache Santuario (XML Security for C++) XML Signature Reference Crafted XPointer Expression Handling Heap Buffer Overflow
15737| [94618] Apache Archiva /archiva/security/useredit.action username Parameter XSS
15738| [94617] Apache Archiva /archiva/security/roleedit.action name Parameter XSS
15739| [94616] Apache Archiva /archiva/security/userlist!show.action roleName Parameter XSS
15740| [94615] Apache Archiva /archiva/deleteArtifact!doDelete.action groupId Parameter XSS
15741| [94614] Apache Archiva /archiva/admin/addLegacyArtifactPath!commit.action legacyArtifactPath.path Parameter XSS
15742| [94613] Apache Archiva /archiva/admin/addRepository.action Multiple Parameter XSS
15743| [94612] Apache Archiva /archiva/admin/editAppearance.action Multiple Parameter XSS
15744| [94611] Apache Archiva /archiva/admin/addLegacyArtifactPath.action Multiple Parameter XSS
15745| [94610] Apache Archiva /archiva/admin/addNetworkProxy.action Multiple Parameter XSS
15746| [94403] Apache Santuario (XML Security for C++) InclusiveNamespace PrefixList Processing Heap Overflow
15747| [94402] Apache Santuario (XML Security for C++) HMAC-based XML Signature Processing DoS
15748| [94401] Apache Santuario (XML Security for C++) XPointer Evaluation Stack Overflow
15749| [94400] Apache Santuario (XML Security for C++) HMAC-Based XML Signature Reference Element Validation Spoofing Weakness
15750| [94279] Apache Qpid CA Certificate Validation Bypass
15751| [94275] Apache Solr JettySolrRunner.java Can Not Find Error Message XSS
15752| [94233] Apache OpenJPA Object Deserialization Arbitrary Executable Creation
15753| [94042] Apache Axis JAX-WS Java Unspecified Exposure
15754| [93969] Apache Struts OGNL Expression Handling Double Evaluation Error Remote Command Execution
15755| [93796] Apache Subversion Filename Handling FSFS Repository Corruption Remote DoS
15756| [93795] Apache Subversion svnserve Server Aborted Connection Message Handling Remote DoS
15757| [93794] Apache Subversion contrib/hook-scripts/check-mime-type.pl svnlook Hyphenated argv Argument Handling Remote DoS
15758| [93793] Apache Subversion contrib/hook-scripts/svn-keyword-check.pl Filename Handling Remote Command Execution
15759| [93646] Apache Struts Crafted Parameter Arbitrary OGNL Code Execution
15760| [93645] Apache Struts URL / Anchor Tag includeParams Attribute Remote Command Execution
15761| [93636] Apache Pig Multiple Physical Operator Memory Exhaustion Remote Remote DoS
15762| [93635] Apache Wink DTD (Document Type Definition) Expansion Data Parsing Information Disclosure
15763| [93605] RT Apache::Session::File Session Replay Reuse Information Disclosure
15764| [93599] Apache Derby SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY Boot Password Manipulation Re-encryption Failure Password Corruption
15765| [93555] Apache Commons Codec Invalid Base32 String Information Tunneling Weakness
15766| [93554] Apache HBase bulkLoadHFiles() Method ACL Bypass
15767| [93543] JBoss Enterprise Application Platform org.apache.catalina.connector.Response.encodeURL() Method MitM jsessionid Disclosure
15768| [93542] Apache ManifoldCF (Connectors Framework) org.apache.manifoldcf.crawler.ExportConfiguration Class Configuration Export Password Disclosure
15769| [93541] Apache Solr json.wrf Callback XSS
15770| [93524] Apache Hadoop GetSecurityDescriptorControl() Function Absolute Security Descriptor Handling NULL Descriptor Weakness
15771| [93521] Apache jUDDI Security API Token Session Persistence Weakness
15772| [93520] Apache CloudStack Default SSL Key Weakness
15773| [93519] Apache Shindig /ifr Cross-site Arbitrary Gadget Invocation
15774| [93518] Apache Solr /admin/analysis.jsp name Parameter XSS
15775| [93517] Apache CloudStack setup-cloud-management /etc/sudoers Modification Local Privilege Escalation
15776| [93516] Apache CXF UsernameTokenInterceptor Nonce Caching Replay Weakness
15777| [93515] Apache HBase table.jsp name Parameter XSS
15778| [93514] Apache CloudStack Management Server Unauthenticated Remote JMX Connection Default Setting Weakness
15779| [93463] Apache Struts EL / OGNL Interpretation Unspecified Remote Code Execution
15780| [93462] Apache CXF WS-SecurityPolicy AlgorithmSuite Arbitrary Ciphertext Decryption Weakness
15781| [93401] Apache Hadoop core-site.xml Permission Weakness Local Alfredo Secret Disclosure
15782| [93400] Apache Hadoop Map/Reduce Job Log Directory Symlink Arbitrary File Mode Manipulation
15783| [93397] Apache Wicket Referrer HTTP Header Session ID Disclosure
15784| [93366] Apache HTTP Server modules/mappers/mod_rewrite.c do_rewritelog() Function Log File Terminal Escape Sequence Filtering Remote Command Execution
15785| [93254] Apache Tomcat AsyncListener Method Cross-session Information Disclosure
15786| [93253] Apache Tomcat Chunked Transfer Encoding Data Saturation Remote DoS
15787| [93252] Apache Tomcat FORM Authenticator Session Fixation
15788| [93172] Apache Camel camel/endpoints/ Endpoint XSS
15789| [93171] Apache Sling HtmlResponse Error Message XSS
15790| [93170] Apache Directory DelegatingAuthenticator MitM Spoofing Weakness
15791| [93169] Apache Wave AuthenticationServlet.java Session Fixation Weakness
15792| [93168] Apache Click ErrorReport.java id Parameter XSS
15793| [93167] Apache ActiveMQ JMSXUserId Spoofing Weakness
15794| [93166] Apache CXF Crafted Message Element Count Handling System Resource Exhaustion Remote DoS
15795| [93165] Apache CXF Crafted Message Element Level Handling System Resource Exhaustion Remote DoS
15796| [93164] Apache Harmony DatagramSocket Class connect Method CheckAccept() IP Blacklist Bypass
15797| [93163] Apache Hadoop Map/Reduce Daemon Symlink Arbitrary File Overwrite
15798| [93162] Apache VelocityStruts struts/ErrorsTool.getMsgs Error Message XSS
15799| [93161] Apache CouchDB Rewriter VM Atom Table Memory Exhaustion Remote DoS
15800| [93158] Apache Wicket BookmarkablePageLink Feature XSS CSRF
15801| [93157] Apache Struts UrlHelper.java s:url includeParams Functionality XSS
15802| [93156] Apache Tapestry Calendar Component datefield.js datefield Parameter XSS
15803| [93155] Apache Struts fielderror.ftl fielderror Parameter Error Message XSS
15804| [93154] Apache JSPWiki Edit.jsp createPages WikiPermission Bypass
15805| [93153] Apache PDFBox PDFXrefStreamParser Missing Element Handling PDF Parsing DoS
15806| [93152] Apache Hadoop HttpServer.java Multiple Function XSS
15807| [93151] Apache Shiro Search Filter userName Parameter LDAP Code Injection Weakness
15808| [93150] Apache Harmony java.net.SocketPermission Class boolean equals Function checkConnect() Weakness Host Name Retrieval
15809| [93149] Apache Harmony java.security.Provider Class void load Function checkSecurityAccess() Weakness
15810| [93148] Apache Harmony java.security.ProtectionDomain Class java.lang.String.toString() Function checkPermission() Weakness
15811| [93147] Apache Harmony java.net.URLConnection openConnection Function checkConnect Weakness Proxy Connection Permission Bypass
15812| [93146] Apache Harmony java.net.ServerSocket Class void implAccept Function checkAccept() Weakness SerSocket Subclass Creation
15813| [93145] Apache Qpid JMS Client Detached Session Frame Handling NULL Pointer Dereference Remote DoS
15814| [93144] Apache Solr Admin Command Execution CSRF
15815| [93009] Apache VCL XMLRPC API Unspecified Function Remote Privilege Escalation
15816| [93008] Apache VCL Web GUI Unspecified Remote Privilege Escalation
15817| [92997] Apache Commons Codec org.apache.commons.codec.net.URLCodec Fields Missing 'final' Thread-safety Unspecified Issue
15818| [92976] Apache ActiveMQ scheduled.jsp crontab Command XSS
15819| [92947] Apache Commons Codec org.apache.commons.codec.language.Soundex.US_ENGLISH_MAPPING Missing MS_PKGPROTECT Field Manipulation Unspecified Issue
15820| [92749] Apache CloudStack Predictable Hash Virtual Machine Console Console Access URL Generation
15821| [92748] Apache CloudStack VM Console Access Restriction Bypass
15822| [92709] Apache ActiveMQ Web Console Unauthenticated Remote Access
15823| [92708] Apache ActiveMQ Sample Web Application Broker Resource Consumption Remote DoS
15824| [92707] Apache ActiveMQ webapp/websocket/chat.js Subscribe Message XSS
15825| [92706] Apache ActiveMQ Debug Log Rendering XSS
15826| [92705] Apache ActiveMQ PortfolioPublishServlet.java refresh Parameter XSS
15827| [92270] Apache Tomcat Unspecified CSRF
15828| [92094] Apache Subversion mod_dav_svn Module Nonexistent URL Lock Request Handling NULL Pointer Dereference Remote DoS
15829| [92093] Apache Subversion mod_dav_svn Module Activity URL PROPFIND Request Handling NULL Pointer Dereference Remote DoS
15830| [92092] Apache Subversion mod_dav_svn Module Log REPORT Request Handling NULL Pointer Dereference Remote DoS
15831| [92091] Apache Subversion mod_dav_svn Module Node Property Handling Resource Exhaustion Remote DoS
15832| [92090] Apache Subversion mod_dav_svn Module Activity URL Lock Request Handling NULL Pointer Dereference Remote DoS
15833| [91774] Apache Commons Codec Unspecified Non-private Field Manipulation Weakness
15834| [91628] mod_ruid2 for Apache HTTP Server fchdir() Inherited File Descriptor chroot Restriction Bypass
15835| [91328] Apache Wicket $up$ Traversal Arbitrary File Access
15836| [91295] Apple Mac OS X Apache Unicode Character URI Handling Authentication Bypass
15837| [91235] Apache Rave /app/api/rpc/users/get User Object Hashed Password Remote Disclosure
15838| [91185] Munin Default Apache Configuration Permission Weakness Remote Information Disclosure
15839| [91173] Apache Wicket WebApplicationPath Constructor Bypass /WEB-INF/ Directory File Access
15840| [91172] Apache Wicket PackageResourceGuard File Extension Filter Bypass
15841| [91025] Apache Qpid qpid::framing::Buffer Class Multiple Method Out-of-bounds Access Remote DoS
15842| [91024] Apache Qpid federation_tag Attribute Handling Federated Interbroker Link Access Restriction Bypass
15843| [91023] Apache Qpid AMQP Type Decoder Exposure Array Size Value Handling Memory Consumption Remote DoS
15844| [91022] Apache Qpid qpid/cpp/include/qpid/framing/Buffer.h qpid::framing::Buffer::checkAvailable() Function Integer Overflow
15845| [90986] Apache Jena ARQ INSERT DATA Request Handling Overflow
15846| [90907] Apache Subversion mod_dav_svn / libsvn_fs svn_fs_file_length() Function MKACTIVITY / PROPFIND Option Request Handling Remote DoS
15847| [90906] Apache Commons FileUpload /tmp Storage Symlink Arbitrary File Overwrite
15848| [90864] Apache Batik 1xx Redirect Script Origin Restriction Bypass
15849| [90858] Apache Ant Malformed TAR File Handling Infinite Loop DoS
15850| [90852] Apache HTTP Server for Debian apachectl /var/lock Permission Weakness Symlink Directory Permission Manipulation
15851| [90804] Apache Commons CLI Path Subversion Local Privilege Escalation
15852| [90802] Apache Avro Recursive Schema Handling Infinite Recursion DoS
15853| [90592] Apache Batik ApplicationSecurityEnforcer.java Multiple Method Security Restriction Bypass
15854| [90591] Apache Batik XML External Entity (XXE) Data Parsing Arbitrary File Disclosure
15855| [90565] Apache Tomcat Log Directory Permission Weakness Local Information Disclosure
15856| [90564] Apache Maven / Maven Wagon SSL Certificate Validation MitM Spoofing Weakness
15857| [90557] Apache HTTP Server mod_proxy_balancer balancer-manager Interface Multiple Parameter XSS
15858| [90556] Apache HTTP Server Multiple Module Multiple Parameter XSS
15859| [90276] Apache Axis2 axis2.xml Plaintext Password Local Disclosure
15860| [90249] Apache Axiom ClassLoader XMLInputFactory / XMLOutputFactory Construction Unspecified Issue
15861| [90235] Apache Commons HttpClient Certificate Wildcard Matching Weakness
15862| [90079] Apache CXF WSS4JInInterceptor URIMappingInterceptor WS-Security SOAP Service Access Restriction Bypass
15863| [90078] Apache CXF WS-SecurityPolicy Enabled Plaintext UsernameTokens Handling Authentication Bypass
15864| [89453] Apache Open For Business Project (OFBiz) Screenlet.title Widget Attribute XSS
15865| [89452] Apache Open For Business Project (OFBiz) Image.alt Widget Attribute XSS
15866| [89294] Apache CouchDB Futon UI Browser-based Test Suite Query Parameter XSS
15867| [89293] Apache CouchDB Unspecified Traversal Arbitrary File Access
15868| [89275] Apache HTTP Server mod_proxy_ajp Module Expensive Request Parsing Remote DoS
15869| [89267] Apache CouchDB JSONP Callback Handling Unspecified XSS
15870| [89146] Apache CloudStack Master Server log4j.conf SSH Private Key / Plaintext Password Disclosure
15871| [88603] Apache OpenOffice.org (OOo) Unspecified Information Disclosure
15872| [88602] Apache OpenOffice.org (OOo) Unspecified Manifest-processing Issue
15873| [88601] Apache OpenOffice.org (OOo) Unspecified PowerPoint File Handling Issue
15874| [88285] Apache Tomcat Partial HTTP Request Saturation Remote DoS
15875| [88095] Apache Tomcat NIO Connector Terminated Connection Infinte Loop DoS
15876| [88094] Apache Tomcat FORM Authentication Crafted j_security_check Request Security Constraint Bypass
15877| [88093] Apache Tomcat Null Session Requst CSRF Prevention Filter Bypass
15878| [88043] IBM Tivoli Netcool/Reporter Apache CGI Unspecified Remote Command Execution
15879| [87580] Apache Tomcat DIGEST Authentication Session State Caching Authentication Bypass Weakness
15880| [87579] Apache Tomcat DIGEST Authentication Stale Nonce Verification Authentication Bypass Weakness
15881| [87477] Apache Tomcat Project Woodstock Service Error Page UTF-7 XSS Weakness
15882| [87227] Apache Tomcat InternalNioInputBuffer.java parseHeaders() Function Request Header Size Parsing Remote DoS
15883| [87223] Apache Tomcat DIGEST Authentication replay-countermeasure Functionality cnonce / cn Verification Authentication Bypass Weakness
15884| [87160] Apache Commons HttpClient X.509 Certificate Domain Name Matching MiTM Weakness
15885| [87159] Apache CXF X.509 Certificate Domain Name Matching MiTM Weakness
15886| [87150] Apache Axis / Axis2 X.509 Certificate Domain Name Matching MiTM Weakness
15887| [86902] Apache HTTP Server 3xx Redirect Internal IP Address Remote Disclosure
15888| [86901] Apache Tomcat Error Message Path Disclosure
15889| [86684] Apache CloudStack Unauthorized Arbitrary API Call Invocation
15890| [86556] Apache Open For Business Project (OFBiz) Unspecified Issue
15891| [86503] Visual Tools VS home/apache/DiskManager/cron/init_diskmgr Local Command Execution
15892| [86401] Apache ActiveMQ ResourceHandler Traversal Arbitrary File Access
15893| [86225] Apache Axis2 XML Signature Wrapping (XSW) Authentication Bypass
15894| [86206] Apache Axis2 Crafted SAML Assertion Signature Exclusion Attack Authentication Bypass
15895| [85722] Apache CXF SOAP Request Parsing Access Restriction Bypass
15896| [85704] Apache Qpid Incoming Client Connection Saturation Remote DoS
15897| [85474] Eucalyptus Apache Santuario (XML Security for Java) Library XML Signature Transform Handling DoS
15898| [85430] Apache mod_pagespeed Module Unspecified XSS
15899| [85429] Apache mod_pagespeed Module Hostname Verification Cross-host Resource Disclosure
15900| [85249] Apache Wicket Unspecified XSS
15901| [85236] Apache Hadoop conf/hadoop-env.sh Temporary File Symlink Arbitrary File Manipulation
15902| [85090] Apache HTTP Server mod_proxy_ajp.c mod_proxy_ajp Module Proxy Functionality Cross-client Information Disclosure
15903| [85089] Apache HTTP Server mod_proxy_http.c mod_proxy_http Module Cross-client Information Disclosure
15904| [85062] Apache Solr Autocomplete Module for Drupal Autocomplete Results XSS
15905| [85010] Apache Struts Token Handling Mechanism Token Name Configuration Parameter CSRF Weakness
15906| [85009] Apache Struts Request Parameter OGNL Expression Parsing Remote DoS
15907| [84911] libapache2-mod-rpaf X-Forward-For HTTP Header Parsing Remote DoS
15908| [84823] Apache HTTP Server Multiple Module Back End Server Error Handling HTTP Request Parsing Remote Information Disclosure
15909| [84818] Apache HTTP Server mod_negotiation Module mod_negotiation.c make_variant_list Function XSS
15910| [84562] Apache Qpid Broker Authentication Mechanism AMQP Client Shadow Connection NullAuthenticator Request Parsing Authentication Bypass
15911| [84458] Apache Libcloud SSL Certificate Validation MitM Spoofing Weakness
15912| [84279] PHP on Apache php_default_post_reader POST Request Handling Overflow DoS
15913| [84278] PHP w/ Apache PDO::ATTR_DEFAULT_FETCH_MODE / PDO::FETCH_CLASS DoS
15914| [84231] Apache Hadoop DataNodes Client BlockTokens Arbitrary Block Access
15915| [83943] Oracle Solaris Cluster Apache Tomcat Agent Subcomponent Unspecified Local Privilege Escalation
15916| [83939] Oracle Solaris Apache HTTP Server Subcomponent Unspecified Remote Information Disclosure
15917| [83685] svnauthcheck Apache HTTP Configuration File Permission Revocation Weakness
15918| [83682] Apache Sling POST Servlet @CopyFrom Operation HTTP Request Parsing Infinite Loop Remote DoS
15919| [83339] Apache Roller Blogger Roll Unspecified XSS
15920| [83270] Apache Roller Unspecified Admin Action CSRF
15921| [82782] Apache CXF WS-SecurityPolicy 1.1 SupportingToken Policy Bypass
15922| [82781] Apache CXF WS-SecurityPolicy Supporting Token Children Specification Token Signing Verification Weakness
15923| [82611] cPanel Apache Piped Log Configuration Log Message Formatting Traversal Arbitrary File Creation
15924| [82436] MapServer for Windows Bundled Apache / PHP Configuration Local File Inclusion
15925| [82215] PHP sapi/cgi/cgi_main.c apache_request_headers Function HTTP Header Handling Remote Overflow
15926| [82161] Apache Commons Compress bzip2 File Compression BZip2CompressorOutputStream Class File Handling Remote DoS
15927| [81965] Apache Batik Squiggle SVG Browser JAR File Arbitrary Code Execution
15928| [81790] Apache POI src/org/apache/poi/hwpf/model/UnhandledDataStructure.java UnhandledDataStructure() constructor Length Attribute CDF / CFBF File Handling Remote DoS
15929| [81660] Apache Qpid Credential Checking Cluster Authentication Bypass
15930| [81511] Apache for Debian /usr/share/doc HTTP Request Parsing Local Script Execution
15931| [81359] Apache HTTP Server LD_LIBRARY_PATH Variable Local Privilege Escalation
15932| [81349] Apache Open For Business Project (OFBiz) Webslinger Component Unspecified XSS
15933| [81348] Apache Open For Business Project (OFBiz) Content IDs / Map-Keys Unspecified XSS
15934| [81347] Apache Open For Business Project (OFBiz) Parameter Arrays Unspecified XSS
15935| [81346] Apache Open For Business Project (OFBiz) checkoutProcess.js getServerError() Function Unspecified XSS
15936| [81196] Apache Open For Business Project (OFBiz) FlexibleStringExpander Nested Script String Parsing Remote Code Execution
15937| [80981] Apache Hadoop Kerberos/MapReduce Security Feature User Impersonation Weakness
15938| [80571] Apache Traffic Server Host HTTP Header Parsing Remote Overflow
15939| [80547] Apache Struts XSLTResult.java File Upload Arbitrary Command Execution
15940| [80360] AskApache Password Protector Plugin for WordPress Error Page $_SERVER Superglobal XSS
15941| [80349] Apache HTTP Server mod_fcgid Module fcgid_spawn_ctl.c FcgidMaxProcessesPerClass Virtual Host Directive HTTP Request Parsing Remote DoS
15942| [80301] Apache Wicket /resources/ Absolute Path Arbitrary File Access
15943| [80300] Apache Wicket wicket:pageMapName Parameter XSS
15944| [79478] Apache Solr Extension for TYPO3 Unspecified XSS
15945| [79002] Apache MyFaces javax.faces.resource In Parameter Traversal Arbitrary File Access
15946| [78994] Apache Struts struts-examples/upload/upload-submit.do name Parameter XSS
15947| [78993] Apache Struts struts-cookbook/processDyna.do message Parameter XSS
15948| [78992] Apache Struts struts-cookbook/processSimple.do message Parameter XSS
15949| [78991] Apache Struts struts2-rest-showcase/orders clientName Parameter XSS
15950| [78990] Apache Struts struts2-showcase/person/editPerson.action Multiple Parameter XSS
15951| [78932] Apache APR Hash Collision Form Parameter Parsing Remote DoS
15952| [78903] Apache CXF SOAP Request Parsing WS-Security UsernameToken Policy Bypass
15953| [78600] Apache Tomcat HTTP DIGEST Authentication DigestAuthenticator.java Catalina Weakness Security Bypass
15954| [78599] Apache Tomcat HTTP DIGEST Authentication Realm Value Parsing Security Bypass
15955| [78598] Apache Tomcat HTTP DIGEST Authentication qop Value Parsing Security Bypass
15956| [78573] Apache Tomcat Parameter Saturation CPU Consumption Remote DoS
15957| [78556] Apache HTTP Server Status Code 400 Default Error Response httpOnly Cookie Disclosure
15958| [78555] Apache HTTP Server Threaded MPM %{cookiename}C Log Format String Cookie Handling Remote DoS
15959| [78501] Apache Struts ParameterInterceptor Class OGNL Expression Parsing Remote Command Execution
15960| [78331] Apache Tomcat Request Object Recycling Information Disclosure
15961| [78293] Apache HTTP Server Scoreboard Invalid Free Operation Local Security Bypass
15962| [78277] Apache Struts ExceptionDelegator Component Parameter Parsing Remote Code Execution
15963| [78276] Apache Struts DebuggingInterceptor Component Developer Mode Unspecified Remote Command Execution
15964| [78113] Apache Tomcat Hash Collision Form Parameter Parsing Remote DoS
15965| [78112] Apache Geronimo Hash Collision Form Parameter Parsing Remote DoS
15966| [78109] Apache Struts ParameterInterceptor Traversal Arbitrary File Overwrite
15967| [78108] Apache Struts CookieInterceptor Cookie Name Handling Remote Command Execution
15968| [77593] Apache Struts Conversion Error OGNL Expression Injection
15969| [77496] Apache ActiveMQ Failover Mechanism Openwire Request Parsing Remote DoS
15970| [77444] Apache HTTP Server mod_proxy Mdule Web Request HTTP/0.9 Protocol URL Parsing Proxy Remote Security Bypass
15971| [77374] Apache MyFaces Java Bean includeViewParameters Parsing EL Expression Security Weakness
15972| [77310] Apache HTTP Server mod_proxy Reverse Proxy Mode Security Bypass Weakness (2011-4317)
15973| [77234] Apache HTTP Server on cygwin Encoded Traversal Arbitrary File Access
15974| [77012] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Memory Consumption DoS
15975| [76944] Apache Tomcat Manager Application Servlets Access Restriction Bypass
15976| [76744] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Overflow
15977| [76189] Apache Tomcat HTTP DIGEST Authentication Weakness
15978| [76079] Apache HTTP Server mod_proxy Mdule Web Request URL Parsing Proxy Remote Security Bypass (2011-3368)
15979| [76072] Apache JServ jserv.conf jserv-status Handler jserv/ URI Request Parsing Local Information Disclosure
15980| [75807] Apache HTTP Server Incomplete Header Connection Saturation Remote DoS
15981| [75647] Apache HTTP Server mod_proxy_ajp Module mod_proxy_balancer HTTP Request Remote DoS
15982| [75376] Apache Libcloud SSL Certificate Validation MitM Server Spoofing Weakness
15983| [74853] Domain Technologie Control /etc/apache2/apache2.conf File Permissions Weakness dtcdaemons User Password Disclosure
15984| [74818] Apache Tomcat AJP Message Injection Authentication Bypass
15985| [74725] Apache Wicket Multi Window Support Unspecified XSS
15986| [74721] Apache HTTP Server ByteRange Filter Memory Exhaustion Remote DoS
15987| [74541] Apache Commons Daemon Jsvc Permissions Weakness Arbitrary File Access
15988| [74535] Apache Tomcat XML Parser Cross-application Multiple File Manipulation
15989| [74447] Apache Struts XWork Nonexistent Method s:submit Element Internal Java Class Remote Path Disclosure
15990| [74262] Apache HTTP Server Multi-Processing Module itk.c Configuration Merger mpm-itk root UID / GID Remote Privilege Escalation
15991| [74120] Apache HTTP Server mod_authnz_external mysql/mysql-auth.pl user Field SQL Injection
15992| [73920] Oracle Secure Backup /apache/htdocts/php/common.php username Parameter Remote Code Execution
15993| [73798] Apache Tomcat sendfile Request Start / Endpoint Parsing Local DoS
15994| [73797] Apache Tomcat sendfile Request Attribute Validation Weakness Local Access Restriction Bypass
15995| [73776] Apache Tomcat HTTP BIO Connector HTTP Pipelining Cross-user Remote Response Access
15996| [73644] Apache XML Security Signature Key Parsing Overflow DoS
15997| [73600] Apache Struts javatemplates Plugin Component Handlers .action URI Multiple Parameter XSS
15998| [73462] Apache Rampart/C util/rampart_timestamp_token.c rampart_timestamp_token_validate Function Expired Token Remote Access Restriction Bypass
15999| [73429] Apache Tomcat JMX MemoryUserDatabase Local Password Disclosure
16000| [73384] Apache HTTP Server mod_rewrite PCRE Resource Exhaustion DoS
16001| [73383] Apache HTTP Server Portable Runtime (APR) Library apr_fnmatch() Infinite Loop Remote DoS
16002| [73378] IBM WebSphere Application Server (WAS) JavaServer Pages org.apache.jasper.runtime.JspWriterImpl.response JSP Page Application Restart Remote DoS
16003| [73247] Apache Subversion mod_dav_svn File Permission Weakness Information Disclosure
16004| [73246] Apache Subversion mod_dav_svn Path-based Access Control Rule Handling Remote DoS
16005| [73245] Apache Subversion mod_dav_svn Baselined Resource Request Handling Remote DoS
16006| [73154] Apache Archiva Multiple Unspecified CSRF
16007| [73153] Apache Archiva /archiva/admin/deleteNetworkProxy!confirm.action proxyid Parameter XSS
16008| [72407] Apache Tomcat @ServletSecurity Initial Load Annotation Security Constraint Bypass Information Disclosure
16009| [72238] Apache Struts Action / Method Names <
16010| [71647] Apache HttpComponents HttpClient Proxy-Authorization Credentials Remote Disclosure
16011| [71558] Apache Tomcat SecurityManager ServletContext Attribute Traversal Arbitrary File Manipulation
16012| [71557] Apache Tomcat HTML Manager Multiple XSS
16013| [71075] Apache Archiva User Management Page XSS
16014| [71027] Apache Tomcat @ServletSecurity Annotation Security Constraint Bypass Information Disclosure
16015| [70925] Apache Continuum Project Pages Unspecified XSS (2011-0533)
16016| [70924] Apache Continuum Multiple Admin Function CSRF
16017| [70809] Apache Tomcat NIO HTTP Connector Request Line Processing DoS
16018| [70734] Apache CouchDB Request / Cookie Handling Unspecified XSS
16019| [70585] Oracle Fusion Middleware Oracle HTTP Server Apache Plugin Unspecified Remote Issue
16020| [70333] Apache Subversion rev_hunt.c blame Command Multiple Memory Leak Remote DoS
16021| [70332] Apache Subversion Apache HTTP Server mod_dav_svn repos.c walk FunctionSVNParentPath Collection Remote DoS
16022| [69659] Apache Archiva Admin Authentication Weakness Privilege Escalation
16023| [69520] Apache Archiva Administrator Credential Manipulation CSRF
16024| [69512] Apache Tomcat Set-Cookie Header HTTPOnly Flag Session Hijacking Weakness
16025| [69456] Apache Tomcat Manager manager/html/sessions Multiple Parameter XSS
16026| [69275] Apache mod_fcgid Module fcgid_bucket.c fcgid_header_bucket_read() Function Remote Overflow
16027| [69067] Apache Shiro URI Path Security Traversal Information Disclosure
16028| [68815] Apache MyFaces shared/util/StateUtils.java View State MAC Weakness Cryptographic Padding Remote View State Modification
16029| [68670] Apache Qpid C++ Broker Component broker/SessionAdapter.cpp SessionAdapter::ExchangeHandlerImpl::checkAlternate Function Exchange Alternate Remote DoS
16030| [68669] Apache Qpid cluster/Cluster.cpp Cluster::deliveredEvent Function Invalid AMQP Data Remote DoS
16031| [68662] Apache Axis2 dswsbobje.war Module Admin Account Default Password
16032| [68531] Apache Qpid qpidd sys/ssl/SslSocket.cpp Incomplete SSL Handshake Remote DoS
16033| [68327] Apache APR-util buckets/apr_brigade.c apr_brigade_split_line() Function Memory Consumption DoS
16034| [68314] Apache XML-RPC SAX Parser External Entity Information Disclosure
16035| [67964] Apache Traffic Server Transaction ID / Source Port Randomization Weakness DNS Cache Poisoning
16036| [67846] SUSE Lifecycle Management Server on SUSE Linux Enterprise apache2-slms Parameter Quoting CSRF
16037| [67294] Apache CXF XML SOAP Message Crafted Document Type Declaration Remote DoS
16038| [67240] Apache CouchDB Installation Page Direct Request Arbitrary JavaScript Code Execution CSRF
16039| [67205] Apache Derby BUILTIN Authentication Password Hash Generation Algorithm SHA-1 Transformation Password Substitution
16040| [66745] Apache HTTP Server Multiple Modules Pathless Request Remote DoS
16041| [66319] Apache Tomcat Crafted Transfer-Encoding Header Handling Buffer Recycling Remote DoS
16042| [66280] Apache Struts XWork ParameterInterceptor Server-Side Object Remote Code Execution
16043| [66226] Apache Axis2 Admin Interface Cookie Session Fixation
16044| [65697] Apache Axis2 / Java SOAP Message DTD Rejection Weakness Arbitrary File Access
16045| [65654] Apache HTTP Server mod_proxy_http mod_proxy_http.c Timeout Detection Weakness HTTP Request Response Disclosure
16046| [65429] Apache MyFaces Unencrypted ViewState Serialized View Object Manipulation Arbitrary Expression Language (EL) Statement Execution
16047| [65054] Apache ActiveMQ Jetty Error Handler XSS
16048| [64844] Apache Axis2/Java axis2/axis2-admin/engagingglobally modules Parameter XSS
16049| [64522] Apache Open For Business Project (OFBiz) ecommerce/control/contactus Multiple Parameter XSS
16050| [64521] Apache Open For Business Project (OFBiz) Web Tools Section entityName Parameter XSS
16051| [64520] Apache Open For Business Project (OFBiz) ecommerce/control/ViewBlogArticle contentId Parameter XSS
16052| [64519] Apache Open For Business Project (OFBiz) Control Servlet URI XSS
16053| [64518] Apache Open For Business Project (OFBiz) Show Portal Page Section start Parameter XSS
16054| [64517] Apache Open For Business Project (OFBiz) View Profile Section partyId Parameter XSS
16055| [64516] Apache Open For Business Project (OFBiz) Export Product Listing Section productStoreId Parameter XSS
16056| [64307] Apache Tomcat Web Application Manager/Host Manager CSRF
16057| [64056] mod_auth_shadow for Apache HTTP Server wait() Function Authentication Bypass
16058| [64023] Apache Tomcat WWW-Authenticate Header Local Host Information Disclosure
16059| [64020] Apache ActiveMQ Jetty ResourceHandler Crafted Request JSP File Source Disclosure
16060| [63895] Apache HTTP Server mod_headers Unspecified Issue
16061| [63368] Apache ActiveMQ createDestination.action JMSDestination Parameter CSRF
16062| [63367] Apache ActiveMQ createDestination.action JMSDestination Parameter XSS
16063| [63350] Apache CouchDB Hash Verification Algorithm Predictable Execution Time Weakness
16064| [63140] Apache Thrift Service Malformed Data Remote DoS
16065| [62676] Apache HTTP Server mod_proxy_ajp Module Crafted Request Remote DoS
16066| [62675] Apache HTTP Server Multi-Processing Module (MPM) Subrequest Header Handling Cross-thread Information Disclosure
16067| [62674] Apache HTTP Server mod_isapi Module Unloading Crafted Request Remote DoS
16068| [62231] Apache HTTP Server Logging Format Weakness Crafted DNS Response IP Address Spoofing
16069| [62230] Apache HTTP Server Crafted DNS Response Inverse Lookup Log Corruption XSS
16070| [62054] Apache Tomcat WAR Filename Traversal Work-directory File Deletion
16071| [62053] Apache Tomcat Autodeployment Process appBase File HTTP Request Authentication Bypass
16072| [62052] Apache Tomcat WAR File Traversal Arbitrary File Overwrite
16073| [62009] Apache HTTP Server src/modules/proxy/proxy_util.c mod_proxy ap_proxy_send_fb() Function Overflow
16074| [61379] Apache River Outrigger Entry Storage Saturation Memory Exhaustion DoS
16075| [61378] Apache Hadoop Map/Reduce JobTracker Memory Consumption DoS
16076| [61377] Apache Commons Modeler Multiple Mutable Static Fields Weakness
16077| [61376] Apache Rampart wsse:security Tag Signature Value Checking Weakness
16078| [60687] Apache C++ Standard Library (STDCXX) strxfrm() Function Overflow
16079| [60680] Apache Hadoop JobHistory Job Name Manipulation Weakness
16080| [60679] Apache ODE DeploymentWebService OMElement zipPart CRLF Injection
16081| [60678] Apache Roller Comment Email Notification Manipulation DoS
16082| [60677] Apache CouchDB Unspecified Document Handling Remote DoS
16083| [60428] Sun Java Plug-in org.apache.crimson.tree.XmlDocument Class reateXmlDocument Method Floppy Drive Access Bypass
16084| [60413] mod_throttle for Apache Shared Memory File Manipulation Local Privilege Escalation
16085| [60412] Sun Java Plug-in org.apache.xalan.processor.XSLProcessorVersion Class Unsigned Applet Variable Sharing Privilege Escalation
16086| [60396] Apache HTTP Server on OpenBSD Multipart MIME Boundary Remote Information Disclosure
16087| [60395] Apache HTTP Server on OpenBSD ETag HTTP Header Remote Information Disclosure
16088| [60232] PHP on Apache php.exe Direct Request Remote DoS
16089| [60176] Apache Tomcat Windows Installer Admin Default Password
16090| [60016] Apache HTTP Server on HP Secure OS for Linux HTTP Request Handling Unspecified Issue
16091| [59979] Apache HTTP Server on Apple Mac OS X HTTP TRACE Method Unspecified Client XSS
16092| [59969] Apache HTTP Server mod_ssl SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection
16093| [59944] Apache Hadoop jobhistory.jsp XSS
16094| [59374] Apache Solr Search Extension for TYPO3 Unspecified XSS
16095| [59022] Apache Shindig ConcatProxyServlet HTTP Header Response Splitting
16096| [59021] Apache Cocoon X-Cocoon-Version Header Remote Information Disclosure
16097| [59020] Apache Tapestry HTTPS Session Cookie Secure Flag Weakness
16098| [59019] Apache mod_python Cookie Salting Weakness
16099| [59018] Apache Harmony Error Message Handling Overflow
16100| [59013] Apache Derby SYSCS_EXPORT_TABLE Arbitrary File Overwrite
16101| [59012] Apache Derby Driver Auto-loading Non-deterministic Startup Weakness
16102| [59011] Apache JSPWiki Page Attachment Change Note Function XSS
16103| [59010] Apache Solr get-file.jsp XSS
16104| [59009] Apache Solr action.jsp XSS
16105| [59008] Apache Solr analysis.jsp XSS
16106| [59007] Apache Solr schema.jsp Multiple Parameter XSS
16107| [59006] Apache Beehive select / checkbox Tag XSS
16108| [59005] Apache Beehive jpfScopeID Global Parameter XSS
16109| [59004] Apache Beehive Error Message XSS
16110| [59003] Apache HttpClient POST Request Handling Memory Consumption DoS
16111| [59002] Apache Jetspeed default-page.psml URI XSS
16112| [59001] Apache Axis2 xsd Parameter Traversal Arbitrary File Disclosure
16113| [59000] Apache CXF Unsigned Message Policy Bypass
16114| [58999] Apache WSS4J CallbackHandler Plaintext Password Validation Weakness
16115| [58998] Apache OpenJPA persistence.xml Cleartext Password Local Disclosure
16116| [58997] Apache OpenEJB openejb.xml Cleartext Password Local Disclosure
16117| [58996] Apache Hadoop Map/Reduce LinuxTaskController File Group Ownership Weakness
16118| [58995] Apache Hadoop Map/Reduce Task Ownership Weakness
16119| [58994] Apache Hadoop Map/Reduce DistributedCache Localized File Permission Weakness
16120| [58993] Apache Hadoop browseBlock.jsp XSS
16121| [58991] Apache Hadoop browseDirectory.jsp XSS
16122| [58990] Apache Hadoop Map/Reduce HTTP TaskTrackers User Data Remote Disclosure
16123| [58989] Apache Hadoop Sqoop Process Listing Local Cleartext Password Disclosure
16124| [58988] Apache Hadoop Chukwa HICC Portal Unspecified XSS
16125| [58987] Apache Hadoop Map/Reduce TaskTracker User File Permission Weakness
16126| [58986] Apache Qpid Encrypted Message Handling Remote Overflow DoS
16127| [58985] Apache Qpid Process Listing Local Cleartext Password Disclosure
16128| [58984] Apache Jackrabbit Content Repository (JCR) Default Account Privilege Access Weakness
16129| [58983] Apache Jackrabbit Content Repository (JCR) NamespaceRegistry API Registration Method Race Condition
16130| [58982] Apache Synapse Proxy Service Security Policy Mismatch Weakness
16131| [58981] Apache Geronimo TomcatGeronimoRealm Security Context Persistence Weakness
16132| [58980] Apache Geronimo LDAP Realm Configuration Restart Reversion Weakness
16133| [58979] Apache MyFaces Tomahawk ExtensionsPhaseListener HTML Injection Information Disclosure
16134| [58978] Apache MyFaces Trinidad LocaleInfoScriptlet XSS
16135| [58977] Apache Open For Business Project (OFBiz) Multiple Default Accounts
16136| [58976] Apache Open For Business Project (OFBiz) URI passThru Parameter XSS
16137| [58975] Apache Open For Business Project (OFBiz) PARTYMGR_CREATE/UPDATE Permission Arbitrary User Password Modification
16138| [58974] Apache Sling /apps Script User Session Management Access Weakness
16139| [58973] Apache Tuscany Crafted SOAP Request Access Restriction Bypass
16140| [58931] Apache Geronimo Cookie Parameters Validation Weakness
16141| [58930] Apache Xalan-C++ XPath Handling Remote DoS
16142| [58879] Apache Portable Runtime (APR-util) poll/unix/port.c Event Port Backend Pollset Feature Remote DoS
16143| [58837] Apache Commons Net FTPSClient CipherSuites / Protocols Mutable Object Unspecified Data Security Issue
16144| [58813] Apache MyFaces Trinidad tr:table / HTML Comment Handling DoS
16145| [58812] Apache Open For Business Project (OFBiz) JSESSIONID Session Hijacking Weakness
16146| [58811] Apache Open For Business Project (OFBiz) /catalog/control/EditProductConfigItem configItemId Parameter XSS
16147| [58810] Apache Open For Business Project (OFBiz) /catalog/control/EditProdCatalo prodCatalogId Parameter XSS
16148| [58809] Apache Open For Business Project (OFBiz) /partymgr/control/viewprofile partyId Parameter XSS
16149| [58808] Apache Open For Business Project (OFBiz) /catalog/control/createProduct internalName Parameter XSS
16150| [58807] Apache Open For Business Project (OFBiz) Multiple Unspecified CSRF
16151| [58806] Apache FtpServer MINA Logging Filter Cleartext Credential Local Disclosure
16152| [58805] Apache Derby Unauthenticated Database / Admin Access
16153| [58804] Apache Wicket Header Contribution Unspecified Issue
16154| [58803] Apache Wicket Session Fixation
16155| [58802] Apache Directory Server (ApacheDS) userPassword Attribute Search Password Disclosure
16156| [58801] Apache ActiveMQ Stomp Client Credential Validation Bypass
16157| [58800] Apache Tapestry (context)/servicestatus Internal Service Information Disclosure
16158| [58799] Apache Tapestry Logging Cleartext Password Disclosure
16159| [58798] Apache Jetspeed pipeline Parameter pipeline-map Policy Bypass
16160| [58797] Apache Jetspeed Password Policy Multiple Weaknesses
16161| [58796] Apache Jetspeed Unsalted Password Storage Weakness
16162| [58795] Apache Rampart Crafted SOAP Header Authentication Bypass
16163| [58794] Apache Roller Admin Protocol (RAP) Malformed Header Authentication Bypass
16164| [58793] Apache Hadoop Map/Reduce mapred.system.dir Permission Weakness Job Manipulation
16165| [58792] Apache Shindig gadgets.rpc iframe RPC Call Validation Weakness
16166| [58791] Apache Synapse synapse.properties Cleartext Credential Local Disclosure
16167| [58790] Apache WSS4J SOAP Message UsernameToken Remote Password Disclosure
16168| [58789] Apache WSS4J SOAP Header Malformed UsernameToken Authentication Bypass
16169| [58776] Apache JSPWiki PreviewContent.jsp Edited Text XSS
16170| [58775] Apache JSPWiki preview.jsp action Parameter XSS
16171| [58774] Apache JSPWiki Edit.jsp Multiple Parameter XSS
16172| [58773] Apache JSPWiki Accept-Language Header Multiple Script language Parameter XSS
16173| [58772] Apache JSPWiki EditorManager.java editor Parameter XSS
16174| [58771] Apache JSPWiki GroupContent.jsp Multiple Parameter XSS
16175| [58770] Apache JSPWiki Group.jsp group Parameter XSS
16176| [58769] Apache JSPWiki Database Connection Termination DoS Weakness
16177| [58768] Apache JSPWiki Attachment Servlet nextpage Parameter Arbitrary Site Redirect
16178| [58766] Apache JSPWiki /admin/SecurityConfig.jsp Direct Request Information Disclosure
16179| [58765] Apache JSPWiki Spam Filter UniqueID RNG Weakness
16180| [58764] Apache JSPWiki Edit.jsp Multiple Parameter XSS
16181| [58763] Apache JSPWiki Include Tag Multiple Script XSS
16182| [58762] Apache JSPWiki Multiple .java Tags pageContext Parameter XSS
16183| [58761] Apache JSPWiki Wiki.jsp skin Parameter XSS
16184| [58760] Apache Commons VFS Exception Error Message Cleartext Credential Disclosure
16185| [58759] Apache Jackrabbit Content Repository (JCR) UUID System.currentTimeMillis() RNG Weakness
16186| [58758] Apache River GrantPermission Policy Manipulation Privilege Escalation
16187| [58757] Apache WS-Commons Java2 StaXUtils Multiple Unspecified Minor Issues
16188| [58756] Apache WSS4J WSHandler Client Certificate Signature Validation Weakness
16189| [58755] Apache Harmony DRLVM Non-public Class Member Access
16190| [58754] Apache Harmony File.createTempFile() Temporary File Creation Prediction Weakness
16191| [58751] Apache Geronimo GeronimoIdentityResolver Subject Handling Multiple Issues
16192| [58750] Apache MyFaces Trinidad Generated HTML Information Disclosure
16193| [58749] Apache MyFaces Trinidad Database Access Error Message Information Disclosure
16194| [58748] Apache MyFaces Trinidad Image Resource Loader Traversal Arbitrary Image Access
16195| [58747] Apache MyFaces Trinidad Error Message User Entered Data Disclosure Weakness
16196| [58746] Apache Axis2 JAX-WS Java2 WSDL4J Unspecified Issue
16197| [58744] Apache Wicket Crafted File Upload Disk Space Exhaustion DoS
16198| [58743] Apache Wicket wicket.util.crypt.SunJceCrypt Encryption Reversion Weakness
16199| [58742] Apache Rampart PolicyBasedValiadtor HttpsToken Endpoint Connection Weakness
16200| [58741] Apache Rampart WSSecSignature / WSSecEncryptedKey KeyIdentifierType Validation Weakness
16201| [58740] Apache Rampart TransportBinding Message Payload Cleartext Disclosure
16202| [58739] Apache Open For Business Project (OFBiz) Unsalted Password Storage Weakness
16203| [58738] Apache Open For Business Project (OFBiz) orderId Parameter Arbitrary Order Access
16204| [58737] Apache mod_python w/ mod_python.publisher index.py Underscore Prefixed Variable Disclosure
16205| [58735] Apache Open For Business Project (OFBiz) /ecommerce/control/keywordsearch SEARCH_STRING Parameter XSS
16206| [58734] Apache Torque Log File Cleartext Credential Local Disclosure
16207| [58733] Apache Axis2 doGet Implementation Authentication Bypass Service State Manipulation
16208| [58732] Apache MyFaces UIInput.validate() Null Value Validation Bypass Weakness
16209| [58731] Apache MyFaces /faces/* Prefix Mapping Authentication Bypass
16210| [58725] Apache Tapestry Basic String ACL Bypass Weakness
16211| [58724] Apache Roller Logout Functionality Failure Session Persistence
16212| [58723] Apache Roller User Profile / Admin Page Cleartext Password Disclosure
16213| [58722] Apache Derby Connection URL Encryption Method Reversion Weakness
16214| [58721] Apache Geronimo on Tomcat Security-constraint Resource ACL Bypass
16215| [58720] Apache Geronimo Explicit Servlet Mapping Access Bypass Weakness
16216| [58719] Apache Geronimo Keystore Unprivileged Service Disable DoS
16217| [58718] Apache Geronimo Deployment Plans Remote Password Disclosure
16218| [58717] Apache Jetspeed Portlet Application Edit Access Restriction Bypass
16219| [58716] Apache Jetspeed PSML Management Cached Constraint Authentication Weakness
16220| [58707] Apache WSS4J Crafted PasswordDigest Request Authentication Bypass
16221| [58706] Apache HttpClient Pre-emptive Authorization Remote Credential Disclosure
16222| [58705] Apache Directory Server (ApacheDS) User Passwords Cleartext Disclosure
16223| [58704] Apache Directory Server (ApacheDS) Non-existent User LDAP Bind Remote DoS
16224| [58703] Apache Geronimo Debug Console Unauthenticated Remote Information Disclosure
16225| [58702] Apache Directory Server (ApacheDS) Persistent LDAP Anonymous Bind Weakness
16226| [58701] Apache Jetspeed User Admin Portlet Unpassworded Account Creation Weakness
16227| [58700] Apache MyFaces /faces/* Path Handling Remote Overflow DoS
16228| [58699] Apache MyFaces Disable Property Client Side Manipulation Privilege Escalation
16229| [58698] Apache Roller Remember Me Functionality Cleartext Password Disclosure
16230| [58697] Apache XalanJ2 org.apache.xalan.xsltc.runtime.CallFunction Class Unspecified Issue
16231| [58696] Apache Tapestry Encoded Traversal Arbitrary File Access
16232| [58695] Apache Jetspeed Unauthenticated PSML Tags / Admin Folder Access
16233| [58694] Apache Geronimo Deploy Tool Process List Local Credential Disclosure
16234| [58693] Apache Derby service.properties File Encryption Key Information Disclosure
16235| [58692] Apache Geronimo Default Security Realm Login Brute Force Weakness
16236| [58689] Apache Roller Retrieve Last 5 Post Feature Unauthorized Blog Post Manipulation
16237| [58688] Apache Xalan-Java (XalanJ2) Static Variables Multiple Unspecified Issues
16238| [58687] Apache Axis Invalid wsdl Request XSS
16239| [58686] Apache Cocoon Temporary File Creation Unspecified Race Condition
16240| [58685] Apache Velocity Template Designer Privileged Code Execution
16241| [58684] Apache Jetspeed controls.Customize Action Security Check Bypass
16242| [58675] Apache Open For Business Project (OFBiz) eCommerce/ordermgr Multiple Field XSS
16243| [58674] Apache Open For Business Project (OFBiz) ecommerce/control/login Multiple Field XSS
16244| [58673] Apache Open For Business Project (OFBiz) ecommerce/control/viewprofile Multiple Field XSS
16245| [58672] Apache Open For Business Project (OFBiz) POS Input Panel Cleartext Password Disclosure
16246| [58671] Apache Axis2 JMS Signed Message Crafted WS-Security Header Security Bypass
16247| [58670] Apache Jetspeed JetspeedTool.getPortletFromRegistry Portlet Security Validation Failure
16248| [58669] Apache Jetspeed LDAP Cleartext Passwords Disclosure
16249| [58668] Apache Axis External Entity (XXE) Data Parsing Privilege Escalation
16250| [58667] Apache Roller Database Cleartext Passwords Disclosure
16251| [58666] Apache Xerces-C++ UTF-8 Transcoder Overlong Code Handling Unspecified Issue
16252| [58665] Apache Jetspeed Turbine: Cross-user Privileged Action Execution
16253| [58664] Apache Jetspeed EditAccount.vm Password Modification Weakness
16254| [58663] Apache Jetspeed Role Parameter Arbitrary Portlet Disclosure
16255| [58662] Apache Axis JWS Page Generated .class File Direct Request Information Disclosure
16256| [58661] Apache Jetspeed user-form.vm Password Reset Cleartext Disclosure
16257| [58660] Apache WSS4J checkReceiverResults Function Crafted SOAP Request Authentication Bypass
16258| [58658] Apache Rampart Crafted SOAP Request Security Verification Bypass
16259| [57882] Apache HTTP Server mod_proxy_ftp Authorization HTTP Header Arbitrary FTP Command Injection
16260| [57851] Apache HTTP Server mod_proxy_ftp EPSV Command NULL Dereference Remote DoS
16261| [56984] Apache Xerces2 Java Malformed XML Input DoS
16262| [56903] Apache ODE (Orchestration Director Engine) Process Deployment Web Service Traversal Arbitrary File Manipulation
16263| [56859] Apache Xerces-C++ Multiple Sub-project XML Nested DTD Structures Parsing Recursion Error DoS
16264| [56766] Apache Portable Runtime (APR-util) memory/unix/apr_pools.c Relocatable Memory Block Aligning Overflow
16265| [56765] Apache Portable Runtime (APR-util) misc/apr_rmm.c Multiple Function Overflows
16266| [56517] Apache HTTP Server File Descriptor Leak Arbitrary Local File Append
16267| [56443] PTK Unspecified Apache Sub-process Arbitrary Command Execution
16268| [56414] Apache Tiles Duplicate Expression Language (EL) Expression Evaluation XSS
16269| [55814] mod_NTLM for Apache HTTP Server ap_log_rerror() Function Remote Format String
16270| [55813] mod_NTLM for Apache HTTP Server log() Function Remote Overflow
16271| [55782] Apache HTTP Server mod_deflate Module Aborted Connection DoS
16272| [55553] Apache HTTP Server mod_proxy Module mod_proxy_http.c stream_reqbody_cl Function CPU Consumption DoS
16273| [55059] Apache APR-util strmatch/apr_strmatch.c apr_strmatch_precompile Function Crafted Input Remote DoS
16274| [55058] Apache APR-util apr_brigade_vprintf Function Crafted Input Off-by-one Remote DoS
16275| [55057] Apache APR-util xml/apr_xml.c apr_xml_* Interface Expat XML Parser Crafted XML Document Remote DoS
16276| [55056] Apache Tomcat Cross-application TLD File Manipulation
16277| [55055] Apache Tomcat Illegal URL Encoded Password Request Username Enumeration
16278| [55054] Apache Tomcat Java AJP Connector mod_jk Load Balancing Worker Malformed Header Remote DoS
16279| [55053] Apache Tomcat Crafted Request Security Restraint Bypass Arbitrary Content Access
16280| [54733] Apache HTTP Server AllowOverride Directive .htaccess Options Bypass
16281| [54713] razorCMS Security Manager apache User Account Unspecified File Permission Weakness Issue
16282| [54589] Apache Jserv Nonexistent JSP Request XSS
16283| [54122] Apache Struts s:a / s:url Tag href Element XSS
16284| [54093] Apache ActiveMQ Web Console JMS Message XSS
16285| [53932] Apache Geronimo Multiple Admin Function CSRF
16286| [53931] Apache Geronimo /console/portal/Server/Monitoring Multiple Parameter XSS
16287| [53930] Apache Geronimo /console/portal/ URI XSS
16288| [53929] Apache Geronimo on Windows Security/Keystores Portlet Traversal Arbitrary File Upload
16289| [53928] Apache Geronimo on Windows Embedded DB/DB Manager Portlet Traversal Arbitrary File Upload
16290| [53927] Apache Geronimo on Windows Services/Repository Portlet Traversal Arbitrary File Upload
16291| [53921] Apache HTTP Server mod_proxy_ajp Cross Thread/Session Information Disclosure
16292| [53766] Oracle BEA WebLogic Server Plug-ins for Apache Certificate Handling Remote Overflow
16293| [53574] PHP on Apache .htaccess mbstring.func_overload Setting Cross Hosted Site Behavior Modification
16294| [53381] Apache Tomcat JK Connector Content-Length Header Cross-user Information Disclosure
16295| [53380] Apache Struts Unspecified XSS
16296| [53289] Apache mod_perl Apache::Status /perl-status Unspecified XSS
16297| [53186] Apache HTTP Server htpasswd Predictable Salt Weakness
16298| [52899] Apache Tomcat Examples Web Application Calendar Application jsp/cal/cal2.jsp time Parameter XSS
16299| [52407] Apache Tomcat doRead Method POST Content Information Disclosure
16300| [51923] Apache HTTP Server mod-auth-mysql Module mod_auth_mysql.c Multibyte Character Encoding SQL Injection
16301| [51613] Apache HTTP Server Third-party Module Child Process File Descriptor Leak
16302| [51612] Apache HTTP Server Internal Redirect Handling Infinite Loop DoS
16303| [51468] Apache Jackrabbit Content Repository (JCR) swr.jsp q Parameter XSS
16304| [51467] Apache Jackrabbit Content Repository (JCR) search.jsp q Parameter XSS
16305| [51151] Apache Roller Search Function q Parameter XSS
16306| [50482] PHP with Apache php_value Order Unspecified Issue
16307| [50475] Novell NetWare ApacheAdmin Console Unauthenticated Access
16308| [49734] Apache Struts DefaultStaticContentLoader Class Traversal Arbitrary File Access
16309| [49733] Apache Struts FilterDispatcher Class Traversal Arbitrary File Access
16310| [49283] Oracle BEA WebLogic Server Plugins for Apache Remote Transfer-Encoding Overflow
16311| [49062] Apache Tomcat Cross-thread Concurrent Request Variable Overwrite Information Disclosure
16312| [48847] ModSecurity (mod_security) Transformation Caching Unspecified Apache DoS
16313| [48788] Apache Xerces-C++ XML Schema maxOccurs Value XML File Handling DoS
16314| [47474] Apache HTTP Server mod_proxy_ftp Directory Component Wildcard Character XSS
16315| [47464] Apache Tomcat allowLinking / UTF-8 Traversal Arbitrary File Access
16316| [47463] Apache Tomcat RequestDispatcher Traversal Arbitrary File Access
16317| [47462] Apache Tomcat HttpServletResponse.sendError Method Message Argument XSS
16318| [47096] Oracle Weblogic Apache Connector POST Request Overflow
16319| [46382] Frontend Filemanager (air_filemanager) Extension for TYPO3 on Apache Unspecified Arbitrary Code Execution
16320| [46285] TYPO3 on Apache Crafted Filename Upload Arbitrary Command Execution
16321| [46085] Apache HTTP Server mod_proxy ap_proxy_http_process_response() Function Interim Response Forwarding Remote DoS
16322| [45905] Apache Tomcat Host Manager host-manager/html/add name Parameter XSS
16323| [45879] Ragnarok Online Control Panel on Apache Crafted Traversal Authentication Bypass
16324| [45742] Apache HTTP Server on Novell Unspecified Request Directive Internal IP Disclosure
16325| [45740] Apache Derby DropSchemaNode Bind Phase Arbitrary Scheme Statement Dropping
16326| [45599] Apache Derby Lock Table Statement Privilege Requirement Bypass Arbitrary Table Lock
16327| [45585] Apache Derby ACCSEC Command RDBNAM Parameter Cleartext Credential Disclosure
16328| [45584] Apache Derby DatabaseMetaData.getURL Function Cleartext Credential Disclosure
16329| [45420] Apache HTTP Server 403 Error Page UTF-7 Encoded XSS
16330| [44728] PHP Toolkit on Gentoo Linux Interpretation Conflict Apache HTTP Server Local DoS
16331| [44618] Oracle JSP Apache/Jserv Path Translation Traversal Arbitrary JSP File Execution
16332| [44159] Apache HTTP Server Remote Virtual Host Name Disclosure
16333| [43997] Apache-SSL ExpandCert() Function Certificate Handling Arbitrary Environment Variables Manipulation
16334| [43994] suPHP for Apache (mod_suphp) Directory Symlink Local Privilege Escalation
16335| [43993] suPHP for Apache (mod_suphp) Owner Mode Race Condition Symlink Local Privilege Escalation
16336| [43663] Apache HTTP Server Mixed Platform AddType Directive Crafted Request PHP Source Disclosure
16337| [43658] AuthCAS Module (AuthCAS.pm) for Apache HTTP Server SESSION_COOKIE_NAME SQL Injection
16338| [43452] Apache Tomcat HTTP Request Smuggling
16339| [43309] Apache Geronimo LoginModule Login Method Bypass
16340| [43290] Apache JSPWiki Entry Page Attachment Unrestricted File Upload
16341| [43259] Apache HTTP Server on Windows mod_proxy_balancer URL Handling Remote Memory Corruption
16342| [43224] Apache Geronimo on SuSE Linux init Script Symlink Unspecified File/Directory Access
16343| [43189] Apache mod_jk2 Host Header Multiple Fields Remote Overflow
16344| [42937] Apache HTTP Server mod_proxy_balancer balancer-manager Unspecified CSRF
16345| [42341] MOD_PLSQL for Apache Unspecified URL SQL Injection
16346| [42340] MOD_PLSQL for Apache CGI Environment Handling Unspecified Overflow
16347| [42214] Apache HTTP Server mod_proxy_ftp UTF-7 Encoded XSS
16348| [42091] Apache Maven Site Plugin Installation Permission Weakness
16349| [42089] Apache Maven .m2/settings.xml Cleartext Password Disclosure
16350| [42088] Apache Maven Defined Repo Process Listing Password Disclosure
16351| [42087] Apache Maven Site Plugin SSH Deployment Permission Setting Weakness
16352| [42036] Apache HTTP Server MS-DOS Device Request Host OS Disclosure
16353| [41891] BEA WebLogic Apache Beehive NetUI Page Flow Unspecified XSS
16354| [41436] Apache Tomcat Native APR Connector Duplicate Request Issue
16355| [41435] Apache Tomcat %5C Cookie Handling Session ID Disclosure
16356| [41434] Apache Tomcat Exception Handling Subsequent Request Information Disclosure
16357| [41400] LimeSurvey save.php Apache Log File PHP Code Injection
16358| [41029] Apache Tomcat Calendar Examples Application cal2.jsp Multiple Parameter CSRF
16359| [41019] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload XSS
16360| [41018] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload CRLF
16361| [40853] Apache Tomcat SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) JSESSIONIDSSO Cookie Security Weakness
16362| [40264] Apache HTTP Server mod_proxy_balancer balancer_handler Function bb Variable Remote DoS
16363| [40263] Apache HTTP Server mod_proxy_balancer balancer-manager Multiple Parameter XSS
16364| [40262] Apache HTTP Server mod_status refresh XSS
16365| [39833] Apache Tomcat JULI Logging Component catalina.policy Security Bypass
16366| [39251] Coppermine Photo Gallery on Apache Multiple File Extension Upload Arbitrary Code Execution
16367| [39166] Apache Tomcat on Windows caseSensitive Attribute Mixed Case Request JSP Source Disclosure
16368| [39134] Apache mod_imagemap Module Imagemap Unspecified XSS
16369| [39133] Apache mod_imap Module Imagemap File Unspecified XSS
16370| [39035] Apache Tomcat examples/servlet/CookieExample Multiple Parameter XSS
16371| [39003] Apache HTTP Server HTTP Method Header Request Entity Too Large XSS
16372| [39000] Apache Tomcat SendMailServlet sendmail.jsp mailfrom Parameter XSS
16373| [38939] Apache HTTP Server Prefork MPM Module Array Modification Local DoS
16374| [38673] Apache Jakarta Slide WebDAV SYSTEM Request Traversal Arbitrary File Access
16375| [38662] Apache Geronimo SQLLoginModule Nonexistent User Authentication Bypass
16376| [38661] Apache Geronimo MEJB Unspecified Authentication Bypass
16377| [38641] Apache HTTP Server mod_mem_cache recall_headers Function Information Disclosure
16378| [38640] Apache HTTP Server suexec Document Root Unauthorized Operations
16379| [38639] Apache HTTP Server suexec Multiple Symlink Privilege Escalation
16380| [38636] Apache HTTP Server mod_autoindex.c P Variable UTF-7 Charset XSS
16381| [38513] BEA WebLogic Server Proxy Plug-in for Apache Protocol Error Handling Remote DoS
16382| [38187] Apache Geronimo / Tomcat WebDAV XML SYSTEM Tag Arbitrary File Access
16383| [37079] Apache HTTP Server mod_cache cache_util.c Malformed Cache-Control Header DoS
16384| [37071] Apache Tomcat Cookie Handling Session ID Disclosure
16385| [37070] Apache Tomcat Cookie Handling Quote Delimiter Session ID Disclosure
16386| [37052] Apache HTTP Server mod_status mod_status.c Unspecified XSS
16387| [37051] Apache HTTP Server mod_proxy modules/proxy/proxy_util.c Crafted Header Remote DoS
16388| [37050] Apache HTTP Server Prefork MPM Module Crafted Code Sequence Local DoS
16389| [36417] Apache Tomcat Host Manager Servlet html/add Action aliases Parameter XSS
16390| [36377] Apache MyFaces Tomahawk JSF Application autoscroll Multiple Script XSS
16391| [36080] Apache Tomcat JSP Examples Crafted URI XSS
16392| [36079] Apache Tomcat Manager Uploaded Filename XSS
16393| [34888] Apache Tomcat Example Calendar Application cal2.jsp time Parameter XSS
16394| [34887] Apache Tomcat implicit-objects.jsp Crafted Header XSS
16395| [34885] Apache Tomcat on IIS Servlet Engine MS-DOS Device Request DoS
16396| [34884] Apache Tomcat on Windows Nonexistent Resource Request Path Disclosure
16397| [34883] Apache Tomcat Crafted JSP File Request Path Disclosure
16398| [34882] Apache Tomcat Default SSL Ciphersuite Configuration Weakness
16399| [34881] Apache Tomcat Malformed Accept-Language Header XSS
16400| [34880] Apache Tomcat HTTP/1.1 Connector NULL Byte Request JSP Source Disclosure
16401| [34879] Apache Tomcat examples/jsp2/jspx/textRotate.jspx XSS
16402| [34878] Apache Tomcat examples/jsp2/el/implicit-objects.jsp XSS
16403| [34877] Apache Tomcat JK Web Server Connector (mod_jk) Double Encoded Traversal Arbitrary File Access
16404| [34876] Apache HTTP Server ScriptAlias CGI Source Disclosure
16405| [34875] Apache Tomcat appdev/sample/web/hello.jsp Multiple Parameter XSS
16406| [34874] Apache Tomcat AJP Connector mod_jk ajp_process_callback Remote Memory Disclosure
16407| [34873] Apache Stats Variable Extraction _REQUEST Ssuperglobal Array Overwrite
16408| [34872] Apache HTTP Server suexec User/Group Combination Weakness Local Privilege Escalation
16409| [34769] Apache Tomcat w/ Proxy Module Double Encoded Traversal Arbitrary File Access
16410| [34541] mod_perl for Apache HTTP Server RegistryCooker.pm PATH_INFO Crafted URI Remote DoS
16411| [34540] mod_perl for Apache HTTP Server PerlRun.pm PATH_INFO Crafted URI Remote DoS
16412| [34398] Apache Tomcat mod_jk Invalid Chunked Encoded Body Information Disclosure
16413| [34154] Apache Axis Nonexistent Java Web Service Path Disclosure
16414| [33855] Apache Tomcat JK Web Server Connector mod_jk.so Long URI Worker Map Remote Overflow
16415| [33816] Apache HTTP Server on Debian Linux TTY Local Privilege Escalation
16416| [33456] Apache HTTP Server Crafted TCP Connection Range Header DoS
16417| [33346] Avaya Multiple Products Apache Tomcat Port Weakness
16418| [32979] Apache Java Mail Enterprise Server (JAMES) Phoenix/MX4J Interface Arbitrary User Creation
16419| [32978] Apache Java Mail Enterprise Server (JAMES) POP3Server Log File Plaintext Password Disclosure
16420| [32724] Apache mod_python _filter_read Freed Memory Disclosure
16421| [32723] Apache Tomcat semicolon Crafted Filename Request Forced Directory Listing
16422| [32396] Apache Open For Business Project (OFBiz) Ecommerce Component Forum Implementation Message Body XSS
16423| [32395] Apache Open For Business Project (OFBiz) Ecommerce Component Form Field Manipulation Privilege Escalation
16424| [30354] Linux Subversion libapache2-svn Search Path Subversion Local Privilege Escalation
16425| [29603] PHP ini_restore() Apache httpd.conf Options Bypass
16426| [29536] Apache Tcl mod_tcl set_var Function Remote Format String
16427| [28919] Apache Roller Weblogger Blog Comment Multiple Field XSS
16428| [28130] PHP with Apache Mixed Case Method Limit Directive Bypass
16429| [27913] Apache HTTP Server on Windows mod_alias URL Validation Canonicalization CGI Source Disclosure
16430| [27588] Apache HTTP Server mod_rewrite LDAP Protocol URL Handling Overflow
16431| [27487] Apache HTTP Server Crafted Expect Header Cross Domain HTML Injection
16432| [26935] FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
16433| [26572] Apache Java Mail Enterprise Server (JAMES) MAIL Command Overflow DoS
16434| [25909] Drupal on Apache files Directory File Upload Arbitrary Code Execution
16435| [24825] Oracle ModPL/SQL for Apache Unspecified Remote HTTP Issue
16436| [24365] Apache Struts Multiple Function Error Message XSS
16437| [24364] Apache Struts getMultipartRequestHandler() Function Crafted Request DoS
16438| [24363] Apache Struts org.apache.struts.taglib.html.Constants.CANCEL Validation Bypass
16439| [24103] Pubcookie Apache mod_pubcookie Unspecified XSS
16440| [23906] Apache mod_python for Apache HTTP Server FileSession Privileged Local Command Execution
16441| [23905] Apache Log4net LocalSyslogAppender Format String Memory Corruption DoS
16442| [23198] Apache WSS4J Library SOAP Signature Verification Bypass
16443| [23124] Generic Apache Request Library (libapreq) apreq_parse_* Functions Remote DoS
16444| [22652] mod_php for Apache HTTP Server Crafted import_request_variables Function DoS
16445| [22475] PHP w/ Apache PDO::FETCH_CLASS __set() Function DoS
16446| [22473] PHP w/ Apache2 Crafted PDOStatement DoS
16447| [22459] Apache Geronimo Error Page XSS
16448| [22458] Apache Tomcat / Geronimo Sample Script cal2.jsp time Parameter XSS
16449| [22301] auth_ldap for Apache HTTP Server auth_ldap_log_reason() Function Remote Format String
16450| [22261] Apache HTTP Server mod_ssl ssl_hook_Access Error Handling DoS
16451| [22259] mod_auth_pgsql for Apache HTTP Server Log Function Format String
16452| [21736] Apache Java Mail Enterprise Server (JAMES) Spooler retrieve Function DoS
16453| [21705] Apache HTTP Server mod_imap Image Map Referer XSS
16454| [21021] Apache Struts Error Message XSS
16455| [20897] PHP w/ Apache 2 SAPI virtual() Function Unspecified INI Setting Disclosure
16456| [20491] PHP mod_php apache2handler SAPI Crafted .htaccess DoS
16457| [20462] Apache HTTP Server worker.c MPM Memory Exhaustion DoS
16458| [20439] Apache Tomcat Directory Listing Saturation DoS
16459| [20373] Apache Tomcat on HP Secure OS for Linux Unspecified Servlet Access Issue
16460| [20285] Apache HTTP Server Log File Control Character Injection
16461| [20242] Apache HTTP Server mod_usertrack Predictable Session ID Generation
16462| [20209] Brainf*ck Module (mod_bf) for Apache HTTP Server Local Overflow
16463| [20033] Apache Tomcat MS-DOS Device Request Error Message Path Disclosure
16464| [19883] apachetop atop.debug Symlink Arbitrary File Overwrite
16465| [19863] mod_auth_shadow for Apache HTTP Server require group Authentication Bypass
16466| [19855] Apache HTTP Server ErrorDocument Directive .htaccess Bypass
16467| [19821] Apache Tomcat Malformed Post Request Information Disclosure
16468| [19769] Apache HTTP Server Double-reverse DNS Lookup Spoofing
16469| [19188] Apache HTTP Server mod_ssl SSLVerifyClient Per-location Context Restriction Bypass
16470| [19137] Apache HTTP Server on Red Hat Linux Double Slash GET Request Forced Directory Listing
16471| [19136] Apache on Mandrake Linux Arbitrary Directory Forced Listing
16472| [18977] Apache HTTP Server Crafted HTTP Range Header DoS
16473| [18389] Ragnarok Online Control Panel Apache Authentication Bypass
16474| [18286] Apache HTTP Server mod_ssl ssl_callback_SSLVerify_CRL( ) Function Overflow
16475| [18233] Apache HTTP Server htdigest user Variable Overfow
16476| [17738] Apache HTTP Server HTTP Request Smuggling
16477| [16586] Apache HTTP Server Win32 GET Overflow DoS
16478| [15889] Apache HTTP Server mod_cgid Threaded MPM CGI Output Misdirection
16479| [14896] mod_dav for Apache HTTP Server Remote Null Dereference Child Process Termination
16480| [14879] Apache HTTP Server ap_log_rerror Function Error Message Path Disclosure
16481| [14770] Apache Tomcat AJP12 Protocol Malformed Packet Remote DoS
16482| [14597] Apache Tomcat IntegerOverflow.jsp Test JSP Script Path Disclosure
16483| [14596] Apache Tomcat pageSession.jsp Test JSP Script Path Disclosure
16484| [14595] Apache Tomcat pageLanguage.jsp Test JSP Script Path Disclosure
16485| [14594] Apache Tomcat pageIsThreadSafe.jsp Test JSP Script Path Disclosure
16486| [14593] Apache Tomcat pageIsErrorPage.jsp Test JSP Script Path Disclosure
16487| [14592] Apache Tomcat pageInvalid.jsp Test JSP Script Path Disclosure
16488| [14591] Apache Tomcat pageExtends.jsp Test JSP Script Path Disclosure
16489| [14590] Apache Tomcat pageDouble.jsp Test JSP Script Path Disclosure
16490| [14589] Apache Tomcat pageAutoFlush.jsp Test JSP Script Path Disclosure
16491| [14588] Apache Tomcat extends2.jsp Test JSP Script Path Disclosure
16492| [14587] Apache Tomcat extends1.jsp Test JSP Script Path Disclosure
16493| [14586] Apache Tomcat comments.jsp Test JSP Script Path Disclosure
16494| [14585] Apache Tomcat buffer4.jsp Test JSP Script Path Disclosure
16495| [14584] Apache Tomcat buffer3.jsp Test JSP Script Path Disclosure
16496| [14583] Apache Tomcat buffer2.jsp Test JSP Script Path Disclosure
16497| [14582] Apache Tomcat buffer1.jsp Test JSP Script Path Disclosure
16498| [14581] Apache Tomcat pageImport2.jsp Test JSP Script Path Disclosure
16499| [14580] Apache Tomcat pageInfo.jsp Test JSP Script Path Disclosure
16500| [14410] mod_frontpage for Apache HTTP Server fpexec Remote Overflow
16501| [14044] Apache Batik Squiggle Browser with Rhino Scripting Engine Unspecified File System Access
16502| [13737] mod_access_referer for Apache HTTP Server Malformed Referer DoS
16503| [13711] Apache mod_python publisher.py Traversal Arbitrary Object Information Disclosure
16504| [13640] mod_auth_any for Apache HTTP Server on Red Hat Linux Metacharacter Command Execution
16505| [13304] Apache Tomcat realPath.jsp Path Disclosure
16506| [13303] Apache Tomcat source.jsp Arbitrary Directory Listing
16507| [13087] Apache HTTP Server mod_log_forensic check_forensic Symlink Arbitrary File Creation / Overwrite
16508| [12849] mod_auth_radius for Apache HTTP Server radcpy() Function Overflow DoS
16509| [12848] Apache HTTP Server htdigest realm Variable Overflow
16510| [12721] Apache Tomcat examples/jsp2/el/functions.jsp XSS
16511| [12720] mod_dosevasive for Apache HTTP Server Symlink Arbitrary File Create/Overwrite
16512| [12558] Apache HTTP Server IPv6 FTP Proxy Socket Failure DoS
16513| [12557] Apache HTTP Server prefork MPM accept Error DoS
16514| [12233] Apache Tomcat MS-DOS Device Name Request DoS
16515| [12232] Apache Tomcat with JDK Arbitrary Directory/Source Disclosure
16516| [12231] Apache Tomcat web.xml Arbitrary File Access
16517| [12193] Apache HTTP Server on Mac OS X File Handler Bypass
16518| [12192] Apache HTTP Server on Mac OS X Unauthorized .ht and .DS_Store File Access
16519| [12178] Apache Jakarta Lucene results.jsp XSS
16520| [12176] mod_digest_apple for Apache HTTP Server on Mac OS X Authentication Replay
16521| [11391] Apache HTTP Server Header Parsing Space Saturation DoS
16522| [11003] Apache HTTP Server mod_include get_tag() Function Local Overflow
16523| [10976] mod_mylo for Apache HTTP Server mylo_log Logging Function HTTP GET Overflow
16524| [10637] Apache HTTP Server mod_ssl SSLCipherSuite Access Restriction Bypass
16525| [10546] Macromedia JRun4 mod_jrun Apache Module Remote Overflow
16526| [10471] Apache Xerces-C++ XML Parser DoS
16527| [10218] Apache HTTP Server Satisfy Directive Access Control Bypass
16528| [10068] Apache HTTP Server htpasswd Local Overflow
16529| [10049] mod_cplusplus For Apache HTTP Server Unspecified Overflow
16530| [9994] Apache HTTP Server apr-util IPV6 Parsing DoS
16531| [9991] Apache HTTP Server ap_resolve_env Environment Variable Local Overflow
16532| [9948] mod_dav for Apache HTTP Server LOCK Request DoS
16533| [9742] Apache HTTP Server mod_ssl char_buffer_read Function Reverse Proxy DoS
16534| [9718] Apache HTTP Server Win32 Single Dot Append Arbitrary File Access
16535| [9717] Apache HTTP Server mod_cookies Cookie Overflow
16536| [9716] Apache::Gallery Gallery.pm Inline::C Predictable Filename Code Execution
16537| [9715] Apache HTTP Server rotatelogs Control Characters Over Pipe DoS
16538| [9714] Apache Authentication Module Threaded MPM DoS
16539| [9713] Apache HTTP Server on OS2 filestat.c Device Name Request DoS
16540| [9712] Apache HTTP Server Multiple Linefeed Request Memory Consumption DoS
16541| [9711] Apache HTTP Server Access Log Terminal Escape Sequence Injection
16542| [9710] Apache HTTP Server on Windows Illegal Character Default Script Mapping Bypass
16543| [9709] Apache HTTP Server on Windows MS-DOS Device Name HTTP Post Code Execution
16544| [9708] Apache HTTP Server on Windows MS-DOS Device Name DoS
16545| [9707] Apache HTTP Server Duplicate MIME Header Saturation DoS
16546| [9706] Apache Web Server Multiple MIME Header Saturation Remote DoS
16547| [9705] Apache Tomcat Invoker/Default Servlet Source Disclosure
16548| [9702] Apache HTTP Server CGI/WebDAV HTTP POST Request Source Disclosure
16549| [9701] Apache HTTP Server for Windows Multiple Slash Forced Directory Listing
16550| [9700] Apache HTTP Server mod_autoindex Multiple Slash Request Forced Directory Listing
16551| [9699] Apache HTTP Server mod_dir Multiple Slash Request Forced Directory Listing
16552| [9698] Apache HTTP Server mod_negotiation Multiple Slash Request Forced Directory Listing
16553| [9697] Apache HTTP Server htdigest Local Symlink Arbitrary File Overwrite
16554| [9696] Apache HTTP Server htpasswd Local Symlink Arbitrary File Overwrite
16555| [9695] Apache Tomcat SnoopServlet Servlet Information Disclosure
16556| [9694] PHP3 on Apache HTTP Server Encoded Traversal Arbitrary File Access
16557| [9693] mod_auth_pgsql_sys for Apache HTTP Server User Name SQL Injection
16558| [9692] Apache HTTP Server mod_vhost_alias Mass Virtual Hosting Arbitrary File Access
16559| [9691] Apache HTTP Server mod_rewrite Mass Virtual Hosting Arbitrary File Access
16560| [9690] Apache HTTP Server mod_vhost_alias CGI Program Source Disclosure
16561| [9689] Trustix httpsd for Apache-SSL Permission Weakness Privilege Escalation
16562| [9688] Apache HTTP Server mod_proxy Malformed FTP Command DoS
16563| [9687] Apache::AuthenSmb smbval SMB Authentication Library Multiple Overflows
16564| [9686] Apache::AuthenSmb smbvalid SMB Authentication Library Multiple Overflows
16565| [9523] Apache HTTP Server mod_ssl Aborted Connection DoS
16566| [9459] Oracle PL/SQL (mod_plsql) Apache Module Help Page Request Remote Overflow
16567| [9208] Apache Tomcat .jsp Encoded Newline XSS
16568| [9204] Apache Tomcat ROOT Application XSS
16569| [9203] Apache Tomcat examples Application XSS
16570| [9068] Apache HTTP Server mod_userdir User Account Information Disclosure
16571| [8773] Apache Tomcat Catalina org.apache.catalina.servlets.DefaultServlet Source Code Disclosure
16572| [8772] Apache Tomcat Catalina org.apache.catalina.connector.http DoS
16573| [7943] Apache HTTP Server mod_ssl sslkeys File Disclosure
16574| [7942] Apache HTTP Server mod_ssl Default Pass Phrase
16575| [7941] Apache HTTP Server mod_ssl Encrypted Private Key File Descriptor Leak
16576| [7935] Apache HTTP Server mod_ssl ssl_gcache Race Conditions
16577| [7934] Apache HTTP Server mod_ssl SSLSessionCache File Content Disclosure
16578| [7933] Apache HTTP Server mod_ssl SSLMutex File Content Disclosure
16579| [7932] Apache HTTP Server mod_ssl mkcert.sh File Creation Permission Weakness
16580| [7931] Apache HTTP Server mod_ssl X.509 Client Certificate Authentication Bypass
16581| [7930] Apache HTTP Server mod_ssl ssl_expr_eval_func_file() Overflow
16582| [7929] Apache HTTP Server mod_ssl ssl_engine_log.c mod_proxy Hook Function Remote Format String
16583| [7611] Apache HTTP Server mod_alias Local Overflow
16584| [7394] Apache Tomcat mod_jk Invalid Transfer-Encoding Chunked Field DoS
16585| [7203] Apache Tomcat source.jsp Traversal Arbitrary File Access
16586| [7039] Apache HTTP Server on Mac OS X HFS+ File System Access Bypass
16587| [6882] Apache mod_python Malformed Query String Variant DoS
16588| [6839] Apache HTTP Server mod_proxy Content-Length Overflow
16589| [6630] Apache Tomcat Java Server Pages (JSP) Engine WPrinterJob() DoS
16590| [6472] Apache HTTP Server mod_ssl ssl_util_uuencode_binary Remote Overflow
16591| [5821] Apache HTTP Server Multiple / GET Remote Overflow DoS
16592| [5580] Apache Tomcat Servlet Malformed URL JSP Source Disclosure
16593| [5552] Apache HTTP Server split-logfile Arbitrary .log File Overwrite
16594| [5526] Apache Tomcat Long .JSP URI Path Disclosure
16595| [5278] Apache Tomcat web.xml Restriction Bypass
16596| [5051] Apache Tomcat Null Character DoS
16597| [4973] Apache Tomcat servlet Mapping XSS
16598| [4650] mod_gzip for Apache HTTP Server Debug Mode Printf Stack Overflow
16599| [4649] mod_gzip for Apache HTTP Server Debug Mode Format String Overflow
16600| [4648] mod_gzip for Apache HTTP Server Debug Mode Race Condition
16601| [4568] mod_survey For Apache ENV Tags SQL Injection
16602| [4553] Apache HTTP Server ApacheBench Overflow DoS
16603| [4552] Apache HTTP Server Shared Memory Scoreboard DoS
16604| [4446] Apache HTTP Server mod_disk_cache Stores Credentials
16605| [4383] Apache HTTP Server Socket Race Condition DoS
16606| [4382] Apache HTTP Server Log Entry Terminal Escape Sequence Injection
16607| [4340] Apache Portable Runtime (APR) apr_psprintf DoS
16608| [4232] Apache Cocoon DatabaseAuthenticatorAction SQL Injection
16609| [4231] Apache Cocoon Error Page Server Path Disclosure
16610| [4182] Apache HTTP Server mod_ssl Plain HTTP Request DoS
16611| [4181] Apache HTTP Server mod_access IP Address Netmask Rule Bypass
16612| [4075] Apache HTTP Sever on Windows .var File Request Path Disclosure
16613| [4037] Apache HTTP Server on Cygwin Encoded GET Request Arbitrary File Access
16614| [3877] Apache-SSL SSLVerifyClient SSLFakeBasicAuth Client Certificate Forgery
16615| [3819] Apache HTTP Server mod_digest Cross Realm Credential Replay
16616| [3322] mod_php for Apache HTTP Server Process Hijack
16617| [3215] mod_php for Apache HTTP Server File Descriptor Leakage
16618| [2885] Apache mod_python Malformed Query String DoS
16619| [2749] Apache Cocoon view-source Sample File Traversal Arbitrary File Access
16620| [2733] Apache HTTP Server mod_rewrite Local Overflow
16621| [2672] Apache HTTP Server mod_ssl SSLCipherSuite Ciphersuite Downgrade Weakness
16622| [2613] Apache HTTP Server mod_cgi stderr Output Handling Local DoS
16623| [2149] Apache::Gallery Privilege Escalation
16624| [2107] Apache HTTP Server mod_ssl Host: Header XSS
16625| [1926] Apache HTTP Server mod_rewrite Crafted URI Rule Bypass
16626| [1833] Apache HTTP Server Multiple Slash GET Request DoS
16627| [1577] Apache HTTP Server mod_rewrite RewriteRule Expansion Arbitrary File Access
16628| [872] Apache Tomcat Multiple Default Accounts
16629| [862] Apache HTTP Server SSI Error Page XSS
16630| [859] Apache HTTP Server Win32 Crafted Traversal Arbitrary File Access
16631| [849] Apache Tomcat TroubleShooter Servlet Information Disclosure
16632| [845] Apache Tomcat MSDOS Device XSS
16633| [844] Apache Tomcat Java Servlet Error Page XSS
16634| [842] Apache HTTP Server mod_ssl ssl_compat_directive Function Overflow
16635| [838] Apache HTTP Server Chunked Encoding Remote Overflow
16636| [827] PHP4 for Apache on Windows php.exe Malformed Request Path Disclosure
16637| [775] Apache mod_python Module Importing Privilege Function Execution
16638| [769] Apache HTTP Server Win32 DOS Batch File Arbitrary Command Execution
16639| [756] Apache HTTP Server mod_ssl i2d_SSL_SESSION Function SSL Client Certificate Overflow
16640| [701] Apache HTTP Server Win32 ScriptAlias php.exe Arbitrary File Access
16641| [674] Apache Tomcat Nonexistent File Error Message Path Disclosure
16642| [637] Apache HTTP Server UserDir Directive Username Enumeration
16643| [623] mod_auth_pgsql for Apache HTTP Server User Name SQL Injection
16644| [582] Apache HTTP Server Multiviews Feature Arbitrary Directory Listing
16645| [562] Apache HTTP Server mod_info /server-info Information Disclosure
16646| [561] Apache Web Servers mod_status /server-status Information Disclosure
16647| [417] Apache HTTP Server on SuSE Linux /doc/packages Remote Information Disclosure
16648| [410] mod_perl for Apache HTTP Server /perl/ Directory Listing
16649| [404] Apache HTTP Server on SuSE Linux WebDAV PROPFIND Arbitrary Directory Listing
16650| [402] Apache HTTP Server on SuSE Linux cgi-bin-sdb Request Script Source Disclosure
16651| [379] Apache ASP module Apache::ASP source.asp Example File Arbitrary File Creation
16652| [377] Apache Tomcat Snoop Servlet Remote Information Disclosure
16653| [376] Apache Tomcat contextAdmin Arbitrary File Access
16654| [342] Apache HTTP Server for Windows Multiple Forward Slash Directory Listing
16655| [222] Apache HTTP Server test-cgi Arbitrary File Access
16656| [143] Apache HTTP Server printenv.pl Multiple Method CGI XSS
16657| [48] Apache HTTP Server on Debian /usr/doc Directory Information Disclosure
16658|_
16659113/tcp closed ident conn-refused
16660139/tcp closed netbios-ssn conn-refused
16661443/tcp open ssl/http syn-ack Apache httpd (PHP 7.1.23)
16662|_http-server-header: Apache
16663| vulscan: VulDB - https://vuldb.com:
16664| [135270] Apache JSPWiki up to 2.11.0.M3 Plugin Link cross site scripting
16665| [135269] Apache JSPWiki up to 2.11.0.M3 InterWiki Link cross site scripting
16666| [135268] Apache JSPWiki up to 2.11.0.M3 Attachment cross site scripting
16667| [134527] Apache Karaf up to 4.2.4 Config Service directory traversal
16668| [134416] Apache Sanselan 0.97-incubator Loop denial of service
16669| [134415] Apache Sanselan 0.97-incubator Hang denial of service
16670| [134291] Apache Axis up to 1.7.8 Server-Side Request Forgery
16671| [134290] Apache UIMA DUCC up to 2.2.2 cross site scripting
16672| [134248] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
16673| [134247] Apache Archiva up to 2.2.3 Artifact Upload directory traversal
16674| [134246] Apache Camel up to 2.19/2.21.3/2.22.2/2.23.0 directory traversal
16675| [134138] Apache Pluto 3.0.0/3.0.1 Chat Room Demo Portlet cross site scripting
16676| [133992] Apache Qpid Proton up to 0.27.0 Certificate Validation Man-in-the-Middle weak authentication
16677| [133977] Apache Zeppelin up to 0.7.x Stored cross site scripting
16678| [133976] Apache Zeppelin up to 0.7.x Cron Scheduler privilege escalation
16679| [133975] Apache Zeppelin up to 0.7.2 Session Fixation weak authentication
16680| [133444] Apache PDFbox 2.0.14 XML Parser XML External Entity
16681| [133750] Oracle Agile Recipe Management for Pharmaceuticals 9.3.3/9.3.4 Apache Commons FileUpload unknown vulnerability
16682| [133728] Oracle Retail Xstore Point of Service 7.0/7.1 Apache HTTP Server denial of service
16683| [133644] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
16684| [133643] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache HTTP Server denial of service
16685| [133640] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Commons FileUpload unknown vulnerability
16686| [133638] Oracle Healthcare Master Person Index 3.0/4.0 Apache Commons FileUpload unknown vulnerability
16687| [133614] Oracle Data Integrator 12.2.1.3.0 Apache Batik unknown vulnerability
16688| [133594] Oracle WebCenter Portal 12.2.1.3.0 Apache Commons FileUpload unknown vulnerability
16689| [133591] Oracle JDeveloper 11.1.1.9.0/12.1.3.0.0/12.2.1.3.0 Apache Log4j unknown vulnerability
16690| [133590] Oracle Identity Analytics 11.1.1.5.8 Apache Commons FileUpload unknown vulnerability
16691| [133588] Oracle Endeca Information Discovery Integrator 3.2.0 Apache Commons FileUpload unknown vulnerability
16692| [133587] Oracle Data Integrator 11.1.1.9.0 Apache Groovy unknown vulnerability
16693| [133585] Oracle API Gateway 11.1.2.4.0 Apache Commons FileUpload unknown vulnerability
16694| [133573] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache ActiveMQ unknown vulnerability
16695| [133571] Oracle FLEXCUBE Private Banking 2.0.0.0/2.2.0.1/12.0.1.0/12.0.3.0/12.1.0.0 Apache Commons FileUpload unknown vulnerability
16696| [133522] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache Tomcat unknown vulnerability
16697| [133520] Oracle Instantis EnterpriseTrack 17.1/17.2/17.3 Apache HTTP Server denial of service
16698| [133518] Oracle Primavera Unifier up to 18.8 Apache Commons FileUpload unknown vulnerability
16699| [133508] Oracle Communications Instant Messaging Server 10.0.1 Apache Tomcat unknown vulnerability
16700| [133501] Oracle Communications Policy Management 12.1/12.2/12.3/12.4 Apache Struts 1 unknown vulnerability
16701| [133500] Oracle Communications Application Session Controller 3.7.1/3.8.0 Apache Tomcat unknown vulnerability
16702| [133493] Oracle Communications Pricing Design Center 11.1/12.0 Apache Log4j unknown vulnerability
16703| [133407] Apache Tomcat up to 7.0.93/8.5.39/9.0.17 on Windows JRE Command Line Argument Code Execution
16704| [133315] Apache Airflow up to 1.10.2 HTTP Endpoint cross site request forgery
16705| [133314] Apache Airflow up to 1.10.2 Metadata Database cross site scripting
16706| [133290] Apache Tomcat up to 8.5.37/9.0.14 HTTP2 Stream Execution denial of service
16707| [133112] Apache HTTP Server up to 2.4.38 mod_auth_digest race condition privilege escalation
16708| [133111] Apache HTTP Server 2.4.37/2.4.38 mod_ssl Bypass privilege escalation
16709| [133092] Airsonic 10.2.1 org.apache.commons.lang.RandomStringUtils RecoverController.java java.util.Random weak authentication
16710| [132568] Apache JSPWiki up to 2.11.0.M2 URL User information disclosure
16711| [132567] Apache JSPWiki up to 2.11.0.M2 URL cross site scripting
16712| [132566] Apache ActiveMQ up to 5.15.8 MQTT Frame Memory denial of service
16713| [132565] Apache HBase up to 2.1.3 REST Server Request privilege escalation
16714| [132183] Apache Mesos up to pre-1.4.x Docker Image Code Execution
16715| [131988] Apache Karaf up to 4.2.2 kar Deployer directory traversal
16716| [131859] Apache Hadoop up to 2.9.1 privilege escalation
16717| [131479] Apache Solr up to 7.6 HTTP GET Request Server-Side Request Forgery
16718| [131446] Apache Solr up to 5.0.5/6.6.5 Config API HTTP POST Request Code Execution
16719| [131385] Apache Qpid Broker-J up to 6.x/7.0.6/7.1.0 AMQP Command Crash denial of service
16720| [131315] Apache Mesos up to pre-1.4.x Mesos Masters Rendering JSON Payload Recursion denial of service
16721| [131236] Apache Airflow up to 1.10.1 Metadata Database cross site scripting
16722| [130755] Apache JSPWiki up to 2.10.5 URL cross site scripting
16723| [130629] Apache Guacamole Cookie Flag weak encryption
16724| [130628] Apache Hadoop up to 3.0.0 HDFS information disclosure
16725| [130529] Apache Subversion 1.10.0/1.10.1/1.10.2/1.10.3/1.11.0 mod_dav_svn Directory Crash denial of service
16726| [130353] Apache Open Office up to 4.1.5 Document Loader String memory corruption
16727| [130341] Apache HTTP Server 2.4.37 mod_ssl Loop denial of service
16728| [130330] Apache HTTP Server up to 2.4.37 mod_session Expired privilege escalation
16729| [130329] Apache HTTP Server 2.4.37 mod_http2 Slowloris denial of service
16730| [130212] Apache Airflow up to 1.10.0 LDAP Auth Backend Certificate weak authentication
16731| [130123] Apache Airflow up to 1.8.2 information disclosure
16732| [130122] Apache Airflow up to 1.8.2 command injection cross site request forgery
16733| [130121] Apache Airflow up to 1.8.2 Webserver Object Code Execution
16734| [129717] Oracle Secure Global Desktop 5.4 Apache HTTP Server denial of service
16735| [129688] Oracle Tape Library ACSLS 8.4 Apache Log4j unknown vulnerability
16736| [129673] Oracle Retail Returns Management 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
16737| [129672] Oracle Retail Central Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
16738| [129671] Oracle Retail Back Office 13.3/13.4/14.0/14.1 Apache Commons Fileupload unknown vulnerability
16739| [129574] Oracle Outside In Technology 8.5.3/8.5.4 Apache Tomcat denial of service
16740| [129573] Oracle WebLogic Server 10.3.6.0 Apache HTTP Server denial of service
16741| [129563] Oracle Enterprise Repository 12.1.3.0.0 Apache Log4j unknown vulnerability
16742| [129555] Oracle Outside In Technology 8.5.3 Apache Batik denial of service
16743| [129551] Oracle Outside In Technology 8.5.3/8.5.4 Apache Commons FileUpload denial of service
16744| [129542] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
16745| [129538] Oracle SOA Suite 12.1.3.0.0/12.2.1.3.0 Apache Batik unknown vulnerability
16746| [129519] Oracle Enterprise Manager Ops Center 12.2.2/12.3.3 Apache ActiveMQ unknown vulnerability
16747| [129508] Oracle Applications Manager up to 12.2.8 Apache Derby unknown vulnerability
16748| [129507] Oracle Mobile Field Service up to 12.2.8 Apache Log4j unknown vulnerability
16749| [129505] Oracle Email Center up to 12.2.8 Apache Log4j unknown vulnerability
16750| [129504] Oracle CRM Technical Foundation up to 12.2.8 Apache Commons FileUpload unknown vulnerability
16751| [129499] Oracle Partner Management up to 12.2.8 Apache Log4j unknown vulnerability
16752| [129498] Oracle Marketing up to 12.2.8 Apache Commons FileUpload unknown vulnerability
16753| [129480] Oracle Communications WebRTC Session Controller up to 7.1 Apache Batik unknown vulnerability
16754| [129479] Oracle Communications Diameter Signaling Router up to 8.2 Apache Batik unknown vulnerability
16755| [129474] Oracle Communications Diameter Signaling Router up to 8.2 Apache HTTP Server information disclosure
16756| [129472] Oracle Communications WebRTC Session Controller up to 7.1 Apache Struts 1 unknown vulnerability
16757| [129470] Oracle Communications Converged Application Server up to 7.0.0.0 Apache Struts 1 unknown vulnerability
16758| [129463] Oracle Communications WebRTC Session Controller up to 7.1 Apache Log4j unknown vulnerability
16759| [129461] Oracle Communications Services Gatekeeper up to 6.1.0.3.x Apache Commons Collections Fileupload unknown vulnerability
16760| [129460] Oracle Communications Service Broker 6.0 Apache Log4j unknown vulnerability
16761| [129459] Oracle Communications Policy Management up to 12.4 Apache Struts 2 unknown vulnerability
16762| [129458] Oracle Communications Online Mediation Controller 6.1 Apache Log4j unknown vulnerability
16763| [129457] Oracle Communications Diameter Signaling Router up to 8.2 Apache Commons Fileupload unknown vulnerability
16764| [129456] Oracle Communications Converged Application Server 6.1 Apache Log4j unknown vulnerability
16765| [128714] Apache Thrift Java Client Library up to 0.11.0 SASL Negotiation org.apache.thrift.transport.TSaslTransport unknown vulnerability
16766| [128713] Apache Thrift Node.js Static Web Server up to 0.11.0 directory traversal
16767| [128709] Apache Karaf up to 4.1.6/4.2.1 Features Deployer XMLInputFactory XML External Entity
16768| [128575] Apache NetBeans 9.0 Proxy Auto-Config Code Execution
16769| [128369] Apache Tika 1.8-1.19.1 SQLite3Parser Loop sql injection
16770| [128111] Apache NiFi 1.8.0 Template Upload Man-in-the-Middle cross site request forgery
16771| [128110] Apache NiFi 1.8.0 Cluster Request privilege escalation
16772| [128109] Apache NiFi 1.8.0 Error Page message-page.jsp Request Header cross site scripting
16773| [128108] Apache NiFi up to 1.7.x X-Frame-Options Header privilege escalation
16774| [128102] Apache Oozie up to 5.0.0 Workflow XML Impersonation spoofing
16775| [127994] WordPress up to 5.0.0 on Apache httpd MIME Restriction cross site scripting
16776| [127981] Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04 HTTP Engine httpService GET Request privilege escalation
16777| [127161] Apache Hadoop 2.7.4/2.7.5/2.7.6 Incomplete Fix CVE-2016-6811 privilege escalation
16778| [127040] Loadbalancer.org Enterprise VA MAX up to 8.3.2 Apache HTTP Server Log cross site scripting
16779| [127007] Apache Spark Request Code Execution
16780| [126791] Apache Hadoop up to 0.23.11/2.7.6/2.8.4/2.9.1/3.0.2 ZIP File unknown vulnerability
16781| [126767] Apache Qpid Proton-J Transport 0.3 Certificate Verification Man-in-the-Middle weak authentication
16782| [126896] Apache Commons FileUpload 1.3.3 on LDAP Manager DiskFileItem File privilege escalation
16783| [126574] Apache Hive up to 2.3.3/3.1.0 Query privilege escalation
16784| [126573] Apache Hive up to 2.3.3/3.1.0 HiveServer2 privilege escalation
16785| [126564] Apache Superset up to 0.22 Pickle Library load Code Execution
16786| [126488] Apache Syncope up to 2.0.10/2.1.1 BPMN Definition xxe privilege escalation
16787| [126487] Apache Syncope up to 2.0.10/2.1.1 cross site scripting
16788| [126346] Apache Tomcat Path privilege escalation
16789| [125922] Apache Impala up to 3.0.0 ALTER privilege escalation
16790| [125921] Apache Impala up to 3.0.0 Queue Injection privilege escalation
16791| [125647] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Install (Apache Tomcat) information disclosure
16792| [125617] Oracle Retail Returns Management 14.1 Apache Batik unknown vulnerability
16793| [125616] Oracle Retail Point-of-Service 13.4/14.0/14.1 Apache Batik unknown vulnerability
16794| [125614] Oracle Retail Central Office 14.1 Apache Batik unknown vulnerability
16795| [125613] Oracle Retail Back Office 13.3/13.4/14/14.1 Apache Batik unknown vulnerability
16796| [125599] Oracle Retail Open Commerce Platform 5.3.0/6.0.0/6.0.1 Apache Log4j unknown vulnerability
16797| [125569] Oracle PeopleSoft Enterprise PeopleTools 8.55/8.56 Apache HTTP Server information disclosure
16798| [125494] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat information disclosure
16799| [125447] Oracle Business Intelligence Enterprise Edition 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Batik unknown vulnerability
16800| [125428] Oracle Identity Management Suite 11.1.2.3.0/12.2.1.3.0 Apache Log4j unknown vulnerability
16801| [125427] Oracle Identity Analytics 11.1.1.5.8 Apache Log4j unknown vulnerability
16802| [125424] Oracle API Gateway 11.1.2.4.0 Apache Log4j unknown vulnerability
16803| [125423] Oracle BI Publisher 11.1.1.7.0/11.1.1.9.0/12.2.1.3.0/12.2.1.4.0 Apache Log4j unknown vulnerability
16804| [125383] Oracle up to 10.2.0 Apache Trinidad unknown vulnerability
16805| [125379] Oracle up to 10.1.x Apache Struts 1 cross site scripting
16806| [125377] Oracle up to 10.2.0 Apache Commons Collections unknown vulnerability
16807| [125376] Oracle Communications Application Session Controller up to 3.7.0 Apache Commons Collections unknown vulnerability
16808| [125375] Oracle Communications User Data Repository up to 12.1.x Apache Xerces memory corruption
16809| [125248] Apache ActiveMQ up to 5.15.5 Web-based Administration Console queue.jsp Parameter cross site scripting
16810| [125133] Apache Tika up to 1.19 XML Parser reset() denial of service
16811| [124877] Apache PDFbox up to 2.0.11 PDF File denial of service
16812| [124876] Apache Ranger up to 1.1.x UnixAuthenticationService Stack-based memory corruption
16813| [124791] Apache Tomcat up to 7.0.90/8.5.33/9.0.11 URL Open Redirect
16814| [124787] Apache Pony Mail 0.7/0.8/0.9 Statistics Generator Timestamp Data information disclosure
16815| [124447] Apache HTTP Server up to 2.4.34 SETTINGS Frame denial of service
16816| [124346] Apache Mesos pre-1.4.2/1.5.0/1.5.1/1.6.0 on Executor HTTP API String Comparison validation JSON Web Token information disclosure
16817| [124286] Apache Tika up to 1.18 IptcAnpaParser Loop denial of service
16818| [124242] Apache Tika up to 0.18 C:/evil.bat" Directory unknown vulnerability
16819| [124241] Apache Tika up to 0.18 XML Parser Entity Expansion denial of service
16820| [124191] Apache Karaf up to 3.0.8/4.0.8/4.1.0 WebConsole .../gogo/ weak authentication
16821| [124190] Apache Karaf up to 4.1.x sshd privilege escalation
16822| [124152] Apache Camel Mail up to 2.22.0 Path directory traversal
16823| [124143] Apache SpamAssassin up to 3.4.1 PDFInfo Plugin Code Execution
16824| [124134] Apache SpamAssassin up to 3.4.1 Scan Engine HTML::Parser Email denial of service
16825| [124095] PHP up to 5.6.37/7.0.31/7.1.21/7.2.9 Apache2 sapi_apache2.c php_handler cross site scripting
16826| [124024] Apache Mesos 1.4.x/1.5.0 libprocess JSON Payload denial of service
16827| [123814] Apache ActiveMQ Client up to 5.15.5 TLS Hostname Verification Man-in-the-Middle weak authentication
16828| [123393] Apache Traffic Server up to 6.2.2/7.1.3 ESI Plugin Config privilege escalation
16829| [123392] Apache Traffic Server 6.2.2 TLS Handshake Segmentation Fault denial of service
16830| [123391] Apache Traffic Server up to 6.2.2/7.1.3 Range Request Performance denial of service
16831| [123390] Apache Traffic Server up to 6.2.2/7.1.3 Request HTTP Smuggling privilege escalation
16832| [123369] Apache Traffic Server up to 6.2.2/7.1.3 ACL remap.config Request denial of service
16833| [123197] Apache Sentry up to 2.0.0 privilege escalation
16834| [123145] Apache Struts up to 2.3.34/2.5.16 Namespace Code Execution
16835| [123144] Apache Cayenne up to 4.1.M1 CayenneModeler XML File File Transfer privilege escalation
16836| [122981] Apache Commons Compress 1.7 ZipArchiveInputStream ZIP Archive denial of service
16837| [122889] Apache HTTP Server up to 2.2.31/2.4.23 mod_userdir HTTP Response Splitting privilege escalation
16838| [122800] Apache Spark 1.3.0 REST API weak authentication
16839| [122642] Apache Airflow up to 1.8.x 404 Page Reflected cross site scripting
16840| [122568] Apache Tomcat up to 8.5.31/9.0.9 Connection Reuse weak authentication
16841| [122567] Apache Axis 1.0./1.1/1.2/1.3/1.4 cross site scripting
16842| [122556] Apache Tomcat up to 7.0.86/8.0.51/8.5.30/9.0.7 UTF-8 Decoder Loop denial of service
16843| [122531] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.9 WebSocket Client unknown vulnerability
16844| [122456] Apache Camel up to 2.20.3/2.21.0 XSD Validator XML External Entity
16845| [122455] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Revoked Certificate weak authentication
16846| [122454] Apache Tomcat Native up to 1.1.34/1.2.16 OSCP Responder Revoked Certificate weak authentication
16847| [122214] Apache Kafka up to 0.9.0.1/0.10.2.1/0.11.0.2/1.0.0 Broker Request Data Loss denial of service
16848| [122202] Apache Kafka up to 0.10.2.1/0.11.0.1 SASL Impersonation spoofing
16849| [122101] Docker Skeleton Runtime for Apache OpenWhisk Docker Action dockerskeleton:1.3.0 privilege escalation
16850| [122100] PHP Runtime for Apache OpenWhisk Docker Action action-php-v7.2:1.0.0 privilege escalation
16851| [122012] Apache Ignite up to 2.5 Serialization privilege escalation
16852| [121911] Apache Ambari up to 2.5.x/2.6.2 Log Message Credentials information disclosure
16853| [121910] Apache HTTP Server 2.4.33 mod_md HTTP Requests denial of service
16854| [121854] Oracle Tape Library ACSLS up to ACSLS 8.4.0-2 Apache Commons Collections unknown vulnerability
16855| [121752] Oracle Insurance Policy Administration 10.0/10.1/10.2/11.0 Apache Log4j unknown vulnerability
16856| [121370] Apache Spark up to 2.1.2/2.2.1/2.3.0 URL cross site scripting
16857| [121354] Apache CouchDB HTTP API Code Execution
16858| [121144] Apache LDAP API up to 1.0.1 SSL Filter information disclosure
16859| [121143] Apache storm up to 0.10.2/1.0.6/1.1.2/1.2.1 Cluster privilege escalation
16860| [120436] Apache CXF Fediz up to 1.4.3 Application Plugin unknown vulnerability
16861| [120310] Apache PDFbox up to 1.8.14/2.0.10 AFMParser Loop denial of service
16862| [120168] Apache CXF weak authentication
16863| [120080] Apache Cassandra up to 3.11.1 JMX/RMI Interface RMI Request privilege escalation
16864| [120043] Apache HBase up to 1.2.6.0/1.3.2.0/1.4.4/2.0.0 Thrift 1 API Server weak authentication
16865| [119723] Apache Qpid Broker-J 7.0.0/7.0.1/7.0.2/7.0.3/7.0.4 AMQP Messages Crash denial of service
16866| [122569] Apache HTTP Server up to 2.4.33 HTTP2 Request denial of service
16867| [119486] Apache Geode up to 1.4.0 Security Manager Code Execution
16868| [119306] Apache MXNet Network Interface privilege escalation
16869| [118999] Apache Storm up to 1.0.6/1.1.2/1.2.1 Archive directory traversal
16870| [118996] Apache Storm up to 1.0.6/1.1.2/1.2.1 Daemon spoofing
16871| [118644] Apple macOS up to 10.13.5 apache_mod_php unknown vulnerability
16872| [118200] Apache Batik up to 1.9 Deserialization unknown vulnerability
16873| [118143] Apache NiFi activemq-client Library Deserialization denial of service
16874| [118142] Apache NiFi 1.6.0 SplitXML xxe privilege escalation
16875| [118051] Apache Zookeeper up to 3.4.9/3.5.3-beta weak authentication
16876| [117997] Apache ORC up to 1.4.3 ORC File Recursion denial of service
16877| [117825] Apache Tomcat up to 7.0.88/8.0.52/8.5.31/9.0.8 CORS Filter privilege escalation
16878| [117405] Apache Derby up to 10.14.1.0 Network Server Network Packet privilege escalation
16879| [117347] Apache Ambari up to 2.6.1 HTTP Request directory traversal
16880| [117265] LibreOffice/Apache Office Writer SMB Connection XML Document information disclosure
16881| [117143] Apache uimaj/uima-as/uimaFIT/uimaDUCC XML XXE information disclosure
16882| [117117] Apache Tika up to 1.17 ChmParser Loop denial of service
16883| [117116] Apache Tika up to 1.17 BPGParser Loop denial of service
16884| [117115] Apache Tika up to 1.17 tika-server command injection
16885| [116929] Apache Fineract getReportType Parameter privilege escalation
16886| [116928] Apache Fineract REST Endpoint Parameter privilege escalation
16887| [116927] Apache Fineract MakercheckersApiResource Parameter sql injection
16888| [116926] Apache Fineract REST Hand Parameter privilege escalation
16889| [116574] Apache wicket-jquery-ui up to 6.29.0/7.10.1/8.0.0-M9.1 WYSIWYG Editor privilege escalation
16890| [116622] Oracle Enterprise Manager for MySQL Database 12.1.0.4 EM Plugin: General (Apache Tomcat) unknown vulnerability
16891| [115931] Apache Solr up to 6.6.2/7.2.1 XML Data Parameter XML External Entity
16892| [115883] Apache Hive up to 2.3.2 privilege escalation
16893| [115882] Apache Hive up to 2.3.2 xpath_short information disclosure
16894| [115881] Apache DriverHive JDBC Driver up to 2.3.2 Escape Argument Bypass privilege escalation
16895| [115518] Apache Ignite 2.3 Deserialization privilege escalation
16896| [115260] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache cross site scripting
16897| [115259] EMC RSA Authentication Agent for Web up to 8.0.1 on IIS/Apache Cookie Stack-based memory corruption
16898| [115500] CA Workload Control Center up to r11.4 SP5 Apache MyFaces Component Code Execution
16899| [115121] Apache Struts REST Plugin up to 2.5.15 Xstream XML Data denial of service
16900| [115061] Apache HTTP Server up to 2.4.29 HTTP Digest Authentication Challenge HTTP Requests Replay privilege escalation
16901| [115060] Apache HTTP Server up to 2.4.29 mod_cache_socache Request Header Crash denial of service
16902| [115059] Apache HTTP Server up to 2.4.29 HTTP2 NULL Pointer Dereference denial of service
16903| [115058] Apache HTTP Server up to 2.4.29 HTTP Header Crash denial of service
16904| [115057] Apache HTTP Server up to 2.4.29 mod_session Variable Name Cache privilege escalation
16905| [115039] Apache HTTP Server up to 2.4.29 FilesMatch File Upload privilege escalation
16906| [115038] Apache HTTP Server up to 2.0.65/2.2.34/2.4.29 mod_authnz_ldap Crash denial of service
16907| [114817] Apache Syncope up to 1.2.10/2.0.7 Search Parameter information disclosure
16908| [114816] Apache Syncope up to 1.2.10/2.0.7 XSLT Code Execution
16909| [114717] Apache Commons 1.11/1.12/1.13/1.14/1.15 ZIP Archive ZipFile/ZipArchiveInputStream denial of service
16910| [114661] Apache Allura up to 1.8.0 HTTP Response Splitting privilege escalation
16911| [114400] Apache Tomcat JK ISAPI Connector up to 1.2.42 IIS/ISAPI privilege escalation
16912| [114258] Apache HTTP Server up to 2.4.22 mod_cluster Segmentation Fault denial of service
16913| [114086] Apache ODE 1.3.3 ODE Process Deployment Web Service directory traversal
16914| [113955] Apache Xerces-C up to 3.2.0 XML Parser NULL Pointer Dereference denial of service
16915| [113945] Apache Tomcat up to 7.0.84/8.0.49/8.5.27/9.0.4 URL Pattern Empty String privilege escalation
16916| [113944] Apache OpenMeetings up to 3.x/4.0.1 CRUD Operation denial of service
16917| [113905] Apache Traffic Server up to 5.2.x/5.3.2/6.2.0/7.0.0 TLS Handshake Core Dump denial of service
16918| [113904] Apache Traffic Server up to 6.2.0 Host Header privilege escalation
16919| [113895] Apache Geode up to 1.3.x Code Execution
16920| [113894] Apache Geode up to 1.3.x TcpServer Code Execution
16921| [113888] Apache James Hupa WebMail 0.0.2 cross site scripting
16922| [113813] Apache Geode Cluster up to 1.3.x Secure Mode privilege escalation
16923| [113747] Apache Tomcat Servlets privilege escalation
16924| [113647] Apache Qpid up to 0.30 qpidd Broker AMQP Message Crash denial of service
16925| [113645] Apache VCL up to 2.1/2.2.1/2.3.1 Web GUI/XMLRPC API privilege escalation
16926| [113560] Apache jUDDI Console 3.0.0 Log Entries spoofing
16927| [113571] Apache Oozie up to 4.3.0/5.0.0-beta1 XML Data XML File privilege escalation
16928| [113569] Apache Karaf up to 4.0.7 LDAPLoginModule LDAP injection denial of service
16929| [113273] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
16930| [113198] Apache Qpid Dispatch Router 0.7.0/0.8.0 AMQP denial of service
16931| [113186] Apache JMeter 2.x/3.x Distributed Test Only privilege escalation
16932| [113145] Apache Thrift up to 0.9.3 Go Client Library privilege escalation
16933| [113106] Apache jUDDI up to 3.3.3 XML Data WADL2Java/WSDL2Java XML Document privilege escalation
16934| [113105] Apache Qpid Broker-J 7.0.0 AMQP Crash denial of service
16935| [112885] Apache Allura up to 1.8.0 File information disclosure
16936| [112856] Apache CloudStack up to 4.8.1.0/4.9.0.0 API weak authentication
16937| [112855] Apache CloudStack 4.1.0/4.1.1 API information disclosure
16938| [112678] Apache Tomcat up to 7.0.82/8.0.47/8.5.23/9.0.1 Bug Fix 61201 privilege escalation
16939| [112677] Apache Tomcat Native Connector up to 1.1.34/1.2.14 OCSP Checker Client weak authentication
16940| [112625] Apache POI up to 3.16 Loop denial of service
16941| [112448] Apache NiFi up to 1.3.x Deserialization privilege escalation
16942| [112396] Apache Hadoop 2.7.3/2.7.4 YARN NodeManager Credentials information disclosure
16943| [112339] Apache NiFi 1.5.0 Header privilege escalation
16944| [112330] Apache NiFi 1.5.0 Header HTTP Request privilege escalation
16945| [112314] NetGain Enterprise Manager 7.2.730 Build 1034 org.apache.jsp.u.jsp.tools.exec_jsp Servlet Parameter privilege escalation
16946| [112253] Apache Hadoop up to 0.23.x/2.7.4/2.8.2 MapReduce Job History Server Configuration File privilege escalation
16947| [112171] Oracle Secure Global Desktop 5.3 Apache Log4j privilege escalation
16948| [112164] Oracle Agile PLM 9.3.5/9.3.6 Apache Tomcat unknown vulnerability
16949| [112161] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Tomcat privilege escalation
16950| [112158] Oracle Autovue for Agile Product Lifecycle Management 21.0.0/21.0.1 Apache Log4j privilege escalation
16951| [112156] Oracle Agile PLM 9.3.3/9.3.4/9.3.5/9.3.6 Apache Log4j privilege escalation
16952| [112155] Oracle Agile Engineering Data Management 6.1.3/6.2.0/6.2.1 Apache Log4j privilege escalation
16953| [112137] Oracle MICROS Relate CRM Software 10.8.x/11.4.x/15.0.x, Apache Tomcat unknown vulnerability
16954| [112136] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat privilege escalation
16955| [112133] Oracle Retail Workforce Management 1.60.7/1.64.0 Apache Log4j privilege escalation
16956| [112129] Oracle Retail Assortment Planning 14.1.3/15.0.3/16.0.1 Apache Log4j privilege escalation
16957| [112114] Oracle 9.1 Apache Log4j privilege escalation
16958| [112113] Oracle 9.1 Apache Log4j privilege escalation
16959| [112045] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat privilege escalation
16960| [112038] Oracle Health Sciences Empirica Inspections 1.0.1.1 Apache Tomcat information disclosure
16961| [112019] Oracle Endeca Information Discovery Integrator 3.1.0/3.2.0 Apache Tomcat privilege escalation
16962| [112017] Oracle WebCenter Portal 11.1.1.9.0/12.2.1.2.0/12.2.1.3.0 Apache Struts 1 cross site scripting
16963| [112011] Oracle Identity Manager 11.1.2.3.0 Apache Commons Collections privilege escalation
16964| [111950] Oracle Database 12.2.0.1 Apache Tomcat information disclosure
16965| [111703] Apache Sling XSS Protection API 1.0.4 URL Encoding cross site scripting
16966| [111556] Apache Geode up to 1.2.x Secure Mode Parameter OQL privilege escalation
16967| [111555] Apache Geode up to 1.2.x Secure Mode OQL privilege escalation
16968| [111540] Apache Geode up to 1.2.x Secure Mode information disclosure
16969| [111519] Apache Sling JCR ContentLoader 2.1.4 xmlreader directory traversal
16970| [111338] Apache DeltaSpike-JSF 1.8.0 cross site scripting
16971| [111330] Apache OFBiz 16.11.01/16.11.02/16.11.03 BIRT Plugin cross site scripting
16972| [110789] Apache Sling up to 1.4.0 Authentication Service Credentials information disclosure
16973| [110785] Apache Drill up to 1.11.0 Query Page unknown vulnerability
16974| [110701] Apache Fineract Query Parameter sql injection
16975| [110484] Apache Synapse up to 3.0.0 Apache Commons Collections Serialized Object Code Injection privilege escalation
16976| [110426] Adobe Experience Manager 6.0/6.1/6.2/6.3 Apache Sling Servlets Post cross site scripting
16977| [110393] Apple macOS up to 10.13.2 apache information disclosure
16978| [110141] Apache Struts up to 2.5.14 REST Plugin denial of service
16979| [110140] Apache Qpid Broker-J up to 0.32 privilege escalation
16980| [110139] Apache Qpid Broker-J up to 6.1.4 AMQP Frame denial of service
16981| [110106] Apache CXF Fediz Spring cross site request forgery
16982| [109766] Apache OpenOffice up to 4.1.3 DOC File Parser WW8Fonts memory corruption
16983| [109750] Apache OpenOffice up to 4.1.3 DOC File Parser ImportOldFormatStyles memory corruption
16984| [109749] Apache OpenOffice up to 4.1.3 PPT File Parser PPTStyleSheet memory corruption
16985| [109606] October CMS Build 412 Apache Configuration File Upload privilege escalation
16986| [109419] Apache Camel up to 2.19.3/2.20.0 camel-castor Java Object Deserialization privilege escalation
16987| [109418] Apache Camel up to 2.19.3/2.20.0 camel-hessian Java Object Deserialization privilege escalation
16988| [109400] Apache CouchDB up to 1.6.x/2.1.0 Database Server Shell privilege escalation
16989| [109399] Apache CouchDB up to 1.6.x/2.1.0 JSON Parser Shell privilege escalation
16990| [109398] Apache CXF 3.1.14/3.2.1 JAX-WS/JAX-RS Attachment denial of service
16991| [108872] Apache Hive up to 2.1.1/2.2.0/2.3.0 Policy Enforcement privilege escalation
16992| [108939] Apple macOS up to 10.13.1 apache unknown vulnerability
16993| [108938] Apple macOS up to 10.13.1 apache denial of service
16994| [108937] Apple macOS up to 10.13.1 apache unknown vulnerability
16995| [108936] Apple macOS up to 10.13.1 apache unknown vulnerability
16996| [108935] Apple macOS up to 10.13.1 apache denial of service
16997| [108934] Apple macOS up to 10.13.1 apache unknown vulnerability
16998| [108933] Apple macOS up to 10.13.1 apache unknown vulnerability
16999| [108932] Apple macOS up to 10.13.1 apache unknown vulnerability
17000| [108931] Apple macOS up to 10.13.1 apache denial of service
17001| [108930] Apple macOS up to 10.13.1 apache unknown vulnerability
17002| [108929] Apple macOS up to 10.13.1 apache denial of service
17003| [108928] Apple macOS up to 10.13.1 apache unknown vulnerability
17004| [108797] Apache Struts up to 2.3.19 TextParseUtiltranslateVariables OGNL Expression privilege escalation
17005| [108795] Apache Traffic Server up to 5.3.0 HTTP2 set_dynamic_table_size memory corruption
17006| [108794] Apache WSS4J up to 1.6.16/2.0.1 Incomplete Fix Leak information disclosure
17007| [108793] Apache Qpid up to 0.30 qpidd Crash denial of service
17008| [108792] Apache Traffic Server up to 5.1.0 Access Restriction privilege escalation
17009| [108791] Apache Wicket up to 1.5.11/6.16.x/7.0.0-M2 Session information disclosure
17010| [108790] Apache storm 0.9.0.1 Log Viewer directory traversal
17011| [108789] Apache Cordova In-App-Browser Standalone Plugin up to 0.3.1 on iOS CDVInAppBrowser privilege escalation
17012| [108788] Apache Cordova File-Transfer Standalone Plugin up to 0.4.1 on iOS ios/CDVFileTransfer.m spoofing
17013| [108787] Apache HttpClient up to 4.3.0 HttpClientBuilder.java unknown vulnerability
17014| [108786] Apache Wicket up to 1.4.21/1.5.9/6.3.x script Tag cross site scripting
17015| [108783] Apache Hadoop up to 0.23.3/1.0.3/2.0.1 Kerberos Security Feature Key weak encryption
17016| [108782] Apache Xerces2 XML Service denial of service
17017| [108781] Apache jUDDI up to 1.x happyjuddi.jsp Parameter cross site scripting
17018| [108780] Apache jUDDI up to 1.x Log File uddiget.jsp spoofing
17019| [108709] Apache Cordova Android up to 3.7.1/4.0.1 intent URL privilege escalation
17020| [108708] Apache ActiveMQ up to 5.10.0 XML Data XML External Entity
17021| [108707] Apache ActiveMQ up to 1.7.0 XML Data XML External Entity
17022| [108629] Apache OFBiz up to 10.04.01 privilege escalation
17023| [108543] Apache Derby 10.1.2.1/10.2.2.0/10.3.1.4/10.4.1.3 Export File privilege escalation
17024| [108312] Apache HTTP Server on RHEL IP Address Filter privilege escalation
17025| [108297] Apache NiFi up to 0.7.1/1.1.1 Proxy Chain Username Deserialization privilege escalation
17026| [108296] Apache NiFi up to 0.7.1/1.1.1 Cluster Request privilege escalation
17027| [108250] Oracle Secure Global Desktop 5.3 Apache HTTP Server memory corruption
17028| [108245] Oracle Transportation Management up to 6.3.7 Apache Tomcat unknown vulnerability
17029| [108244] Oracle Transportation Management 6.4.1/6.4.2 Apache Commons FileUpload denial of service
17030| [108243] Oracle Agile Engineering Data Management 6.1.3/6.2.0 Apache Commons Collections memory corruption
17031| [108222] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Batik denial of service
17032| [108219] Oracle MICROS Retail XBRi Loss Prevention up to 10.8.1 Apache Tomcat unknown vulnerability
17033| [108217] Oracle Retail Store Inventory Management 13.2.9/14.0.4/14.1.3/15.0.1/16.0.1 Apache Groovy unknown vulnerability
17034| [108216] Oracle Retail Convenience and Fuel POS Software 2.1.132 Apache Groovy unknown vulnerability
17035| [108169] Oracle MySQL Enterprise Monitor up to 3.2.8.2223/3.3.4.3247/3.4.2.4181 Apache Tomcat unknown vulnerability
17036| [108113] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Batik denial of service
17037| [108107] Oracle Hospitality Guest Access 4.2.0/4.2.1 Apache Tomcat unknown vulnerability
17038| [108102] Oracle Healthcare Master Person Index 4.x Apache Groovy unknown vulnerability
17039| [108085] Oracle Identity Manager 11.1.2.3.0 Apache Struts 1 memory corruption
17040| [108083] Oracle API Gateway 11.1.2.4.0 Apache Batik denial of service
17041| [108080] Oracle GlassFish Server 3.1.2 Apache Commons FileUpload denial of service
17042| [108069] Oracle Endeca Information Discovery Integrator 2.4/3.0/3.1/3.2 Apache Commons Collections memory corruption
17043| [108067] Oracle Business Process Management Suite 11.1.1.9.0/12.2.1.1.0 Apache Commons Collections memory corruption
17044| [108066] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Tomcat memory corruption
17045| [108065] Oracle Management Pack for GoldenGate 11.2.1.0.12 Apache Commons Collections memory corruption
17046| [108062] Oracle BI Publisher 11.1.1.7.0/12.2.1.1.0/12.2.1.2.0 Apache ActiveMQ memory corruption
17047| [108060] Oracle Enterprise Manager Ops Center 12.2.2/12.3.2 Apache Groovy unknown vulnerability
17048| [108033] Oracle Primavera Unifier 9.13/9.14/10.x/15.x/16.x, Apache Groovy unknown vulnerability
17049| [108024] Oracle Communications Order and Service Management 7.2.4.x.x/7.3.0.x.x/7.3.1.x.x/7.3.5.x.x Apache Commons Collections memory corruption
17050| [108015] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Commons Collections memory corruption
17051| [108013] Oracle Communications WebRTC Session Controller 7.0/7.1/7.2 Apache Groovy unknown vulnerability
17052| [108011] Oracle Communications Services Gatekeeper 5.1/6.0 Apache Trinidad unknown vulnerability
17053| [107904] Apache Struts up to 2.3.28 Double OGNL Evaluation privilege escalation
17054| [107860] Apache Solr up to 7.0 Apache Lucene RunExecutableListener XML External Entity
17055| [107834] Apache Ranger up to 0.6.1 Change Password privilege escalation
17056| [107639] Apache NiFi 1.4.0 XML External Entity
17057| [107606] Apache ZooKeper up to 3.4.9/3.5.2 Command CPU Exhaustion denial of service
17058| [107597] Apache Roller up to 5.0.2 XML-RPC Protocol Support XML External Entity
17059| [107429] Apache Impala up to 2.9.x Kudu Table privilege escalation
17060| [107411] Apache Tomcat up to 7.0.81/8.0.46/8.5.22/9.0.0 JSP File File Upload privilege escalation
17061| [107385] Apache Geode up to 1.2.0 Secure Mode privilege escalation
17062| [107339] Apache OpenNLP up to 1.5.3/1.6.0/1.7.2/1.8.1 XML Data XML External Entity
17063| [107333] Apache Wicket up to 8.0.0-M1 CSRF Prevention HTTP Header privilege escalation
17064| [107323] Apache Wicket 1.5.10/6.13.0 Class Request information disclosure
17065| [107310] Apache Geode up to 1.2.0 Command Line Utility Query privilege escalation
17066| [107276] ArcSight ESM/ArcSight ESM Express up to 6.9.1c Patch 3/6.11.0 Apache Tomcat Version information disclosure
17067| [107266] Apache Tika up to 1.12 XML Parser XML External Entity
17068| [107262] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
17069| [107258] Apache Mesos up to 1.1.2/1.2.1/1.3.0/1.4.0-dev libprocess HTTP Request Crash denial of service
17070| [107197] Apache Xerces Jelly Parser XML File XML External Entity
17071| [107193] ZTE NR8950 Apache Commons Collections RMI Request Deserialization privilege escalation
17072| [107084] Apache Struts up to 2.3.19 cross site scripting
17073| [106877] Apache Struts up to 2.0.33/2.5.10 Freemarker Tag privilege escalation
17074| [106875] Apache Struts up to 2.5.5 URL Validator denial of service
17075| [106874] Apache Struts up to 2.3.30 Convention Plugin directory traversal
17076| [106847] Apache Tomcat up to 7.0.80 VirtualDirContext Source information disclosure
17077| [106846] Apache Tomcat up to 7.0.79 on Windows HTTP PUT Method Parameter File Upload privilege escalation
17078| [106777] Apache HTTP Server up to 2.2.34/2.4.27 Limit Directive ap_limit_section HTTP Request information disclosure
17079| [106739] puppetlabs-apache up to 1.11.0/2.0.x weak authentication
17080| [106720] Apache Wicket up to 1.5.12/6.18.x/7.0.0-M4 CryptoMapper privilege escalation
17081| [106586] Apache Brooklyn up to 0.9.x REST Server cross site scripting
17082| [106562] Apache Spark up to 2.1.1 Launcher API Deserialization privilege escalation
17083| [106559] Apache Brooklyn up to 0.9.x SnakeYAML YAML Data Java privilege escalation
17084| [106558] Apache Brooklyn up to 0.9.x REST Server cross site request forgery
17085| [106556] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
17086| [106555] Apache Traffic Server up to 5.3.1 HTTP2 unknown vulnerability
17087| [106171] Apache Directory LDAP API up to 1.0.0-M30 Timing unknown vulnerability
17088| [106167] Apache Struts up to 2.5.12 REST Plugin XML Data privilege escalation
17089| [106166] Apache Struts up to 2.3.33/2.5.12 REST Plugin denial of service
17090| [106165] Apache Struts up to 2.3.33/2.5.12 URLValidator Regex CPU Exhaustion denial of service
17091| [106115] Apache Hadoop up to 2.6.4/2.7.2 YARN NodeManager Password information disclosure
17092| [106012] Apache Solr up to 5.5.3/6.4.0 Replication directory traversal
17093| [105980] Apache Engine 16.11.01 Parameter Reflected unknown vulnerability
17094| [105962] Apache Atlas 0.6.0/0.7.0 Frame cross site scripting
17095| [105961] Apache Atlas 0.6.0/0.7.0 Stack Trace information disclosure
17096| [105960] Apache Atlas 0.6.0/0.7.0 Search Reflected cross site scripting
17097| [105959] Apache Atlas 0.6.0/0.7.0 edit Tag DOM cross site scripting
17098| [105958] Apache Atlas 0.6.0/0.7.0 edit Tag Stored cross site scripting
17099| [105957] Apache Atlas 0.6.0/0.7.0 Cookie privilege escalation
17100| [105905] Apache Atlas 0.6.0/0.7.0/0.7.1 /js privilege escalation
17101| [105878] Apache Struts up to 2.3.24.0 privilege escalation
17102| [105682] Apache2Triad 1.5.4 phpsftpd/users.php Parameter cross site scripting
17103| [105681] Apache2Triad 1.5.4 phpsftpd/users.php Request cross site request forgery
17104| [105680] Apache2Triad 1.5.4 Parameter Session Fixation weak authentication
17105| [105643] Apache Pony Mail up to 0.8b weak authentication
17106| [105288] Apache Sling up to 2.3.21 Sling.evalString() String cross site scripting
17107| [105219] Apache Tomcat up to 8.5.15/9.0.0.M21 HTTP2 Bypass directory traversal
17108| [105218] Apache Tomcat up to 7.0.78/8.0.44/8.5.15/9.0.0.M21 CORS Filter Cache Poisoning privilege escalation
17109| [105215] Apache CXF up to 3.0.12/3.1.9 OAuth2 Hawk/JOSE MAC Validation Timing unknown vulnerability
17110| [105206] Apache CXF up to 3.0.11/3.1.8 JAX-RS Module XML External Entity
17111| [105205] Apache CXF up to 3.0.11/3.1.8 HTTP Transport Module Parameter cross site scripting
17112| [105202] Apache Storm 1.0.0/1.0.1/1.0.2/1.0.3/1.1.0 Worker privilege escalation
17113| [104987] Apache Xerces-C++ XML Service CPU Exhaustion denial of service
17114| [104986] Apache CXF 2.4.5/2.5.1 WS-SP UsernameToken Policy SOAP Request weak authentication
17115| [104985] Apache MyFaces Core up to 2.1.4 EL Expression Parameter Injection information disclosure
17116| [104983] Apache Wink up to 1.1.1 XML Document xxe privilege escalation
17117| [104981] Apache Commons Email 1.0/1.1/1.2/1.3/1.4 Subject Linebreak SMTP privilege escalation
17118| [104591] MEDHOST Document Management System Apache Solr Default Credentials weak authentication
17119| [104062] Oracle MySQL Enterprise Monitor up to 3.3.3.1199 Apache Tomcat unknown vulnerability
17120| [104061] Oracle MySQL Enterprise Monitor up to 3.2.7.1204/3.3.3.1199 Apache Tomcat unknown vulnerability
17121| [104060] Oracle MySQL Enterprise Monitor up to 3.1.5.7958/3.2.5.1141/3.3.2.1162 Apache Struts 2 unknown vulnerability
17122| [103995] Oracle 8.3/8.4/15.1/15.2 Apache Trinidad unknown vulnerability
17123| [103993] Oracle Policy Automation up to 12.2.3 Apache Commons FileUplaod denial of service
17124| [103916] Oracle Banking Platform 2.3/2.4/2.4.1/2.5 Apache Commons FileUpload denial of service
17125| [103906] Oracle Communications BRM 11.2.0.0.0 Apache Commons Collections privilege escalation
17126| [103904] Oracle Communications BRM 11.2.0.0.0/11.3.0.0.0 Apache Groovy memory corruption
17127| [103866] Oracle Transportation Management 6.1/6.2 Apache Webserver unknown vulnerability
17128| [103816] Oracle BI Publisher 11.1.1.9.0/12.2.1.1.0/12.2.1.2.0 Apache Commons Fileupload denial of service
17129| [103797] Oracle Tuxedo System and Applications Monitor Apache Commons Collections privilege escalation
17130| [103792] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Commons Fileupload privilege escalation
17131| [103791] Oracle Endeca Server 7.6.0.0/7.6.1.0 Apache Commons Collections privilege escalation
17132| [103788] Oracle Enterprise Repository 11.1.1.7.0/12.1.3.0.0 Apache ActiveMQ memory corruption
17133| [103787] Oracle Enterprise Data Quality 8.1.13.0.0 Apache Groovy memory corruption
17134| [103763] Apache Sling up to 1.0.11 XSS Protection API XSS.getValidXML() Application XML External Entity
17135| [103762] Apache Sling up to 1.0.12 XSS Protection API XSSAPI.encodeForJSString() Script Tag cross site scripting
17136| [103693] Apache OpenMeetings 1.0.0 HTTP Method privilege escalation
17137| [103692] Apache OpenMeetings 1.0.0 Tomcat Error information disclosure
17138| [103691] Apache OpenMeetings 3.2.0 Parameter privilege escalation
17139| [103690] Apache OpenMeetings 1.0.0 sql injection
17140| [103689] Apache OpenMeetings 1.0.0 crossdomain.xml privilege escalation
17141| [103688] Apache OpenMeetings 1.0.0 weak encryption
17142| [103687] Apache OpenMeetings 1.0.0 cross site request forgery
17143| [103556] Apache Roller 5.1.0/5.1.1 Weblog Page Template VTL privilege escalation
17144| [103554] Apache OpenMeetings 1.0.0 Password Update unknown vulnerability
17145| [103553] Apache OpenMeetings 1.0.0 File Upload privilege escalation
17146| [103552] Apache OpenMeetings 3.2.0 Chat cross site scripting
17147| [103551] Apache OpenMeetings 3.1.0 XML unknown vulnerability
17148| [103521] Apache HTTP Server 2.4.26 HTTP2 Free memory corruption
17149| [103520] Apache HTTP Server up to 2.2.33/2.4.26 mod_auth_digest Authorization Header memory corruption
17150| [103519] Apache Struts up to 2.5.11/2.3.32 Spring AOP denial of service
17151| [103518] Apache Struts up to 2.5.11 URLValidator directory traversal
17152| [103492] Apache Spark up to 2.1.x Web UI Reflected cross site scripting
17153| [103401] Apache Struts 2.3.x Struts 1 Plugin ActionMessage privilege escalation
17154| [103399] Apache Traffic Control Traffic Router TCP Connection Slowloris denial of service
17155| [103387] Apache Impala up to 2.8.0 StatestoreSubscriber weak encryption
17156| [103386] Apache Impala up to 2.7.x/2.8.0 Kerberos weak authentication
17157| [103352] Apache Solr Node weak authentication
17158| [102897] Apache Ignite up to 2.0 Update Notifier information disclosure
17159| [102878] Code42 CrashPlan 5.4.x RMI Server org.apache.commons.ssl.rmi.DateRMI privilege escalation
17160| [102698] Apache HTTP Server up to 2.2.32/2.4.25 mod_mime Content-Type memory corruption
17161| [102697] Apache HTTP Server 2.2.32/2.2.24 HTTP Strict Parsing ap_find_token Request Header memory corruption
17162| [102690] Apache HTTP Server up to 2.2.32/2.4.25 mod_ssl ap_hook_process_connection() denial of service
17163| [102689] Apache HTTP Server up to 2.2.32/2.4.25 ap_get_basic_auth_pw weak authentication
17164| [102622] Apache Thrift up to 0.9.2 Client Libraries skip denial of service
17165| [102538] Apache Ranger up to 0.7.0 Authorizer unknown vulnerability
17166| [102537] Apache Ranger up to 0.7.0 Wildcard Character unknown vulnerability
17167| [102536] Apache Ranger up to 0.6 Stored cross site scripting
17168| [102535] Apache Ranger up to 0.6.2 Policy Engine unknown vulnerability
17169| [102255] Apache NiFi up to 0.7.3/1.2.x Response Header privilege escalation
17170| [102254] Apache NiFi up to 0.7.3/1.2.x UI cross site scripting
17171| [102070] Apache CXF Fediz up to 1.1.2/1.2.0 Application Plugin denial of service
17172| [102020] Apache Tomcat up to 9.0.0.M1 Java Servlet HTTP Method unknown vulnerability
17173| [101858] Apache Hive up to 1.2.1/2.0.0 Client weak authentication
17174| [101802] Apache KNOX up to 0.11.0 WebHDFS privilege escalation
17175| [101928] HPE Aruba ClearPass Apache Tomcat information disclosure
17176| [101524] Apache Archiva up to 1.x/2.2.1 REST Endpoint cross site request forgery
17177| [101513] Apache jUDDI 3.1.2/3.1.3/3.1.4/3.1. Logout Open Redirect
17178| [101430] Apache CXF Fediz up to 1.3.1 OIDC Service cross site request forgery
17179| [101429] Apache CXF Fediz up to 1.2.3/1.3.1 Plugins cross site request forgery
17180| [100619] Apache Hadoop up to 2.6.x HDFS Servlet unknown vulnerability
17181| [100618] Apache Hadoop up to 2.7.0 HDFS Web UI cross site scripting
17182| [100621] Adobe ColdFusion 10/11/2016 Apache BlazeDS Library Deserialization privilege escalation
17183| [100205] Oracle MySQL Enterprise Monitor up to 3.1.6.8003/3.2.1182/3.3.2.1162 Apache Commons FileUpload denial of service
17184| [100191] Oracle Secure Global Desktop 4.71/5.2/5.3 Web Server (Apache HTTP Server) information disclosure
17185| [100162] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Commons Collections privilege escalation
17186| [100160] Oracle StorageTek Tape Analytics SW Tool up to 2.2.0 Apache Trinidad unknown vulnerability
17187| [99969] Oracle WebCenter Sites 11.1.1.8.0 Apache Tomcat memory corruption
17188| [99937] Apache Batik up to 1.8 privilege escalation
17189| [99936] Apache FOP up to 2.1 privilege escalation
17190| [99935] Apache CXF up to 3.0.12/3.1.10 STSClient Cache information disclosure
17191| [99934] Apache CXF up to 3.0.12/3.1.10 JAX-RS XML Security Streaming Client spoofing
17192| [99930] Apache Traffic Server up to 6.2.0 denial of service
17193| [99929] Apache Log4j up to 2.8.1 Socket Server Deserialization privilege escalation
17194| [99925] Apache Traffic Server 6.0.0/6.1.0/6.2.0 HPACK Bomb denial of service
17195| [99738] Ping Identity OpenID Connect Authentication Module up to 2.13 on Apache Mod_auth_openidc.c spoofing
17196| [117569] Apache Hadoop up to 2.7.3 privilege escalation
17197| [99591] Apache TomEE up to 1.7.3/7.0.0-M2 EjbObjectInputStream Serialized Object privilege escalation
17198| [99370] Apache Ignite up to 1.8 update-notifier Document XML External Entity
17199| [99299] Apache Geode up to 1.1.0 Pulse OQL Query privilege escalation
17200| [99572] Apache Tomcat up to 7.0.75/8.0.41/8.5.11/9.0.0.M17 Application Listener privilege escalation
17201| [99570] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP Connector Cache information disclosure
17202| [99569] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 HTTP/2 GOAWAY Frame Resource Exhaustion denial of service
17203| [99568] Apache Tomcat up to 6.0.52/7.0.76/8.0.42/8.5.12/9.0.0.M18 Pipelined Request information disclosure
17204| [99048] Apache Ambari up to 2.3.x REST API Shell Metacharacter privilege escalation
17205| [99014] Apache Camel Jackson/JacksonXML privilege escalation
17206| [98610] Apple macOS up to 10.12.3 apache_mod_php memory corruption
17207| [98609] Apple macOS up to 10.12.3 apache_mod_php denial of service
17208| [98608] Apple macOS up to 10.12.3 apache_mod_php memory corruption
17209| [98607] Apple macOS up to 10.12.3 apache_mod_php denial of service
17210| [98606] Apple macOS up to 10.12.3 apache_mod_php denial of service
17211| [98605] Apple macOS up to 10.12.3 Apache denial of service
17212| [98604] Apple macOS up to 10.12.3 Apache denial of service
17213| [98603] Apple macOS up to 10.12.3 Apache denial of service
17214| [98602] Apple macOS up to 10.12.3 Apache denial of service
17215| [98601] Apple macOS up to 10.12.3 Apache denial of service
17216| [98517] Apache POI up to 3.14 OOXML File XXE denial of service
17217| [98405] Apache Hadoop up to 0.23.10 privilege escalation
17218| [98199] Apache Camel Validation XML External Entity
17219| [97892] Apache Tomcat up to 9.0.0.M15 Reverse-Proxy Http11InputBuffer.java information disclosure
17220| [97617] Apache Camel camel-snakeyaml Deserialization privilege escalation
17221| [97602] Apache Camel camel-jackson/camel-jacksonxml CamelJacksonUnmarshalType privilege escalation
17222| [97732] Apache Struts up to 2.3.31/2.5.10 Jakarta Multipart Parser Content-Type privilege escalation
17223| [97466] mod_auth_openidc up to 2.1.5 on Apache weak authentication
17224| [97455] mod_auth_openidc up to 2.1.4 on Apache weak authentication
17225| [97081] Apache Tomcat HTTPS Request denial of service
17226| [97162] EMC OpenText Documentum D2 BeanShell/Apache Commons privilege escalation
17227| [96949] Hanwha Techwin Smart Security Manager up to 1.5 Redis/Apache Felix Gogo privilege escalation
17228| [96314] Apache Cordova up to 6.1.1 on Android weak authentication
17229| [95945] Apple macOS up to 10.12.2 apache_mod_php denial of service
17230| [95944] Apple macOS up to 10.12.2 apache_mod_php denial of service
17231| [95943] Apple macOS up to 10.12.2 apache_mod_php memory corruption
17232| [95666] Oracle FLEXCUBE Direct Banking 12.0.0/12.0.1/12.0.2/12.0.3 Apache Commons Collections privilege escalation
17233| [95455] Apache NiFi up to 1.0.0/1.1.0 Connection Details Dialogue cross site scripting
17234| [95311] Apache storm UI Daemon privilege escalation
17235| [95291] ZoneMinder 1.30.0 Apache httpd privilege escalation
17236| [94800] Apache Wicket up to 1.5.16/6.24.x Deserialize DiskFileItem denial of service
17237| [94705] Apache Qpid Broker for Java up to 6.1.0 SCRAM-SHA-1/SCRAM-SHA-256 User information disclosure
17238| [94627] Apache HTTP Server up to 2.4.24 mod_auth_digest Crash denial of service
17239| [94626] Apache HTTP Server up to 2.4.24 mod_session_crypto Padding weak encryption
17240| [94625] Apache HTTP Server up to 2.4.24 Response Split privilege escalation
17241| [94540] Apache Tika 1.9 tika-server File information disclosure
17242| [94600] Apache ActiveMQ up to 5.14.1 Administration Console cross site scripting
17243| [94348] Apple macOS up to 10.12.1 apache_mod_php denial of service
17244| [94347] Apple macOS up to 10.12.1 apache_mod_php denial of service
17245| [94346] Apple macOS up to 10.12.1 apache_mod_php denial of service
17246| [94345] Apple macOS up to 10.12.1 apache_mod_php denial of service
17247| [94344] Apple macOS up to 10.12.1 apache_mod_php denial of service
17248| [94343] Apple macOS up to 10.12.1 apache_mod_php memory corruption
17249| [94342] Apple macOS up to 10.12.1 apache_mod_php memory corruption
17250| [94128] Apache Tomcat up to 9.0.0.M13 Error information disclosure
17251| [93958] Apache HTTP Server up to 2.4.23 mod_http2 h2_stream.c denial of service
17252| [93874] Apache Subversion up to 1.8.16/1.9.4 mod_dontdothat XXE denial of service
17253| [93855] Apache Hadoop up to 2.6.4/2.7.2 HDFS Service privilege escalation
17254| [93609] Apache OpenMeetings 3.1.0 RMI Registry privilege escalation
17255| [93555] Apache Tika 1.6-1.13 jmatio MATLAB File privilege escalation
17256| [93799] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
17257| [93798] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 JmxRemoteLifecycleListener privilege escalation
17258| [93797] Apache Tomcat up to 6.0.47/7.0.72/8.0.38/8.5.6/9.0.0.M11 HTTP Split privilege escalation
17259| [93796] Apache Tomcat up to 8.5.6/9.0.0.M11 HTTP/2 Header Parser denial of service
17260| [93532] Apache Commons Collections Library Java privilege escalation
17261| [93210] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 ResourceLinkFactory privilege escalation
17262| [93209] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Realm Authentication User information disclosure
17263| [93208] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 System Property Replacement information disclosure
17264| [93207] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Utility Method privilege escalation
17265| [93206] Apache Tomcat up to 6.0.45/7.0.70/8.0.36/8.5.4/9.0.0.M9 Configuration privilege escalation
17266| [93098] Apache Commons FileUpload privilege escalation
17267| [92987] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Commons Collection memory corruption
17268| [92986] Oracle Virtual Desktop Infrastructure up to 3.5.2 Apache Tomcat memory corruption
17269| [92982] Oracle Insurance IStream 4.3.2 Apache Commons Collections memory corruption
17270| [92981] Oracle Financial Services Lending and Leasing 14.1.0/14.2.0 Apache Commons Collections memory corruption
17271| [92979] Oracle up to 8.0.3 Apache Commons Collections memory corruption
17272| [92977] Oracle FLEXCUBE Universal Banking up to 12.2.0 Apache Commons Collections memory corruption
17273| [92976] Oracle FLEXCUBE Universal Banking 12.87.1/12.87.2 Apache Commons Collections memory corruption
17274| [92975] Oracle FLEXCUBE Private Banking up to 12.1.0 Apache Commons Collections memory corruption
17275| [92974] Oracle FLEXCUBE Investor Servicing 12.0.1 Apache Commons Collections memory corruption
17276| [92973] Oracle 12.0.0/12.1.0 Apache Commons Collections memory corruption
17277| [92972] Oracle FLEXCUBE Core Banking 11.5.0.0.0/11.6.0.0.0 Apache Commons Collections memory corruption
17278| [92962] Oracle Agile PLM 9.3.4/9.3.5 Apache Commons Collections memory corruption
17279| [92909] Oracle Agile PLM 9.3.4/9.3.5 Apache Tomcat unknown vulnerability
17280| [92786] Oracle Banking Digital Experience 15.1 Apache Commons Collections information disclosure
17281| [92549] Apache Tomcat on Red Hat privilege escalation
17282| [92509] Apache Tomcat JK ISAPI Connector up to 1.2.41 jk_uri_worker_map.c memory corruption
17283| [92314] Apache MyFaces Trinidad up to 1.0.13/1.2.15/2.0.1/2.1.1 CoreResponseStateManager memory corruption
17284| [92313] Apache Struts2 up to 2.3.28/2.5.0 Action Name Cleanup cross site request forgery
17285| [92299] Apache Derby up to 10.12.1.0 SqlXmlUtil XML External Entity
17286| [92217] Apache ActiveMQ Artemis up to 1.3.x Broker/REST GetObject privilege escalation
17287| [92174] Apache Ranger up to 0.6.0 Policy cross site scripting
17288| [91831] Apache Jackrabbit up to 2.13.2 HTTP Header cross site request forgery
17289| [91825] Apache Zookeeper up to 3.4.8/3.5.2 C CLI Shell memory corruption
17290| [91818] Apache CXF Fediz up to 1.2.2/1.3.0 Application Plugin privilege escalation
17291| [92056] Apple macOS up to 10.11 apache_mod_php memory corruption
17292| [92055] Apple macOS up to 10.11 apache_mod_php memory corruption
17293| [92054] Apple macOS up to 10.11 apache_mod_php denial of service
17294| [92053] Apple macOS up to 10.11 apache_mod_php denial of service
17295| [92052] Apple macOS up to 10.11 apache_mod_php denial of service
17296| [92051] Apple macOS up to 10.11 apache_mod_php memory corruption
17297| [92050] Apple macOS up to 10.11 apache_mod_php denial of service
17298| [92049] Apple macOS up to 10.11 apache_mod_php memory corruption
17299| [92048] Apple macOS up to 10.11 apache_mod_php denial of service
17300| [92047] Apple macOS up to 10.11 apache_mod_php memory corruption
17301| [92046] Apple macOS up to 10.11 apache_mod_php memory corruption
17302| [92045] Apple macOS up to 10.11 apache_mod_php memory corruption
17303| [92044] Apple macOS up to 10.11 apache_mod_php memory corruption
17304| [92043] Apple macOS up to 10.11 apache_mod_php denial of service
17305| [92042] Apple macOS up to 10.11 apache_mod_php memory corruption
17306| [92041] Apple macOS up to 10.11 apache_mod_php memory corruption
17307| [92040] Apple macOS up to 10.11 Apache Proxy privilege escalation
17308| [91785] Apache Shiro up to 1.3.1 Servlet Filter privilege escalation
17309| [90879] Apache OpenMeetings up to 3.1.1 SWF Panel cross site scripting
17310| [90878] Apache Sentry up to 1.6.x Blacklist Filter reflect/reflect2/java_method privilege escalation
17311| [90610] Apache POI up to 3.13 XLSX2CSV Example OpenXML Document XML External Entity
17312| [90584] Apache ActiveMQ up to 5.11.3/5.12.2/5.13/1 Administration Web Console privilege escalation
17313| [90385] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site scripting
17314| [90384] Apache Archiva up to 1.3.9 addProxyConnector_commit.action cross site request forgery
17315| [90383] Apache OpenOffice up to 4.1.2 Impress File memory corruption
17316| [89670] Apache Tomcat up to 8.5.4 CGI Servlet Environment Variable Open Redirect
17317| [89669] Apache HTTP Server up to 2.4.23 RFC 3875 Namespace Conflict Environment Variable Open Redirect
17318| [89726] Apple Mac OS X up to 10.11.5 apache_mod_php memory corruption
17319| [89484] Apache Qpid up to 0.13.0 on Windows Proton Library Certificate weak authentication
17320| [89473] HPE iMC PLAT/EAD/APM/iMC NTA/iMC BIMS/iMC UAM_TAM up to 7.2 Apache Commons Collections Library Command privilege escalation
17321| [90263] Apache Archiva Header denial of service
17322| [90262] Apache Archiva Deserialize privilege escalation
17323| [90261] Apache Archiva XML DTD Connection privilege escalation
17324| [88827] Apache Xerces-C++ up to 3.1.3 DTD Stack-Based memory corruption
17325| [88747] Apache HTTP Server 2.4.17/2.4.18 mod_http2 denial of service
17326| [88608] Apache Struts up to 2.3.28.1/2.5.0 URLValidator Null Value denial of service
17327| [88607] Apache Struts up to 2.3.28.1 REST Plugin Expression privilege escalation
17328| [88606] Apache Struts up to 2.3.28.1 Restriction privilege escalation
17329| [88605] Apache Struts up to 2.3.28.1 Restriction privilege escalation
17330| [88604] Apache Struts up to 2.3.28.1 Token Validator cross site request forgery
17331| [88603] Apache Commons FileUpload up to 1.3.1 MultipartStream denial of service
17332| [88602] Apache Struts up to 1.3.10 ActionServlet.java cross site scripting
17333| [88601] Apache Struts up to 1.3.10 Multithreading ActionServlet.java memory corruption
17334| [88600] Apache Struts up to 1.3.10 MultiPageValidator privilege escalation
17335| [89005] Apache Qpid AMQP JMS Client getObject privilege escalation
17336| [87888] Apache Ranger up to 0.5.2 Policy Admin Tool eventTime sql injection
17337| [87835] Apache CloudStack up to 4.5.2.0/4.6.2.0/4.7.1.0/4.8.0.0 SAML-based Authentication privilege escalation
17338| [87806] HPE Discovery and Dependency Mapping Inventory up to 9.32 update 3 Apache Commons Collections Library privilege escalation
17339| [87805] HPE Universal CMDB up to 10.21 Apache Commons Collections Library privilege escalation
17340| [87768] Apache Shiro up to 1.2.4 Cipher Key privilege escalation
17341| [87765] Apache James Server 2.3.2 Command privilege escalation
17342| [88667] Apache HTTP Server up to 2.4.20 mod_http2 Certificate weak authentication
17343| [87718] Apache Struts up to 2.3.24.1 OGNL Caching denial of service
17344| [87717] Apache Struts up to 2.3.28 REST Plugin privilege escalation
17345| [87706] Apache Qpid Java up to 6.0.2 AMQP privilege escalation
17346| [87703] Apache Qbid Java up to 6.0.2 PlainSaslServer.java denial of service
17347| [87702] Apache ActiveMQ up to 5.13.x Fileserver Web Application Upload privilege escalation
17348| [87700] Apache PDFbox up to 1.8.11/2.0.0 XML Parser PDF Document XML External Entity
17349| [87679] HP Release Control 9.13/9.20/9.21 Apache Commons Collections Library Java Object privilege escalation
17350| [87540] Apache Ambari up to 2.2.0 File Browser View information disclosure
17351| [87433] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
17352| [87432] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
17353| [87431] Apple Mac OS X up to 10.11.4 apache_mod_php Format String
17354| [87430] Apple Mac OS X up to 10.11.4 apache_mod_php denial of service
17355| [87429] Apple Mac OS X up to 10.11.4 apache_mod_php information disclosure
17356| [87428] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
17357| [87427] Apple Mac OS X up to 10.11.4 apache_mod_php memory corruption
17358| [87389] Apache Xerces C++ up to 3.1.3 XML Document DTDScanner.cpp memory corruption
17359| [87172] Adobe ColdFusion up to 10 Update 18/11 Update 7/2016 Apache Commons Collections Library privilege escalation
17360| [87121] Apache Cordova iOS up to 3.x Plugin privilege escalation
17361| [87120] Apache Cordova iOS up to 3.x URL Whitelist privilege escalation
17362| [83806] HPE Network Node Manager i up to 10.01 Apache Commons Collections Library privilege escalation
17363| [83077] Apache Subversion up to 1.8.15/1.9.3 mod_authz_svn mod_authz_svn.c denial of service
17364| [83076] Apache Subversion up to 1.8.15/1.9.3 svnserve svnserve/cyrus_auth.c privilege escalation
17365| [82790] Apache Struts 2.0.0/2.3.24/2.3.28 Dynamic Method privilege escalation
17366| [82789] Apache Struts 2.0.0/2.3.24/2.3.28 XSLTResult privilege escalation
17367| [82725] HPE P9000 Command View up to 7.x/8.4.0 Apache Commons Collections Library privilege escalation
17368| [82444] Apache Camel up to 2.14.x/2.15.4/2.16.0 HTTP Request privilege escalation
17369| [82389] Apache Subversion up to 1.7.x/1.8.14/1.9.2 mod_dav_svn util.c memory corruption
17370| [82280] Apache Struts up to 1.7 JRE URLDecoder cross site scripting
17371| [82260] Apache OFBiz up to 12.04.05/13.07.02 Java Object privilege escalation
17372| [82259] Apache Qpid Proton up to 0.12.0 proton.reactor.Connector weak encryption
17373| [82250] Apache Ranger up to 0.5.0 Admin UI weak authentication
17374| [82214] Apache Wicket up to 1.5.14/6.21.x/7.1.x Input Element cross site scripting
17375| [82213] Apache Wicket up to 1.5.14/6.21.x/7.1.x ModalWindow Title getWindowOpenJavaScript cross site scripting
17376| [82212] Apache Ranger up to 0.5.0 Policy Admin Tool privilege escalation
17377| [82211] Apache OFBiz up to 12.04.06/13.07.02 ModelFormField.java DisplayEntityField.getDescription cross site scripting
17378| [82082] Apache JetSpeed up to 2.3.0 User Manager Service privilege escalation
17379| [82081] Apache OpenMeetings up to 3.1.0 SOAP API information disclosure
17380| [82080] Apache OpenMeetings up to 3.1.0 Event cross site scripting
17381| [82078] Apache OpenMeetings up to 3.1.0 Import/Export System Backup ZIP Archive directory traversal
17382| [82077] Apache OpenMeetings up to 3.1.0 Password Reset sendHashByUser privilege escalation
17383| [82076] Apache Ranger up to 0.5.1 privilege escalation
17384| [82075] Apache JetSpeed up to 2.3.0 Portal cross site scripting
17385| [82074] Apache JetSpeed up to 2.3.0 cross site scripting
17386| [82073] Apache JetSpeed up to 2.3.0 User Manager Service sql injection
17387| [82072] Apache JetSpeed up to 2.3.0 Portal Site Manager ZIP Archive directory traversal
17388| [82058] Apache LDAP Studio/Directory Studio up to 2.0.0-M9 CSV Export privilege escalation
17389| [82053] Apache Ranger up to 0.4.x Policy Admin Tool privilege escalation
17390| [82052] Apache Ranger up to 0.4.x Policy Admin Tool HTTP Request cross site scripting
17391| [81696] Apache ActiveMQ up to 5.13.1 HTTP Header privilege escalation
17392| [81695] Apache Xerces-C up to 3.1.2 internal/XMLReader.cpp memory corruption
17393| [81622] HPE Asset Manager 9.40/9.41/9.50 Apache Commons Collections Library Java Object privilege escalation
17394| [81406] HPE Service Manager up to 9.35 P3/9.41 P1 Apache Commons Collections Library Command privilege escalation
17395| [81405] HPE Operations Orchestration up to 10.50 Apache Commons Collections Library Command privilege escalation
17396| [81427] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
17397| [81426] Apple Mac OS X up to 10.11.3 apache_mod_php PNG File memory corruption
17398| [81372] Apache Struts up to 2.3.24.1 I18NInterceptor cross site scripting
17399| [81371] Apache Struts up to 2.3.24.1 Double OGNL Evaluation privilege escalation
17400| [81370] Apache Struts up to 2.3.24.1 Java URLDecoder cross site scripting
17401| [81084] Apache Tomcat 6.0/7.0/8.0/9.0 ServletContext directory traversal
17402| [81083] Apache Tomcat 7.0/8.0/9.0 Index Page cross site request forgery
17403| [81082] Apache Tomcat 7.0/8.0/9.0 ResourceLinkFactory.setGlobalContext privilege escalation
17404| [81081] Apache Tomcat 6.0/7.0/8.0/9.0 Error information disclosure
17405| [81080] Apache Tomcat 6.0/7.0/8.0/9.0 Session Persistence privilege escalation
17406| [81079] Apache Tomcat 6.0/7.0/8.0/9.0 StatusManagerServlet information disclosure
17407| [81078] Apache Tomcat 7.0/8.0/9.0 Session privilege escalation
17408| [80970] Apache Solr up to 5.3.0 Admin UI plugins.js cross site scripting
17409| [80969] Apache Solr up to 5.2 Schema schema-browser.js cross site scripting
17410| [80968] Apache Solr up to 5.0 analysis.js cross site scripting
17411| [80940] HP Continuous Delivery Automation 1.30 Apache Commons Collections Library privilege escalation
17412| [80823] Apache CloudStack up to 4.5.1 KVM Virtual Machine Migration privilege escalation
17413| [80822] Apache CloudStack up to 4.5.1 API Call information disclosure
17414| [80778] Apache Camel up to 2.15.4/2.16.0 camel-xstream privilege escalation
17415| [80750] HPE Operations Manager 8.x/9.0 on Windows Apache Commons Collections Library privilege escalation
17416| [80724] Apache Hive up to 1.2.1 Authorization Framework privilege escalation
17417| [80577] Oracle Secure Global Desktop 4.63/4.71/5.2 Apache HTTP Server denial of service
17418| [80165] Intel McAfee ePolicy Orchestrator up to 4.6.9/5.0.3/5.3.1 Apache Commons Collections Library privilege escalation
17419| [80116] Apache Subversion up to 1.9.2 svn Protocol libsvn_ra_svn/marshal.c read_string memory corruption
17420| [80115] Apache ActiveMQ up to 5.12.x Broker Service privilege escalation
17421| [80036] IBM Cognos Business Intelligence Apache Commons Collections Library InvokerTransformer privilege escalation
17422| [79873] VMware vCenter Operations/vRealize Orchestrator Apache Commons Collections Library Serialized Java Object privilege escalation
17423| [79840] Apache Cordova File Transfer Plugin up to 1.2.x on Android unknown vulnerability
17424| [79839] Apache TomEE Serialized Java Stream EjbObjectInputStream privilege escalation
17425| [79791] Cisco Products Apache Commons Collections Library privilege escalation
17426| [79539] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
17427| [79538] Apple Mac OS X up to 10.11.1 apache_mod_php memory corruption
17428| [79294] Apache Cordova-Android up to 3.6 BridgeSecret Random Generator weak encryption
17429| [79291] Apache Cordova-Android up to 4.0 Javascript Whitelist privilege escalation
17430| [79244] Apache CXF up to 2.7.17/3.0.7/3.1.2 SAML Web SSO Module SAML Response weak authentication
17431| [79243] Oracle WebLogic Server 10.3.6.0/12.1.2.0/12.1.3.0/12.2.1.0 WLS Security com.bea.core.apache.commons.collections.jar privilege escalation
17432| [78989] Apache Ambari up to 2.1.1 Open Redirect
17433| [78988] Apache Ambari up to 2.0.1/2.1.0 Password privilege escalation
17434| [78987] Apache Ambari up to 2.0.x cross site scripting
17435| [78986] Apache Ambari up to 2.0.x Proxy Endpoint api/v1/proxy privilege escalation
17436| [78780] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
17437| [78779] Apple Mac OS X up to 10.11.0 apache_mod_php denial of service
17438| [78778] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
17439| [78777] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
17440| [78776] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
17441| [78775] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
17442| [78774] Apple Mac OS X up to 10.11.0 apache_mod_php memory corruption
17443| [78297] Apache Commons Components HttpClient up to 4.3.5 HTTPS Timeout denial of service
17444| [77406] Apache Flex BlazeDS AMF Message XML External Entity
17445| [77429] Apache ActiveMQ up to 5.10.0 LDAPLoginModule privilege escalation
17446| [77399] Apache ActiveMQ up to 5.10.0 LDAPLoginModule weak authentication
17447| [77375] Apache Tapestry up to 5.3.5 Client-Side Object Storage privilege escalation
17448| [77331] Apache ActiveMQ up to 5.11.1 on Windows Fileserver Upload/Download directory traversal
17449| [77299] Apache Solr Real-Time Module up to 7.x-1.1 Index Content information disclosure
17450| [77247] Apache ActiveMQ up to 5.10 TransportConnection.java processControlCommand denial of service
17451| [77083] Apache Groovy up to 2.4.3 MethodClosure.java MethodClosure memory corruption
17452| [76953] Apache Subversion 1.7.0/1.8.0/1.8.10 svn_repos_trace_node_locations information disclosure
17453| [76952] Apache Subversion 1.7.0/1.8.0/1.8.10 mod_authz_svn anonymous/authenticated information disclosure
17454| [76567] Apache Struts 2.3.20 unknown vulnerability
17455| [76733] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 ap_some_auth_required unknown vulnerability
17456| [76732] Apache HTTP Server 2.4.7/2.4.8/2.4.9/2.4.10/2.4.12 Request apr_brigade_flatten privilege escalation
17457| [76731] Apache HTTP Server 2.4.12 ErrorDocument 400 Crash denial of service
17458| [75690] Apache Camel up to 2.13.3/2.14.1 XPathBuilder.java XML External Entity
17459| [75689] Apache Camel up to 2.13.3/2.14.1 XML Converter Setup XmlConverter.java SAXSource privilege escalation
17460| [75668] Apache Sling API/Sling Servlets Post up to 2.2.1 HtmlResponse cross site scripting
17461| [75601] Apache Jackrabbit up to 2.10.0 WebDAV Request XML External Entity
17462| [75420] Apache Tomcat up to 6.0.43/7.0.58/8.0.16 Security Manager privilege escalation
17463| [75145] Apache OpenOffice up to 4.1.1 HWP Filter Crash denial of service
17464| [75032] Apache Tomcat Connectors up to 1.2.40 mod_jk privilege escalation
17465| [75135] PHP 5.4/5.5 HTTP Request sapi_apache2.c apache2handler privilege escalation
17466| [74793] Apache Tomcat File Upload denial of service
17467| [74708] Apple MacOS X up to 10.10.2 Apache denial of service
17468| [74707] Apple MacOS X up to 10.10.2 Apache denial of service
17469| [74706] Apple MacOS X up to 10.10.2 Apache memory corruption
17470| [74705] Apple MacOS X up to 10.10.2 Apache denial of service
17471| [74704] Apple MacOS X up to 10.10.2 Apache denial of service
17472| [74703] Apple MacOS X up to 10.10.2 Apache denial of service
17473| [74702] Apple MacOS X up to 10.10.2 Apache denial of service
17474| [74701] Apple MacOS X up to 10.10.2 Apache cross site request forgery
17475| [74700] Apple MacOS X up to 10.10.2 Apache unknown vulnerability
17476| [74661] Apache Flex up to 4.14.0 asdoc index.html cross site scripting
17477| [74609] Apache Cassandra up to 1.2.19/2.0.13/2.1.3 JMX/RMI Interface privilege escalation
17478| [74469] Apache Xerces-C up to 7.0 internal/XMLReader.cpp denial of service
17479| [74468] Apache Batik up to 1.6 denial of service
17480| [74414] Apache Mod-gnutls up to 0.5.1 Authentication spoofing
17481| [74371] Apache Standard Taglibs up to 1.2.0 memory corruption
17482| [74367] Apache HTTP Server up to 2.4.12 mod_lua lua_request.c wsupgrade denial of service
17483| [74174] Apache WSS4J up to 2.0.0 privilege escalation
17484| [74172] Apache ActiveMQ up to 5.5.0 Administration Console cross site scripting
17485| [69092] Apache Tomcat up to 6.0.42/7.0.54/8.0.8 HTTP Request Smuggling privilege escalation
17486| [73831] Apache Qpid up to 0.30 Access Restriction unknown vulnerability
17487| [73731] Apache XML Security unknown vulnerability
17488| [68660] Oracle BI Publisher 10.1.3.4.2/11.1.1.7 Apache Tomcat cross site scripting
17489| [73659] Apache CloudStack up to 4.3.0 Stack-Based unknown vulnerability
17490| [73593] Apache Traffic Server up to 5.1.0 denial of service
17491| [73511] Apache POI up to 3.10 Deadlock denial of service
17492| [73510] Apache Solr up to 4.3.0 cross site scripting
17493| [68447] Apache Subversion up to 1.7.18/1.8.10 mod_dav_svn Crash denial of service
17494| [68446] Apache Subversion up to 1.7.18/1.8.10 REPORT Request Crash denial of service
17495| [73173] Apache CloudStack Stack-Based unknown vulnerability
17496| [68357] Apache Struts up to 2.3.16.3 Random Number Generator cross site request forgery
17497| [73106] Apache Hadoop up to 2.4.0 Symlink privilege escalation
17498| [68575] Apache HTTP Server up to 2.4.10 LuaAuthzProvider mod_lua.c privilege escalation
17499| [72890] Apache Qpid 0.30 unknown vulnerability
17500| [72887] Apache Hive 0.13.0 File Permission privilege escalation
17501| [72878] Apache Cordova 3.5.0 cross site request forgery
17502| [72877] Apache Cordova 3.5.0 cross site request forgery
17503| [72876] Apache Cordova 3.5.0 cross site request forgery
17504| [68435] Apache HTTP Server 2.4.10 mod_proxy_fcgi.c handle_headers denial of service
17505| [68065] Apache CXF up to 3.0.1 JAX-RS SAML denial of service
17506| [68064] Apache CXF up to 3.0.0 SAML Token denial of service
17507| [67913] Oracle Retail Markdown Optimization 12.0/13.0/13.1/13.2/13.4 Apache commons-beanutils-1.8.0.jar memory corruption
17508| [67912] Oracle Retail Invoice Matching up to 14.0 Apache commons-beanutils-1.8.0.jar memory corruption
17509| [67911] Oracle Retail Clearance Optimization Engine 13.3/13.4/14.0 Apache commons-beanutils-1.8.0.jar memory corruption
17510| [67910] Oracle Retail Allocation up to 13.2 Apache commons-beanutils-1.8.0.jar memory corruption
17511| [71835] Apache Shiro 1.0.0/1.1.0/1.2.0/1.2.1/1.2.2 unknown vulnerability
17512| [71633] Apachefriends XAMPP 1.8.1 cross site scripting
17513| [71629] Apache Axis2/C spoofing
17514| [67633] Apple Mac OS X up to 10.9.4 apache_mod_php ext/standard/dns.c dns_get_record memory corruption
17515| [67631] Apple Mac OS X up to 10.9.4 apache_mod_php Symlink memory corruption
17516| [67630] Apple Mac OS X up to 10.9.4 apache_mod_php cdf_read_property_info denial of service
17517| [67629] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_count_chain denial of service
17518| [67628] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_check_stream_offset denial of service
17519| [67627] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c mconvert memory corruption
17520| [67626] Apple Mac OS X up to 10.9.4 apache_mod_php softmagic.c denial of service
17521| [67625] Apple Mac OS X up to 10.9.4 apache_mod_php Crash denial of service
17522| [67624] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_property_info denial of service
17523| [67623] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_unpack_summary_info denial of service
17524| [67622] Apple Mac OS X up to 10.9.4 apache_mod_php cdf.c cdf_read_short_sector denial of service
17525| [67620] Apple Mac OS X up to 10.9.4 apache_mod_php magic/Magdir/commands denial of service
17526| [67790] Apache HTTP Server mod_cache NULL Pointer Dereference denial of service
17527| [67522] Apache Tomcat up to 7.0.39 JSP Upload privilege escalation
17528| [70809] Apache POI up to 3.11 Crash denial of service
17529| [70808] Apache POI up to 3.10 unknown vulnerability
17530| [70806] Apache Commons-httpclient 4.2/4.2.1/4.2.2 spoofing
17531| [70749] Apache Axis up to 1.4 getCN spoofing
17532| [70701] Apache Traffic Server up to 3.3.5 denial of service
17533| [70700] Apache OFBiz up to 12.04.03 cross site scripting
17534| [67402] Apache OpenOffice 4.0.0/4.0.1/4.1.0 Calc privilege escalation
17535| [67401] Apache OpenOffice up to 4.1.0 OLE Object information disclosure
17536| [70661] Apache Subversion up to 1.6.17 denial of service
17537| [70660] Apache Subversion up to 1.6.17 spoofing
17538| [70659] Apache Subversion up to 1.6.17 spoofing
17539| [67183] Apache HTTP Server up to 2.4.9 mod_proxy denial of service
17540| [67180] Apache HTTP Server up to 2.4.9 WinNT MPM Memory Leak denial of service
17541| [67185] Apache HTTP Server up to 2.4.9 mod_status Heap-Based memory corruption
17542| [67184] Apache HTTP Server 2.4.5/2.4.6 mod_cache NULL Pointer Dereference denial of service
17543| [67182] Apache HTTP Server up to 2.4.9 mod_deflate Memory Consumption denial of service
17544| [67181] Apache HTTP Server up to 2.4.9 mod_cgid denial of service
17545| [70338] Apache Syncope up to 1.1.7 unknown vulnerability
17546| [70295] Apache CXF up to 2.7.9 Cleartext information disclosure
17547| [70106] Apache Open For Business Project up to 10.04.0 getServerError cross site scripting
17548| [70105] Apache MyFaces up to 2.1.5 JavaServer Faces directory traversal
17549| [69846] Apache HBase up to 0.94.8 information disclosure
17550| [69783] Apache CouchDB up to 1.2.0 memory corruption
17551| [13383] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 XML Parser privilege escalation
17552| [13300] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi setuid() privilege escalation
17553| [13299] Apache HTTP Server 2.4.1/2.4.2 mod_wsgi Content-Type Header information disclosure
17554| [13164] Apache CXF up to 2.6.13/2.7.10 SOAP OutgoingChainInterceptor.java Invalid Content denial of service
17555| [13163] Apache CXF up to 2.6.13/2.7.10 SOAP HTML Content denial of service
17556| [13158] Apache Struts up to 2.3.16.2 ParametersInterceptor getClass privilege escalation
17557| [69515] Apache Struts up to 2.3.15.0 CookieInterceptor memory corruption
17558| [13086] Apache Struts up to 1.3.10 Class Loader privilege escalation
17559| [13067] Apache Struts up to 2.3.16.1 Class Loader privilege escalation
17560| [69431] Apache Archiva up to 1.3.6 cross site scripting
17561| [69385] Apache Syncope up to 1.1.6 unknown vulnerability
17562| [69338] Apache Xalan-Java up to 2.7.1 system-property unknown vulnerability
17563| [12742] Trustwave ModSecurity up to 2.7.5 Chunk Extension apache2/modsecurity.c modsecurity_tx_init() privilege escalation
17564| [12741] Trustwave ModSecurity up to 2.7.6 Chunked HTTP Transfer apache2/modsecurity.c modsecurity_tx_init Trailing Header privilege escalation
17565| [13387] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Content-Length Header privilege escalation
17566| [13386] Apache Tomcat Security Manager up to 6.0.39/7.0.53/8.0.5 XSLT privilege escalation
17567| [13385] Apache Tomcat 8.0.0/8.0.1/8.0.3 AJP Request Zero Length denial of service
17568| [13384] Apache Tomcat up to 6.0.39/7.0.53/8.0.5 Chunked HTTP Request denial of service
17569| [12748] Apache CouchDB 1.5.0 UUIDS /_uuids denial of service
17570| [66739] Apache Camel up to 2.12.2 unknown vulnerability
17571| [66738] Apache Camel up to 2.12.2 unknown vulnerability
17572| [12667] Apache HTTP Server 2.4.7 mod_log_config.c log_cookie denial of service
17573| [66695] Apache CouchDB up to 1.2.0 cross site scripting
17574| [66694] Apache CouchDB up to 1.2.0 Partition partition2 directory traversal
17575| [66689] Apache HTTP Server up to 2.0.33 mod_dav dav_xml_get_cdata denial of service
17576| [12518] Apache Tomcat up to 6.0.38/7.0.49/8.0.0-RC9 HTTP Header denial of service
17577| [66498] Apache expressions up to 3.3.0 Whitelist unknown vulnerability
17578| [12781] Apache Struts up to 2.3.8 ParametersInterceptor getClass denial of service
17579| [12439] Apache Tomcat 6.0.33 XML XXE information disclosure
17580| [12438] Apache Tomcat 6.0.33/6.0.34/6.0.35/6.0.36/6.0.37 coyoteadapter.java disableURLRewriting privilege escalation
17581| [66356] Apache Wicket up to 6.8.0 information disclosure
17582| [12209] Apache Tomcat 8.0.0-RC1/8.0.1/7.0.0/7.0.50 Content-Type Header for Multi-Part Request Infinite Loop denial of service
17583| [66322] Apache ActiveMQ up to 5.8.0 cross site scripting
17584| [12291] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
17585| [66255] Apache Open For Business Project up to 10.04.3 cross site scripting
17586| [66200] Apache Hadoop up to 2.0.5 Security Feature information disclosure
17587| [66072] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
17588| [66068] Apache CloudStack up to 4.2.0 Stack-Based unknown vulnerability
17589| [11928] Oracle Secure Global Desktop up to 4.71 Apache Tomcat unknown vulnerability
17590| [11924] Oracle Secure Global Desktop up to 4.63 Apache Tomcat denial of service
17591| [11922] Oracle Secure Global Desktop up to 4.63 Apache Tomcat unknown vulnerability
17592| [66049] Apache XML Security for Java up to 1.4.6 Memory Consumption denial of service
17593| [12199] Apache Subversion up to 1.8.5 mod_dav_svn/repos.c get_resource denial of service
17594| [65946] askapache Firefox Adsense up to 3.0 askapache-firefox-adsense.php cross site request forgery
17595| [65668] Apache Solr 4.0.0 Updater denial of service
17596| [65665] Apache Solr up to 4.3.0 denial of service
17597| [65664] Apache Solr 3.6.0/3.6.1/3.6.2/4.0.0 Updater denial of service
17598| [65663] Apache Solr up to 4.5.1 ResourceLoader directory traversal
17599| [65658] Apache roller 4.0/4.0.1/5.0/5.0.1 unknown vulnerability
17600| [65657] Apache Roller 4.0/4.0.1/5.0/5.0.1 cross site scripting
17601| [11325] Apache Subversion 1.7.13 mod_dontdothat Bypass denial of service
17602| [11324] Apache Subversion up to 1.8.4 mod_dav_svn denial of service
17603| [11098] Apache Tomcat 5.5.25 HTTP Request cross site request forgery
17604| [65410] Apache Struts 2.3.15.3 cross site scripting
17605| [65386] Apache Solr up to 2.2.1 on TYPO3 cross site scripting
17606| [65385] Apache Solr up to 2.2.1 on TYPO3 unknown vulnerability
17607| [11044] Apache Struts 2.3.15.3 showConfig.action cross site scripting
17608| [11043] Apache Struts 2.3.15.3 actionNames.action cross site scripting
17609| [11018] cPanel WHM up to 11.40.0.11 Apache mod_userdir Tweak Interface privilege escalation
17610| [65342] Apache Sling 1.0.2/1.0.4/1.0.6/1.1.0/1.1.2 Auth Core cross site scripting
17611| [65340] Apache Shindig 2.5.0 information disclosure
17612| [65316] Apache Mod Fcgid up to 2.3.7 mod_fcgid fcgid_bucket.c fcgid_header_bucket_read memory corruption
17613| [65313] Apache Sling 2.2.0/2.3.0 AbstractCreateOperation.java deepGetOrCreateNode denial of service
17614| [10826] Apache Struts 2 File privilege escalation
17615| [65204] Apache Camel up to 2.10.1 unknown vulnerability
17616| [10460] Apache Struts 2.0.0/2.3.15.1 Action Mapping Mechanism Bypass privilege escalation
17617| [10459] Apache Struts 2.0.0/2.3.15 Dynamic Method Invocation unknown vulnerability
17618| [10160] Apache Subversion 1.8.0/1.8.1/1.8.2 svnwcsub.py handle_options race condition
17619| [10159] Apache Subversion up to 1.8.2 svnserve write_pid_file() race condition
17620| [10158] Apache Subversion 1.8.0/1.8.1/1.8.2 daemonize.py daemon::daemonize race condition
17621| [10157] Apache Subversion up to 1.8.1 FSFS Repository Symlink privilege escalation
17622| [64808] Fail2ban up to 0.8.9 apache-auth.conf denial of service
17623| [64760] Best Practical RT up to 4.0.12 Apache::Session::File information disclosure
17624| [64722] Apache XML Security for C++ Heap-based memory corruption
17625| [64719] Apache XML Security for C++ Heap-based memory corruption
17626| [64718] Apache XML Security for C++ verify denial of service
17627| [64717] Apache XML Security for C++ getURIBaseTXFM memory corruption
17628| [64716] Apache XML Security for C++ spoofing
17629| [64701] Apache CXF up to 2.7.3 XML Parser Memory Consumption denial of service
17630| [64700] Apache CloudStack up to 4.1.0 Stack-Based cross site scripting
17631| [64667] Apache Open For Business Project up to 10.04.04 unknown vulnerability
17632| [64666] Apache Open For Business Project up to 10.04.04 cross site scripting
17633| [9891] Apache HTTP Server 2.2.22 suEXEC Feature .htaccess information disclosure
17634| [64509] Apache ActiveMQ up to 5.8.0 scheduled.jsp cross site scripting
17635| [9826] Apache Subversion up to 1.8.0 mod_dav_svn denial of service
17636| [9683] Apache HTTP Server 2.4.5 mod_session_dbd denial of service
17637| [64485] Apache Struts up to 2.2.3.0 privilege escalation
17638| [9568] Apache Struts up to 2.3.15 DefaultActionMapper cross site request forgery
17639| [9567] Apache Struts up to 2.3.15 DefaultActionMapper memory corruption
17640| [64467] Apache Geronimo 3.0 memory corruption
17641| [64466] Apache OpenJPA up to 2.2.1 Serialization memory corruption
17642| [64457] Apache Struts up to 2.2.3.0 cross site scripting
17643| [64326] Alejandro Garza Apachesolr Autocomplete up to 7.x-1.1 cross site scripting
17644| [9184] Apache Qpid up to 0.20 SSL misconfiguration
17645| [8935] Apache Subversion up to 1.7.9 FSFS Format Repository denial of service
17646| [8934] Apache Subversion up to 1.7.9 Svnserve Server denial of service
17647| [8933] Apache Subversion up to 1.6.21 check-mime-type.pl svnlook memory corruption
17648| [8932] Apache Subversion up to 1.6.21 svn-keyword-check.pl svnlook changed memory corruption
17649| [9022] Apache Struts up to 2.3.14.2 OGNL Expression memory corruption
17650| [8873] Apache Struts 2.3.14 privilege escalation
17651| [8872] Apache Struts 2.3.14 privilege escalation
17652| [8746] Apache HTTP Server Log File Terminal Escape Sequence Filtering mod_rewrite.c do_rewritelog privilege escalation
17653| [8666] Apache Tomcat up to 7.0.32 AsyncListener information disclosure
17654| [8665] Apache Tomcat up to 7.0.29 Chunked Transfer Encoding Extension Size denial of service
17655| [8664] Apache Tomcat up to 7.0.32 FORM Authentication weak authentication
17656| [64075] Apache Subversion up to 1.7.7 mod_dav_svn Crash denial of service
17657| [64074] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
17658| [64073] Apache Subversion up to 1.7.8 mod_dav_svn NULL Pointer Dereference denial of service
17659| [64072] Apache Subversion up to 1.7.7 mod_dav_svn NULL Pointer Dereference denial of service
17660| [64071] Apache Subversion up to 1.7.8 mod_dav_svn Memory Consumption denial of service
17661| [8768] Apache Struts up to 2.3.14 on Mac EL and OGNL Interpreter memory corruption
17662| [64006] Apache ActiveMQ up to 5.7.0 denial of service
17663| [64005] Apache ActiveMQ up to 5.7.0 Default Configuration denial of service
17664| [64004] Apache ActiveMQ up to 5.7.0 PortfolioPublishServlet.java cross site scripting
17665| [8427] Apache Tomcat Session Transaction weak authentication
17666| [63960] Apache Maven 3.0.4 Default Configuration spoofing
17667| [63751] Apache qpid up to 0.20 qpid::framing::Buffer denial of service
17668| [63750] Apache qpid up to 0.20 checkAvailable denial of service
17669| [63749] Apache Qpid up to 0.20 Memory Consumption denial of service
17670| [63748] Apache Qpid up to 0.20 Default Configuration denial of service
17671| [63747] Apache Rave up to 0.20 User Account information disclosure
17672| [7889] Apache Subversion up to 1.6.17 mod_dav_svn/svn_fs_file_length() denial of service
17673| [63646] Apache HTTP Server up to 2.2.23/2.4.3 mod_proxy_balancer.c balancer_handler cross site scripting
17674| [7688] Apache CXF up to 2.7.1 WSS4JInterceptor Bypass weak authentication
17675| [7687] Apache CXF up to 2.7.2 Token weak authentication
17676| [63334] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
17677| [63299] Apache CXF up to 2.6.0 WS-Security unknown vulnerability
17678| [7202] Apache HTTP Server 2.4.2 on Oracle Solaris ld_library_path cross site scripting
17679| [7075] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector NioEndpoint.java denial of service
17680| [7074] Apache Tomcat up to 6.0.35/7.0.29 FORM Authentication RealmBase.java weak authentication
17681| [7073] Apache Tomcat up to 6.0.35/7.0.31 CSRF Prevention Filter cross site request forgery
17682| [63090] Apache Tomcat up to 4.1.24 denial of service
17683| [63089] Apache HTTP Server up to 2.2.13 mod_proxy_ajp denial of service
17684| [62933] Apache Tomcat up to 5.5.0 Access Restriction unknown vulnerability
17685| [62929] Apache Tomcat up to 6.0.35/7.0.27 NIO Connector Memory Consumption denial of service
17686| [62833] Apache CXF -/2.6.0 spoofing
17687| [62832] Apache Axis2 up to 1.6.2 spoofing
17688| [62831] Apache Axis up to 1.4 Java Message Service spoofing
17689| [62830] Apache Commons-httpclient 3.0 Payments spoofing
17690| [62826] Apache Libcloud up to 0.11.0 spoofing
17691| [62757] Apache Open For Business Project up to 10.04.0 unknown vulnerability
17692| [8830] Red Hat JBoss Enterprise Application Platform 6.0.1 org.apache.catalina.connector.Response.encodeURL information disclosure
17693| [62661] Apache Axis2 unknown vulnerability
17694| [62658] Apache Axis2 unknown vulnerability
17695| [62467] Apache Qpid up to 0.17 denial of service
17696| [62417] Apache CXF 2.4.7/2.4.8/2.5.3/2.5.4/2.6.1 spoofing
17697| [6301] Apache HTTP Server mod_pagespeed cross site scripting
17698| [6300] Apache HTTP Server mod_pagespeed Hostname information disclosure
17699| [6123] Apache Wicket up to 1.5.7 Ajax Link cross site scripting
17700| [62035] Apache Struts up to 2.3.4 denial of service
17701| [61916] Apache QPID 0.14/0.16/0.5/0.6 unknown vulnerability
17702| [6998] Apache Tomcat 5.5.35/6.0.35/7.0.28 DIGEST Authentication Session State Caching privilege escalation
17703| [6997] Apache Tomcat 5.5.35/6.0.35/7.0.28 HTTP Digest Authentication Implementation privilege escalation
17704| [6092] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_ajp.c information disclosure
17705| [6090] Apache HTTP Server 2.4.0/2.4.1/2.4.2 mod_proxy_http.c information disclosure
17706| [61507] Apache POI up to 3.8 UnhandledDataStructure denial of service
17707| [6070] Apache Struts up to 2.3.4 Token Name Configuration Parameter privilege escalation
17708| [6069] Apache Struts up to 2.3.4 Request Parameter OGNL Expression denial of service
17709| [5764] Oracle Solaris 10 Apache HTTP Server information disclosure
17710| [5700] Oracle Secure Backup 10.3.0.3/10.4.0.1 Apache denial of service
17711| [61255] Apache Hadoop 2.0.0 Kerberos unknown vulnerability
17712| [61229] Apache Sling up to 2.1.1 denial of service
17713| [61152] Apache Commons-compress 1.0/1.1/1.2/1.3/1.4 denial of service
17714| [61094] Apache Roller up to 5.0 cross site scripting
17715| [61093] Apache Roller up to 5.0 cross site request forgery
17716| [61005] Apache OpenOffice 3.3/3.4 unknown vulnerability
17717| [9673] Apache HTTP Server up to 2.4.4 mod_dav mod_dav.c Request denial of service
17718| [5436] Apache OpenOffice 3.3/3.4 WPXContentListener.cpp _closeTableRow() File memory corruption
17719| [5435] Apache OpenOffice 3.3/3.4 vclmi.dll File memory corruption
17720| [60730] PHP 5.4.0/5.4.1/5.4.2 apache_request_headers memory corruption
17721| [60708] Apache Qpid 0.12 unknown vulnerability
17722| [5032] Apache Hadoop up to 0.20.205.0/1.0.1/0.23.1 Kerberos/MapReduce Security Feature privilege escalation
17723| [4949] Apache Struts File Upload XSLTResult.java XSLT File privilege escalation
17724| [4955] Apache Traffic Server 3.0.3/3.1.2 HTTP Header Parser memory corruption
17725| [4882] Apache Wicket up to 1.5.4 directory traversal
17726| [4881] Apache Wicket up to 1.4.19 cross site scripting
17727| [4884] Apache HTTP Server up to 2.3.6 mod_fcgid fcgid_spawn_ctl.c FcgidMaxProcessesPerClass HTTP Requests denial of service
17728| [60352] Apache Struts up to 2.2.3 memory corruption
17729| [60153] Apache Portable Runtime up to 1.4.3 denial of service
17730| [4598] Apache Struts 1.3.10 upload-submit.do cross site scripting
17731| [4597] Apache Struts 1.3.10 processSimple.do cross site scripting
17732| [4596] Apache Struts 2.0.14/2.2.3 struts2-rest-showcase/orders cross site scripting
17733| [4595] Apache Struts 2.0.14/2.2.3 struts2-showcase/person/editPerson.action cross site scripting
17734| [4583] Apache HTTP Server up to 2.2.21 Threaded MPM denial of service
17735| [4582] Apache HTTP Server up to 2.2.21 protocol.c information disclosure
17736| [4571] Apache Struts up to 2.3.1.2 privilege escalation
17737| [4557] Apache Tomcat up to 7.0.21 Caching/Recycling information disclosure
17738| [59934] Apache Tomcat up to 6.0.9 DigestAuthenticator.java unknown vulnerability
17739| [59933] Apache Tomcat up to 6.0.9 Access Restriction unknown vulnerability
17740| [59932] Apache Tomcat up to 6.0.9 unknown vulnerability
17741| [59931] Apache Tomcat up to 6.0.9 Access Restriction information disclosure
17742| [59902] Apache Struts up to 2.2.3 Interfaces unknown vulnerability
17743| [4528] Apache Struts up to 2.2.3 DebuggingInterceptor privilege escalation
17744| [4527] Apache Struts up to 2.2.3 ExceptionDelegator cross site scripting
17745| [59888] Apache Tomcat up to 6.0.6 denial of service
17746| [59886] Apache ActiveMQ up to 5.5.1 Crash denial of service
17747| [4513] Apache Struts up to 2.3.1 ParameterInterceptor directory traversal
17748| [4512] Apache Struts up to 2.2.3 CookieInterceptor command injection
17749| [59850] Apache Geronimo up to 2.2.1 denial of service
17750| [59825] Apache HTTP Server up to 2.1.7 mod_reqtimeout denial of service
17751| [59556] Apache HTTP Server up to 2.0.53 mod_proxy information disclosure
17752| [58467] Apache libcloud 0.2.0/0.3.0/0.3.1/0.4.0 Access Restriction spoofing
17753| [58413] Apache Tomcat up to 6.0.10 spoofing
17754| [58381] Apache Wicket up to 1.4.17 cross site scripting
17755| [58296] Apache Tomcat up to 7.0.19 unknown vulnerability
17756| [57888] Apache HttpClient 4.0/4.0.1/4.1 Authorization information disclosure
17757| [57587] Apache Subversion up to 1.6.16 mod_dav_svn information disclosure
17758| [57585] Apache Subversion up to 1.6.16 mod_dav_svn Memory Consumption denial of service
17759| [57584] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
17760| [57577] Apache Rampart-C 1.3.0 Access Restriction rampart_timestamp_token_validate privilege escalation
17761| [57568] Apache Archiva up to 1.3.4 cross site scripting
17762| [57567] Apache Archiva up to 1.3.4 cross site request forgery
17763| [57481] Apache Tomcat 7.0.12/7.0.13 Access Restriction unknown vulnerability
17764| [4355] Apache HTTP Server APR apr_fnmatch denial of service
17765| [57435] Apache Struts up to 2.2.1.1 FileHandler.java cross site scripting
17766| [57425] Apache Struts up to 2.2.1.1 cross site scripting
17767| [4352] Apache HTTP Server 2.2.x APR apr_fnmatch denial of service
17768| [57025] Apache Tomcat up to 7.0.11 information disclosure
17769| [57024] Apache Tomcat 7.0.11 Access Restriction information disclosure
17770| [56774] IBM WebSphere Application Server up to 7.0.0.14 org.apache.jasper.runtime.JspWriterImpl.response denial of service
17771| [56824] Apache Subversion up to 1.6.4 mod_dav_svn NULL Pointer Dereference denial of service
17772| [56832] Apache Tomcat up to 7.0.10 Access Restriction information disclosure
17773| [56830] Apache Tomcat up to 7.0.9 Access Restriction privilege escalation
17774| [12440] Apache Tomcat 6.0.33 Malicious Request cross site scripting
17775| [56512] Apache Continuum up to 1.4.0 cross site scripting
17776| [4285] Apache Tomcat 5.x JVM getLocale() denial of service
17777| [4284] Apache Tomcat 5.x HTML Manager cross site scripting
17778| [4283] Apache Tomcat 5.x ServletContect privilege escalation
17779| [56441] Apache Tomcat up to 7.0.6 denial of service
17780| [56300] Apache CouchDB up to 1.0.1 Web Administration Interface cross site scripting
17781| [55967] Apache Subversion up to 1.6.4 rev_hunt.c denial of service
17782| [55966] Apache Subversion up to 1.6.4 mod_dav_svn repos.c walk denial of service
17783| [55095] Apache Axis2 up to 1.6 Default Password memory corruption
17784| [55631] Apache Archiva up to 1.3.1 User Account cross site request forgery
17785| [55556] Apache Tomcat up to 6.0.29 Default Configuration information disclosure
17786| [55553] Apache Tomcat up to 7.0.4 sessionsList.jsp cross site scripting
17787| [55162] Apache MyFaces up to 2.0.0 Authentication Code unknown vulnerability
17788| [54881] Apache Subversion up to 1.6.12 mod_dav_svn authz.c privilege escalation
17789| [54879] Apache APR-util up to 0.9.14 mod_reqtimeout apr_brigade_split_line denial of service
17790| [54693] Apache Traffic Server DNS Cache unknown vulnerability
17791| [54416] Apache CouchDB up to 0.11.0 cross site request forgery
17792| [54394] Apache CXF up to 2.2.8 Memory Consumption denial of service
17793| [54261] Apache Tomcat jsp/cal/cal2.jsp cross site scripting
17794| [54166] Apache HTTP Server up to 2.2.12 mod_cache Crash denial of service
17795| [54385] Apache Struts up to 2.1.8.1 ParameterInterceptor unknown vulnerability
17796| [54012] Apache Tomcat up to 6.0.10 denial of service
17797| [53763] Apache Axis2 1.3/1.4/1.4.1/1.5/1.5.1 Memory Consumption denial of service
17798| [53368] Apache MyFaces 1.1.7/1.2.8 cross site scripting
17799| [53397] Apache axis2 1.4.1/1.5.1 Administration Console cross site scripting
17800| [52894] Apache Tomcat up to 6.0.7 information disclosure
17801| [52960] Apache ActiveMQ up to 5.4-snapshot information disclosure
17802| [52843] Apache HTTP Server mod_auth_shadow unknown vulnerability
17803| [52786] Apache Open For Business Project up to 09.04 cross site scripting
17804| [52587] Apache ActiveMQ up to 5.3.0 cross site request forgery
17805| [52586] Apache ActiveMQ up to 5.3.0 cross site scripting
17806| [52584] Apache CouchDB up to 0.10.1 information disclosure
17807| [51757] Apache HTTP Server 2.0.44 cross site scripting
17808| [51756] Apache HTTP Server 2.0.44 spoofing
17809| [51717] Apache HTTP Server up to 1.3.3 mod_proxy ap_proxy_send_fb memory corruption
17810| [51690] Apache Tomcat up to 6.0 directory traversal
17811| [51689] Apache Tomcat up to 6.0 information disclosure
17812| [51688] Apache Tomcat up to 6.0 directory traversal
17813| [50886] HP Operations Manager 8.10 on Windows File Upload org.apache.catalina.manager.HTMLManagerServlet memory corruption
17814| [50802] Apache Tomcat up to 3.3 Default Password weak authentication
17815| [50626] Apache Solr 1.0.0 cross site scripting
17816| [49857] Apache HTTP Server mod_proxy_ftp cross site scripting
17817| [49856] Apache HTTP Server 2.2.13 mod_proxy_ftp ap_proxy_ftp_handler denial of service
17818| [49348] Apache Xerces-C++ 2.7.0 Stack-Based denial of service
17819| [86789] Apache Portable Runtime memory/unix/apr_pools.c unknown vulnerability
17820| [49283] Apache APR-util up to 1.3.8 apr-util misc/apr_rmm.c apr_rmm_realloc memory corruption
17821| [48952] Apache HTTP Server up to 1.3.6 mod_deflate denial of service
17822| [48626] Apache Tomcat up to 4.1.23 Access Restriction directory traversal
17823| [48431] Apache Tomcat up to 4.1.23 j_security_check cross site scripting
17824| [48430] Apache Tomcat up to 4.1.23 mod_jk denial of service
17825| [47801] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site request forgery
17826| [47800] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console cross site scripting
17827| [47799] Apache Geronimo 2.1/2.1.1/2.1.2/2.1.3 Administration Console directory traversal
17828| [47648] Apache Tiles 2.1.0/2.1.1 cross site scripting
17829| [47640] Apache Struts 2.0.11/2.0.6/2.0.8/2.0.9/2.1 cross site scripting
17830| [47638] Apache Tomcat up to 4.1.23 mod_jk information disclosure
17831| [47636] Apache Struts 2.0.9 xip_client.html cross site scripting
17832| [47593] Apache Mod Perl 1 perl-status Apache::Status cross site scripting
17833| [47637] Apache Struts 1.0.2/1.1/1.2.4/1.2.7/1.2.8 cross site scripting
17834| [47239] Apache Struts up to 2.1.2 Beta struts directory traversal
17835| [47214] Apachefriends xampp 1.6.8 spoofing
17836| [47213] Apachefriends xampp 1.6.8 htaccess cross site request forgery
17837| [47162] Apachefriends XAMPP 1.4.4 weak authentication
17838| [47065] Apache Tomcat 4.1.23 cross site scripting
17839| [46834] Apache Tomcat up to 5.5.20 cross site scripting
17840| [46004] Apache Jackrabbit 1.4/1.5.0 search.jsp cross site scripting
17841| [49205] Apache Roller 2.3/3.0/3.1/4.0 Search cross site scripting
17842| [86625] Apache Struts directory traversal
17843| [44461] Apache Tomcat up to 5.5.0 information disclosure
17844| [44389] Apache Xerces-C++ XML Parser Memory Consumption denial of service
17845| [44352] Apache Friends XAMPP 1.6.8 adodb.php cross site scripting
17846| [43663] Apache Tomcat up to 6.0.16 directory traversal
17847| [43612] Apache Friends XAMPP 1.6.7 iart.php cross site scripting
17848| [43556] Apache HTTP Server up to 2.1.8 mod_proxy_ftp proxy_ftp.c cross site scripting
17849| [43516] Apache Tomcat up to 4.1.20 directory traversal
17850| [43509] Apache Tomcat up to 6.0.13 cross site scripting
17851| [42637] Apache Tomcat up to 6.0.16 cross site scripting
17852| [42325] Apache HTTP Server up to 2.1.8 Error Page cross site scripting
17853| [41838] Apache-SSL 1.3.34 1.57 expandcert privilege escalation
17854| [41091] Apache Software Foundation Mod Jk up to 2.0.1 mod_jk2 Stack-based memory corruption
17855| [40924] Apache Tomcat up to 6.0.15 information disclosure
17856| [40923] Apache Tomcat up to 6.0.15 unknown vulnerability
17857| [40922] Apache Tomcat up to 6.0 information disclosure
17858| [40710] Apache HTTP Server up to 2.0.61 mod_negotiation cross site scripting
17859| [40709] Apache HTTP Server up to 2.0.53 mod_negotiation cross site scripting
17860| [40656] Apache Tomcat 5.5.20 information disclosure
17861| [40503] Apache HTTP Server mod_proxy_ftp cross site scripting
17862| [40502] Apache HTTP Server up to 2.2.5 mod_proxy_balancer memory corruption
17863| [40501] Apache HTTP Server 2.2.6 mod_proxy_balancer cross site request forgery
17864| [40398] Apache HTTP Server up to 2.2 mod_proxy_balancer cross site scripting
17865| [40397] Apache HTTP Server up to 2.2 mod_proxy_balancer balancer_handler denial of service
17866| [40234] Apache Tomcat up to 6.0.15 directory traversal
17867| [40221] Apache HTTP Server 2.2.6 information disclosure
17868| [40027] David Castro Apache Authcas 0.4 sql injection
17869| [3495] Apache OpenOffice up to 2.3 Database Document Processor Designfehler
17870| [3489] Apache HTTP Server 2.x HTTP Header cross site scripting
17871| [3414] Apache Tomcat WebDAV Stored Umgehungs-Angriff
17872| [39489] Apache Jakarta Slide up to 2.1 directory traversal
17873| [39540] Apache Geronimo 2.0/2.0.1/2.0.2/2.1 unknown vulnerability
17874| [3310] Apache OpenOffice 1.1.3/2.0.4/2.2.1 TIFF Image Parser Heap-based memory corruption
17875| [38768] Apache HTTP Server up to 2.1.7 mod_autoindex.c cross site scripting
17876| [38952] Apache Geronimo 2.0.1/2.1 unknown vulnerability
17877| [38658] Apache Tomcat 4.1.31 cal2.jsp cross site request forgery
17878| [38524] Apache Geronimo 2.0 unknown vulnerability
17879| [3256] Apache Tomcat up to 6.0.13 cross site scripting
17880| [38331] Apache Tomcat 4.1.24 information disclosure
17881| [38330] Apache Tomcat 4.1.24 information disclosure
17882| [38185] Apache Tomcat 3.3/3.3.1/3.3.1a/3.3.2 Error Message CookieExample cross site scripting
17883| [37967] Apache Tomcat up to 4.1.36 Error Message sendmail.jsp cross site scripting
17884| [37647] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 Authorization unknown vulnerability
17885| [37646] Apache Derby 10.1.1.0/10.1.2.1/10.1.3.1 unknown vulnerability
17886| [3141] Apache Tomcat up to 4.1.31 Accept-Language Header cross site scripting
17887| [3133] Apache Tomcat up to 6.0 HTTP cross site scripting
17888| [37292] Apache Tomcat up to 5.5.1 cross site scripting
17889| [3130] Apache OpenOffice 2.2.1 RTF Document Heap-based memory corruption
17890| [36981] Apache Tomcat JK Web Server Connector up to 1.2.22 mod_jk directory traversal
17891| [36892] Apache Tomcat up to 4.0.0 hello.jsp cross site scripting
17892| [37320] Apache MyFaces Tomahawk up to 1.1.4 cross site scripting
17893| [36697] Apache Tomcat up to 5.5.17 implicit-objects.jsp cross site scripting
17894| [36491] Apache Axis 1.0 Installation javaioFileNotFoundException information disclosure
17895| [36400] Apache Tomcat 5.5.15 mod_jk cross site scripting
17896| [36698] Apache Tomcat up to 4.0.0 cal2.jsp cross site scripting
17897| [36224] XAMPP Apache Distribution up to 1.6.0a adodb.php connect memory corruption
17898| [36225] XAMPP Apache Distribution 1.6.0a sql injection
17899| [2997] Apache httpd/Tomcat 5.5/6.0 directory traversal
17900| [35896] Apache Apache Test up to 1.29 mod_perl denial of service
17901| [35653] Avaya S8300 Cm 3.1.2 Apache Tomcat unknown vulnerability
17902| [35402] Apache Tomcat JK Web Server Connector 1.2.19 mod_jk.so map_uri_to_worker memory corruption
17903| [35067] Apache Stats up to 0.0.2 extract unknown vulnerability
17904| [35025] Apache Stats up to 0.0.3 extract unknown vulnerability
17905| [34252] Apache HTTP Server denial of service
17906| [2795] Apache OpenOffice 2.0.4 WMF/EMF File Heap-based memory corruption
17907| [33877] Apache Opentaps 0.9.3 cross site scripting
17908| [33876] Apache Open For Business Project unknown vulnerability
17909| [33875] Apache Open For Business Project cross site scripting
17910| [2703] Apache Jakarta Tomcat up to 5.x der_get_oid() memory corruption
17911| [2611] Apache HTTP Server up to 1.0.1 set_var Format String
17912| [31827] XMB Extreme Message Board up to 1.9.6 Apache HTTP Server memcp.php directory traversal
17913| [2452] Apache HTTP Server up to 2.2.3 on Windows mod_alias unknown vulnerability
17914| [31663] vbPortal Apache HTTP Server index.php directory traversal
17915| [2414] Apache HTTP Server up to 2.2.3 mod_rewrite memory corruption
17916| [2393] Apache HTTP Server up to 2.2.2 HTTP Header cross site scripting
17917| [30623] Apache James 2.2.0 SMTP Server denial of service
17918| [30176] PHP-Fusion up to 6.00.306 Apache HTTP Server .php.gif privilege escalation
17919|
17920| MITRE CVE - https://cve.mitre.org:
17921| [CVE-2013-4156] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.
17922| [CVE-2013-4131] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.
17923| [CVE-2013-3239] phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
17924| [CVE-2013-3060] The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
17925| [CVE-2013-2765] The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
17926| [CVE-2013-2251] Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
17927| [CVE-2013-2249] mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.
17928| [CVE-2013-2248] Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
17929| [CVE-2013-2189] Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.
17930| [CVE-2013-2135] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
17931| [CVE-2013-2134] Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
17932| [CVE-2013-2115] Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
17933| [CVE-2013-2071] java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
17934| [CVE-2013-2067] java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
17935| [CVE-2013-1966] Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
17936| [CVE-2013-1965] Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
17937| [CVE-2013-1896] mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
17938| [CVE-2013-1884] The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
17939| [CVE-2013-1879] Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
17940| [CVE-2013-1862] mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
17941| [CVE-2013-1849] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
17942| [CVE-2013-1847] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
17943| [CVE-2013-1846] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
17944| [CVE-2013-1845] The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
17945| [CVE-2013-1814] The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
17946| [CVE-2013-1777] The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not property implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
17947| [CVE-2013-1768] The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
17948| [CVE-2013-1088] Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
17949| [CVE-2013-1048] The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
17950| [CVE-2013-0966] The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI.
17951| [CVE-2013-0942] Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
17952| [CVE-2013-0941] EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
17953| [CVE-2013-0253] The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
17954| [CVE-2013-0248] The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
17955| [CVE-2013-0239] Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
17956| [CVE-2012-6573] Cross-site scripting (XSS) vulnerability in the Apache Solr Autocomplete module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving autocomplete results.
17957| [CVE-2012-6551] The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
17958| [CVE-2012-6092] Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.
17959| [CVE-2012-5887] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
17960| [CVE-2012-5886] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
17961| [CVE-2012-5885] The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.
17962| [CVE-2012-5786] The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF, possibly 2.6.0, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
17963| [CVE-2012-5785] Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
17964| [CVE-2012-5784] Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
17965| [CVE-2012-5783] Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
17966| [CVE-2012-5633] The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
17967| [CVE-2012-5616] Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.
17968| [CVE-2012-5568] Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
17969| [CVE-2012-5351] Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
17970| [CVE-2012-4558] Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
17971| [CVE-2012-4557] The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
17972| [CVE-2012-4556] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
17973| [CVE-2012-4555] The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
17974| [CVE-2012-4534] org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
17975| [CVE-2012-4528] The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
17976| [CVE-2012-4501] Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
17977| [CVE-2012-4460] The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors. NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
17978| [CVE-2012-4459] Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
17979| [CVE-2012-4458] The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
17980| [CVE-2012-4446] The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
17981| [CVE-2012-4431] org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
17982| [CVE-2012-4418] Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
17983| [CVE-2012-4387] Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
17984| [CVE-2012-4386] The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
17985| [CVE-2012-4360] Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
17986| [CVE-2012-4063] The Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying XML Signature transforms to documents, which allows remote attackers to cause a denial of service via unspecified vectors.
17987| [CVE-2012-4001] The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.
17988| [CVE-2012-3908] Multiple cross-site request forgery (CSRF) vulnerabilities in the ISE Administrator user interface (aka the Apache Tomcat interface) on Cisco Identity Services Engine (ISE) 3300 series appliances before 1.1.0.665 Cumulative Patch 1 allow remote attackers to hijack the authentication of administrators, aka Bug ID CSCty46684.
17989| [CVE-2012-3546] org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
17990| [CVE-2012-3544] Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
17991| [CVE-2012-3526] The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
17992| [CVE-2012-3513] munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
17993| [CVE-2012-3506] Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
17994| [CVE-2012-3502] The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
17995| [CVE-2012-3499] Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.
17996| [CVE-2012-3467] Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
17997| [CVE-2012-3451] Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
17998| [CVE-2012-3446] Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
17999| [CVE-2012-3376] DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
18000| [CVE-2012-3373] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
18001| [CVE-2012-3126] Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Products Suite 3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Apache Tomcat Agent.
18002| [CVE-2012-3123] Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality, related to Apache HTTP Server.
18003| [CVE-2012-2760] mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.
18004| [CVE-2012-2733] java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
18005| [CVE-2012-2687] Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
18006| [CVE-2012-2381] Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role.
18007| [CVE-2012-2380] Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality.
18008| [CVE-2012-2379] Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
18009| [CVE-2012-2378] Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
18010| [CVE-2012-2329] Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
18011| [CVE-2012-2145] Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
18012| [CVE-2012-2138] The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
18013| [CVE-2012-2098] Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
18014| [CVE-2012-1574] The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
18015| [CVE-2012-1181] fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
18016| [CVE-2012-1089] Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package.
18017| [CVE-2012-1007] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.
18018| [CVE-2012-1006] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
18019| [CVE-2012-0883] envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.
18020| [CVE-2012-0840] tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
18021| [CVE-2012-0838] Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
18022| [CVE-2012-0788] The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
18023| [CVE-2012-0394] ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."
18024| [CVE-2012-0393] The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.
18025| [CVE-2012-0392] The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
18026| [CVE-2012-0391] The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
18027| [CVE-2012-0256] Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
18028| [CVE-2012-0216] The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
18029| [CVE-2012-0213] The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
18030| [CVE-2012-0053] protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
18031| [CVE-2012-0047] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter.
18032| [CVE-2012-0031] scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
18033| [CVE-2012-0022] Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
18034| [CVE-2012-0021] The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
18035| [CVE-2011-5064] DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
18036| [CVE-2011-5063] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
18037| [CVE-2011-5062] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
18038| [CVE-2011-5057] Apache Struts 2.3.1.1 and earlier provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
18039| [CVE-2011-5034] Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
18040| [CVE-2011-4905] Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.
18041| [CVE-2011-4858] Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
18042| [CVE-2011-4668] IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
18043| [CVE-2011-4449] actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
18044| [CVE-2011-4415] The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.
18045| [CVE-2011-4317] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
18046| [CVE-2011-3639] The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
18047| [CVE-2011-3620] Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
18048| [CVE-2011-3607] Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
18049| [CVE-2011-3376] org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
18050| [CVE-2011-3375] Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
18051| [CVE-2011-3368] The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
18052| [CVE-2011-3348] The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
18053| [CVE-2011-3192] The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
18054| [CVE-2011-3190] Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
18055| [CVE-2011-2729] native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
18056| [CVE-2011-2712] Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
18057| [CVE-2011-2688] SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
18058| [CVE-2011-2526] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
18059| [CVE-2011-2516] Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
18060| [CVE-2011-2481] Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
18061| [CVE-2011-2329] The rampart_timestamp_token_validate function in util/rampart_timestamp_token.c in Apache Rampart/C 1.3.0 does not properly calculate the expiration of timestamp tokens, which allows remote attackers to bypass intended access restrictions by leveraging an expired token, a different vulnerability than CVE-2011-0730.
18062| [CVE-2011-2204] Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
18063| [CVE-2011-2088] XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
18064| [CVE-2011-2087] Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
18065| [CVE-2011-1928] The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
18066| [CVE-2011-1921] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.
18067| [CVE-2011-1783] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.
18068| [CVE-2011-1772] Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
18069| [CVE-2011-1752] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.
18070| [CVE-2011-1610] Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
18071| [CVE-2011-1582] Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
18072| [CVE-2011-1571] Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
18073| [CVE-2011-1570] Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.
18074| [CVE-2011-1503] The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.
18075| [CVE-2011-1502] Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
18076| [CVE-2011-1498] Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
18077| [CVE-2011-1475] The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
18078| [CVE-2011-1419] Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
18079| [CVE-2011-1318] Memory leak in org.apache.jasper.runtime.JspWriterImpl.response in the JavaServer Pages (JSP) component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to cause a denial of service (memory consumption) by accessing a JSP page of an application that is repeatedly stopped and restarted.
18080| [CVE-2011-1184] The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
18081| [CVE-2011-1183] Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
18082| [CVE-2011-1176] The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
18083| [CVE-2011-1088] Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
18084| [CVE-2011-1077] Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
18085| [CVE-2011-1026] Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to hijack the authentication of administrators.
18086| [CVE-2011-0715] The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
18087| [CVE-2011-0534] Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
18088| [CVE-2011-0533] Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta
18089| [CVE-2011-0419] Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
18090| [CVE-2011-0013] Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
18091| [CVE-2010-4644] Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.
18092| [CVE-2010-4539] The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
18093| [CVE-2010-4476] The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
18094| [CVE-2010-4455] Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.2 and 11.1.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Apache Plugin.
18095| [CVE-2010-4408] Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1 does not require entry of the administrator's password at the time of modifying a user account, which makes it easier for context-dependent attackers to gain privileges by leveraging a (1) unattended workstation or (2) cross-site request forgery (CSRF) vulnerability, a related issue to CVE-2010-3449.
18096| [CVE-2010-4312] The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
18097| [CVE-2010-4172] Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
18098| [CVE-2010-3872] The fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.6 for the Apache HTTP Server does not use bytewise pointer arithmetic in certain circumstances, which has unspecified impact and attack vectors related to "untrusted FastCGI applications" and a "stack buffer overwrite."
18099| [CVE-2010-3863] Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
18100| [CVE-2010-3854] Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
18101| [CVE-2010-3718] Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
18102| [CVE-2010-3449] Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1
18103| [CVE-2010-3315] authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
18104| [CVE-2010-3083] sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
18105| [CVE-2010-2952] Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.
18106| [CVE-2010-2791] mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.
18107| [CVE-2010-2375] Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
18108| [CVE-2010-2234] Cross-site request forgery (CSRF) vulnerability in Apache CouchDB 0.8.0 through 0.11.0 allows remote attackers to hijack the authentication of administrators for direct requests to an installation URL.
18109| [CVE-2010-2227] Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
18110| [CVE-2010-2103] Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter. NOTE: some of these details are obtained from third party information.
18111| [CVE-2010-2086] Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
18112| [CVE-2010-2076] Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
18113| [CVE-2010-2068] mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through 2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in certain configurations involving proxy worker pools, does not properly detect timeouts, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.
18114| [CVE-2010-2057] shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
18115| [CVE-2010-1632] Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
18116| [CVE-2010-1623] Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.
18117| [CVE-2010-1587] The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
18118| [CVE-2010-1452] The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
18119| [CVE-2010-1325] Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting. NOTE: some sources report that this is a vulnerability in a product named "Apache SLMS," but that is incorrect.
18120| [CVE-2010-1244] Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.
18121| [CVE-2010-1157] Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
18122| [CVE-2010-1151] Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possibly modify data, via vectors related to improper interaction with an external helper application for validation of credentials.
18123| [CVE-2010-0684] Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
18124| [CVE-2010-0434] The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not properly handle headers in subrequests in certain circumstances involving a parent request that has a body, which might allow remote attackers to obtain sensitive information via a crafted request that triggers access to memory locations associated with an earlier request.
18125| [CVE-2010-0432] Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
18126| [CVE-2010-0425] modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
18127| [CVE-2010-0408] The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle certain situations in which a client sends no request body, which allows remote attackers to cause a denial of service (backend server outage) via a crafted request, related to use of a 500 error code instead of the appropriate 400 error code.
18128| [CVE-2010-0390] Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions, allows remote attackers to execute arbitrary code by uploading a file with a pjpeg or jpeg extension, then accessing it via a direct request to the file in original/. NOTE: some of these details are obtained from third party information.
18129| [CVE-2010-0219] Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.
18130| [CVE-2010-0010] Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
18131| [CVE-2010-0009] Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
18132| [CVE-2009-5120] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
18133| [CVE-2009-5119] The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
18134| [CVE-2009-5006] The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote authenticated users to cause a denial of service (NULL pointer dereference, daemon crash, and cluster outage) by attempting to modify the alternate of an exchange.
18135| [CVE-2009-5005] The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data.
18136| [CVE-2009-4355] Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.
18137| [CVE-2009-4269] The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
18138| [CVE-2009-3923] The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure (VDI) 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server.
18139| [CVE-2009-3890] Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.
18140| [CVE-2009-3843] HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
18141| [CVE-2009-3821] Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
18142| [CVE-2009-3555] The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
18143| [CVE-2009-3548] The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
18144| [CVE-2009-3250] The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbitrary code by composing an e-mail message with an attachment filename ending in (1) .php in installations based on certain Apache HTTP Server configurations, (2) .php. on Windows, or (3) .php/ on Linux, and then making a direct request to a certain pathname under storage/.
18145| [CVE-2009-3095] The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11.
18146| [CVE-2009-3094] The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allows remote FTP servers to cause a denial of service (NULL pointer dereference and child process crash) via a malformed reply to an EPSV command.
18147| [CVE-2009-2902] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
18148| [CVE-2009-2901] The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
18149| [CVE-2009-2823] The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the HTTP TRACE method, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software.
18150| [CVE-2009-2699] The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
18151| [CVE-2009-2696] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
18152| [CVE-2009-2693] Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
18153| [CVE-2009-2625] XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
18154| [CVE-2009-2412] Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR
18155| [CVE-2009-2299] The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
18156| [CVE-2009-1956] Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.
18157| [CVE-2009-1955] The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
18158| [CVE-2009-1903] The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method.
18159| [CVE-2009-1891] The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connection is closed, which allows remote attackers to cause a denial of service (CPU consumption).
18160| [CVE-2009-1890] The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
18161| [CVE-2009-1885] Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
18162| [CVE-2009-1462] The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.
18163| [CVE-2009-1275] Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
18164| [CVE-2009-1195] The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
18165| [CVE-2009-1191] mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request.
18166| [CVE-2009-1012] Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
18167| [CVE-2009-0918] Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
18168| [CVE-2009-0796] Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
18169| [CVE-2009-0783] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
18170| [CVE-2009-0781] Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
18171| [CVE-2009-0754] PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
18172| [CVE-2009-0580] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
18173| [CVE-2009-0486] Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce insufficiently random numbers for random tokens, which allows remote attackers to bypass cross-site request forgery (CSRF) protection mechanisms and conduct unauthorized activities as other users.
18174| [CVE-2009-0039] Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
18175| [CVE-2009-0038] Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring
18176| [CVE-2009-0033] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
18177| [CVE-2009-0026] Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.
18178| [CVE-2009-0023] The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.
18179| [CVE-2008-6879] Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
18180| [CVE-2008-6755] ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions to 0600, which makes it easier for remote attackers to modify this file by accessing it through a (1) PHP or (2) CGI script.
18181| [CVE-2008-6722] Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.
18182| [CVE-2008-6682] Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
18183| [CVE-2008-6505] Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
18184| [CVE-2008-6504] ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
18185| [CVE-2008-5696] Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the ApacheAdmin console, which allows remote attackers to reconfigure the Apache HTTP Server via console operations.
18186| [CVE-2008-5676] Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to "transformation caching."
18187| [CVE-2008-5519] The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
18188| [CVE-2008-5518] Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet)
18189| [CVE-2008-5515] Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
18190| [CVE-2008-5457] Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
18191| [CVE-2008-4308] The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
18192| [CVE-2008-4008] Unspecified vulnerability in the WebLogic Server Plugins for Apache component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a stack-based buffer overflow in the WebLogic Apache Connector, related to an invalid parameter.
18193| [CVE-2008-3666] Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv_96 allows (1) context-dependent attackers to cause a denial of service (panic) via vectors involving creation of a crafted file and use of the sendfilev system call, as demonstrated by a file served by an Apache 2.2.x web server with EnableSendFile configured
18194| [CVE-2008-3271] Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
18195| [CVE-2008-3257] Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
18196| [CVE-2008-2939] Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
18197| [CVE-2008-2938] Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
18198| [CVE-2008-2742] Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory. NOTE: this is only a vulnerability in environments that support multiple extensions, such as Apache with the mod_mime module enabled.
18199| [CVE-2008-2717] TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
18200| [CVE-2008-2579] Unspecified vulnerability in the WebLogic Server Plugins for Apache, Sun and IIS web servers component in Oracle BEA Product Suite 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, 7.0 SP7, and 6.1 SP7 has unknown impact and remote attack vectors.
18201| [CVE-2008-2384] SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.
18202| [CVE-2008-2370] Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
18203| [CVE-2008-2364] The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
18204| [CVE-2008-2168] Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
18205| [CVE-2008-2025] Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on SUSE openSUSE 11.0, and before 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "insufficient quoting of parameters."
18206| [CVE-2008-1947] Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
18207| [CVE-2008-1734] Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.
18208| [CVE-2008-1678] Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
18209| [CVE-2008-1232] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
18210| [CVE-2008-0869] Cross-site scripting (XSS) vulnerability in BEA WebLogic Workshop 8.1 through SP6 and Workshop for WebLogic 9.0 through 10.0 allows remote attackers to inject arbitrary web script or HTML via a "framework defined request parameter" when using WebLogic Workshop or Apache Beehive NetUI framework with page flows.
18211| [CVE-2008-0732] The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
18212| [CVE-2008-0555] The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.
18213| [CVE-2008-0457] Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.
18214| [CVE-2008-0456] CRLF injection vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by uploading a file with a multi-line name containing HTTP header sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
18215| [CVE-2008-0455] Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
18216| [CVE-2008-0128] The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
18217| [CVE-2008-0005] mod_proxy_ftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.
18218| [CVE-2008-0002] Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
18219| [CVE-2007-6750] The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris, related to the lack of the mod_reqtimeout module in versions before 2.2.15.
18220| [CVE-2007-6726] Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) xip_client.html and (2) xip_server.html in src/io/.
18221| [CVE-2007-6514] Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive.
18222| [CVE-2007-6423] ** DISPUTED ** Unspecified vulnerability in mod_proxy_balancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue.
18223| [CVE-2007-6422] The balancer_handler function in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.
18224| [CVE-2007-6421] Cross-site scripting (XSS) vulnerability in balancer-manager in mod_proxy_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.
18225| [CVE-2007-6420] Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
18226| [CVE-2007-6388] Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
18227| [CVE-2007-6361] Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote attackers to read certain files under temp/, as demonstrated by a log file that records the titles of blog entries. NOTE: access to temp/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
18228| [CVE-2007-6342] SQL injection vulnerability in the David Castro AuthCAS module (AuthCAS.pm) 0.4 for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the SESSION_COOKIE_NAME (session ID) in a cookie.
18229| [CVE-2007-6286] Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
18230| [CVE-2007-6258] Multiple stack-based buffer overflows in the legacy mod_jk2 2.0.3-DEV and earlier Apache module allow remote attackers to execute arbitrary code via a long (1) Host header, or (2) Hostname within a Host header.
18231| [CVE-2007-6231] Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the tm_includepath parameter to (1) Classes.inc.php, (2) statistic.inc.php, (3) status.inc.php, (4) status_top_x.inc.php, or (5) libchart-1.1/libchart.php in include/. NOTE: access to include/ is blocked by .htaccess in most deployments that use Apache HTTP Server.
18232| [CVE-2007-6203] Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.
18233| [CVE-2007-5797] SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.
18234| [CVE-2007-5731] Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
18235| [CVE-2007-5461] Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
18236| [CVE-2007-5342] The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
18237| [CVE-2007-5333] Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
18238| [CVE-2007-5156] Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.
18239| [CVE-2007-5085] Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.
18240| [CVE-2007-5000] Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
18241| [CVE-2007-4724] Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
18242| [CVE-2007-4723] Directory traversal vulnerability in Ragnarok Online Control Panel 4.3.4a, when the Apache HTTP Server is used, allows remote attackers to bypass authentication via directory traversal sequences in a URI that ends with the name of a publicly available page, as demonstrated by a "/...../" sequence and an account_manage.php/login.php final component for reaching the protected account_manage.php page.
18243| [CVE-2007-4641] Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting code into an Apache log file.
18244| [CVE-2007-4556] Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.
18245| [CVE-2007-4548] The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
18246| [CVE-2007-4465] Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.
18247| [CVE-2007-3847] The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.
18248| [CVE-2007-3571] The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
18249| [CVE-2007-3386] Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
18250| [CVE-2007-3385] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
18251| [CVE-2007-3384] Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.
18252| [CVE-2007-3383] Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
18253| [CVE-2007-3382] Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
18254| [CVE-2007-3304] Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
18255| [CVE-2007-3303] Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes. NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
18256| [CVE-2007-3101] Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.
18257| [CVE-2007-2450] Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
18258| [CVE-2007-2449] Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the '
18259| [CVE-2007-2353] Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
18260| [CVE-2007-2025] Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload arbitrary PHP files with a double extension, as demonstrated by .php.3, which is interpreted by Apache as being a valid PHP file.
18261| [CVE-2007-1863] cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
18262| [CVE-2007-1862] The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously used data, which could be used by remote attackers to obtain potentially sensitive information.
18263| [CVE-2007-1860] mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the URL to Tomcat, which allows remote attackers to access protected pages via a crafted prefix JkMount, possibly involving double-encoded .. (dot dot) sequences and directory traversal, a related issue to CVE-2007-0450.
18264| [CVE-2007-1858] The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.
18265| [CVE-2007-1842] Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the table parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, a related issue to CVE-2006-2019.
18266| [CVE-2007-1801] Directory traversal vulnerability in inc/lang.php in sBLOG 0.7.3 Beta allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conf_lang_default parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by inc/lang.php.
18267| [CVE-2007-1743] suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local users to leverage other vulnerabilities to create arbitrary UID/GID owned files if /proc is mounted. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root." In addition, because this is dependent on other vulnerabilities, perhaps this is resultant and should not be included in CVE.
18268| [CVE-2007-1742] suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root, which might allow local users to perform unauthorized operations on incorrect directories, as demonstrated using "html_backup" and "htmleditor" under an "html" directory. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
18269| [CVE-2007-1741] Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher, who is reliable, claims that the vendor disputes the issue because "the attacks described rely on an insecure server configuration" in which the user "has write access to the document root."
18270| [CVE-2007-1720] Directory traversal vulnerability in addressbook.php in the Addressbook 1.2 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module_name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file.
18271| [CVE-2007-1636] Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.
18272| [CVE-2007-1633] Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by bbcode_ref.php.
18273| [CVE-2007-1577] Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tplname] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
18274| [CVE-2007-1539] Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the module_name parameter, as demonstrated via a static PHP code injection attack in an Apache log file.
18275| [CVE-2007-1524] Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the settings[skin] parameter, as demonstrated by injecting PHP code into an Apache HTTP Server log file, which can then be included via themes/default/.
18276| [CVE-2007-1491] Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties.
18277| [CVE-2007-1358] Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
18278| [CVE-2007-1349] PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
18279| [CVE-2007-0975] Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the _REQUEST superglobal array.
18280| [CVE-2007-0930] Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function.
18281| [CVE-2007-0792] The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.
18282| [CVE-2007-0774] Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
18283| [CVE-2007-0637] Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the galeria parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by zd_numer.php.
18284| [CVE-2007-0451] Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
18285| [CVE-2007-0450] Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
18286| [CVE-2007-0419] The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
18287| [CVE-2007-0173] Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
18288| [CVE-2007-0098] Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
18289| [CVE-2007-0086] ** DISPUTED ** The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal.
18290| [CVE-2006-7217] Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
18291| [CVE-2006-7216] Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
18292| [CVE-2006-7197] The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.
18293| [CVE-2006-7196] Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
18294| [CVE-2006-7195] Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
18295| [CVE-2006-7098] The Debian GNU/Linux 033_-F_NO_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl.
18296| [CVE-2006-6869] Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang cookie to error.php, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
18297| [CVE-2006-6675] Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecifeid parameters in Welcome web-app.
18298| [CVE-2006-6613] Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_lang[include_file] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
18299| [CVE-2006-6589] Cross-site scripting (XSS) vulnerability in ecommerce/control/keywordsearch in the Apache Open For Business Project (OFBiz) and Opentaps 0.9.3 allows remote attackers to inject arbitrary web script or HTML via the SEARCH_STRING parameter, a different issue than CVE-2006-6587. NOTE: some of these details are obtained from third party information.
18300| [CVE-2006-6588] The forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) trusts the (1) dataResourceTypeId, (2) contentTypeId, and certain other hidden form fields, which allows remote attackers to create unauthorized types of content, modify content, or have other unknown impact.
18301| [CVE-2006-6587] Cross-site scripting (XSS) vulnerability in the forum implementation in the ecommerce component in the Apache Open For Business Project (OFBiz) allows remote attackers to inject arbitrary web script or HTML by posting a message.
18302| [CVE-2006-6445] Directory traversal vulnerability in error.php in Envolution 1.1.0 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
18303| [CVE-2006-6071] TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
18304| [CVE-2006-6047] Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
18305| [CVE-2006-5894] Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by lang.php.
18306| [CVE-2006-5752] Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.
18307| [CVE-2006-5733] Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
18308| [CVE-2006-5263] Directory traversal vulnerability in templates/header.php3 in phpMyAgenda 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter, as demonstrated by a parameter value naming an Apache HTTP Server log file that apparently contains PHP code.
18309| [CVE-2006-4994] Multiple unquoted Windows search path vulnerabilities in Apache Friends XAMPP 1.5.2 might allow local users to gain privileges via a malicious program file in %SYSTEMDRIVE%, which is run when XAMPP attempts to execute (1) FileZillaServer.exe, (2) mysqld-nt.exe, (3) Perl.exe, or (4) xamppcontrol.exe with an unquoted "Program Files" pathname.
18310| [CVE-2006-4636] Directory traversal vulnerability in SZEWO PhpCommander 3.0 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Directory parameter, as demonstrated by parameter values naming Apache HTTP Server log files that apparently contain PHP code.
18311| [CVE-2006-4625] PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
18312| [CVE-2006-4558] DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.
18313| [CVE-2006-4191] Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by header.php.
18314| [CVE-2006-4154] Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.
18315| [CVE-2006-4110] Apache 2.2.2, when running on Windows, allows remote attackers to read source code of CGI programs via a request that contains uppercase (or alternate case) characters that bypass the case-sensitive ScriptAlias directive, but allow access to the file on case-insensitive file systems.
18316| [CVE-2006-4004] Directory traversal vulnerability in index.php in vbPortal 3.0.2 through 3.6.0 Beta 1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the bbvbplang cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
18317| [CVE-2006-3918] http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.
18318| [CVE-2006-3835] Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (
18319| [CVE-2006-3747] Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and other versions before 2.0.59, and 2.2, when RewriteEngine is enabled, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted URLs that are not properly handled using certain rewrite rules.
18320| [CVE-2006-3362] Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
18321| [CVE-2006-3102] Race condition in articles/BitArticle.php in Bitweaver 1.3, when run on Apache with the mod_mime extension, allows remote attackers to execute arbitrary PHP code by uploading arbitrary files with double extensions, which are stored for a small period of time under the webroot in the temp/articles directory.
18322| [CVE-2006-3070] write_ok.php in Zeroboard 4.1 pl8, when installed on Apache with mod_mime, allows remote attackers to bypass restrictions for uploading files with executable extensions by uploading a .htaccess file that with an AddType directive that assigns an executable module to files with assumed-safe extensions, as demonstrated by assigning the txt extension to be handled by application/x-httpd-php.
18323| [CVE-2006-2831] Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
18324| [CVE-2006-2806] The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.
18325| [CVE-2006-2743] Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.
18326| [CVE-2006-2514] Coppermine galleries before 1.4.6, when running on Apache with mod_mime installed, allows remote attackers to upload arbitrary files via a filename with multiple file extensions.
18327| [CVE-2006-2330] PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
18328| [CVE-2006-1777] Directory traversal vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the s parameter, as demonstrated by injecting PHP sequences into an Apache error_log file, which is then included by doc/index.php.
18329| [CVE-2006-1564] Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory.
18330| [CVE-2006-1548] Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
18331| [CVE-2006-1547] ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
18332| [CVE-2006-1546] Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
18333| [CVE-2006-1393] Multiple cross-site scripting (XSS) vulnerabilities in the mod_pubcookie Apache application server module in University of Washington Pubcookie 1.x, 3.0.0, 3.1.0, 3.1.1, 3.2 before 3.2.1b, and 3.3 before 3.3.0a allow remote attackers to inject arbitrary web script or HTML via unspecified attack vectors.
18334| [CVE-2006-1346] Directory traversal vulnerability in inc/setLang.php in Greg Neustaetter gCards 1.45 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a lang[*][file] parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by index.php.
18335| [CVE-2006-1292] Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the phpicalendar[cookie_language] and phpicalendar[cookie_style] cookies, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included by day.php.
18336| [CVE-2006-1243] Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in the blog_language parameter, as demonstrated by injecting PHP sequences into an Apache access_log file, which is then included using install05.php.
18337| [CVE-2006-1095] Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.
18338| [CVE-2006-1079] htpasswd, as used in Acme thttpd 2.25b and possibly other products such as Apache, might allow local users to gain privileges via shell metacharacters in a command line argument, which is used in a call to the system function. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
18339| [CVE-2006-1078] Multiple buffer overflows in htpasswd, as used in Acme thttpd 2.25b, and possibly other products such as Apache, might allow local users to gain privileges via (1) a long command line argument and (2) a long line in a file. NOTE: since htpasswd is normally installed as a non-setuid program, and the exploit is through command line options, perhaps this issue should not be included in CVE. However, if there are some typical or recommended configurations that use htpasswd with sudo privileges, or common products that access htpasswd remotely, then perhaps it should be included.
18340| [CVE-2006-0743] Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
18341| [CVE-2006-0254] Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.
18342| [CVE-2006-0150] Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors, including the username.
18343| [CVE-2006-0144] The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
18344| [CVE-2006-0042] Unspecified vulnerability in (1) apreq_parse_headers and (2) apreq_parse_urlencoded functions in Apache2::Request (Libapreq2) before 2.07 allows remote attackers cause a denial of service (CPU consumption) via unknown attack vectors that result in quadratic computational complexity.
18345| [CVE-2005-4857] eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error".
18346| [CVE-2005-4849] Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
18347| [CVE-2005-4836] The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
18348| [CVE-2005-4814] Unrestricted file upload vulnerability in Segue CMS before 1.3.6, when the Apache HTTP Server handles .phtml files with the PHP interpreter, allows remote attackers to upload and execute arbitrary PHP code by placing .phtml files in the userfiles/ directory.
18349| [CVE-2005-4703] Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
18350| [CVE-2005-3745] Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
18351| [CVE-2005-3630] Fedora Directory Server before 10 allows remote attackers to obtain sensitive information, such as the password from adm.conf via an IFRAME element, probably involving an Apache httpd.conf configuration that orders "allow" directives before "deny" directives.
18352| [CVE-2005-3510] Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
18353| [CVE-2005-3392] Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.
18354| [CVE-2005-3357] mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
18355| [CVE-2005-3352] Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.
18356| [CVE-2005-3319] The apache2handler SAPI (sapi_apache2.c) in the Apache module (mod_php) for PHP 5.x before 5.1.0 final and 4.4 before 4.4.1 final allows attackers to cause a denial of service (segmentation fault) via the session.save_path option in a .htaccess file or VirtualHost.
18357| [CVE-2005-3164] The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
18358| [CVE-2005-2970] Memory leak in the worker MPM (worker.c) for Apache 2, in certain circumstances, allows remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections.
18359| [CVE-2005-2963] The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.
18360| [CVE-2005-2728] The byte-range filter in Apache 2.0 before 2.0.54 allows remote attackers to cause a denial of service (memory consumption) via an HTTP header with a large Range field.
18361| [CVE-2005-2660] apachetop 0.12.5 and earlier, when running in debug mode, allows local users to create or append to arbitrary files via a symlink attack on atop.debug.
18362| [CVE-2005-2088] The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
18363| [CVE-2005-1754] ** DISPUTED ** JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
18364| [CVE-2005-1753] ** DISPUTED ** ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not exist in the mentioned products."
18365| [CVE-2005-1344] Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to execute arbitrary code via a long realm argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
18366| [CVE-2005-1268] Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
18367| [CVE-2005-1266] Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.
18368| [CVE-2005-0808] Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
18369| [CVE-2005-0182] The mod_dosevasive module 1.9 and earlier for Apache creates temporary files with predictable filenames, which could allow remote attackers to overwrite arbitrary files via a symlink attack.
18370| [CVE-2005-0108] Apache mod_auth_radius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service (crash) via a RADIUS_REPLY_MESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument.
18371| [CVE-2004-2734] webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
18372| [CVE-2004-2680] mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.
18373| [CVE-2004-2650] Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
18374| [CVE-2004-2343] ** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.
18375| [CVE-2004-2336] Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
18376| [CVE-2004-2115] Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.
18377| [CVE-2004-1834] mod_disk_cache in Apache 2.0 through 2.0.49 stores client headers, including authentication information, on the hard disk, which could allow local users to gain sensitive information.
18378| [CVE-2004-1765] Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabled, allows remote attackers to execute arbitrary code via crafted POST requests.
18379| [CVE-2004-1545] UploadFile.php in MoniWiki 1.0.9.2 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.hwp, which allows remote attackers to upload and execute arbitrary code.
18380| [CVE-2004-1438] The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command.
18381| [CVE-2004-1405] MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
18382| [CVE-2004-1404] Attachment Mod 2.3.10 module for phpBB, when used with Apache mod_mime, does not properly handle files with multiple file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code.
18383| [CVE-2004-1387] The check_forensic script in apache-utils package 1.3.31 allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
18384| [CVE-2004-1084] Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+, which bypass Apache file handles.
18385| [CVE-2004-1083] Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.
18386| [CVE-2004-1082] mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials.
18387| [CVE-2004-0942] Apache webserver 2.0.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an HTTP GET request with a MIME header containing multiple lines with a large number of space characters.
18388| [CVE-2004-0940] Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
18389| [CVE-2004-0885] The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
18390| [CVE-2004-0811] Unknown vulnerability in Apache 2.0.51 prevents "the merging of the Satisfy directive," which could allow attackers to obtain access to restricted resources contrary to the specified authentication configuration.
18391| [CVE-2004-0809] The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access.
18392| [CVE-2004-0786] The IPv6 URI parsing routines in the apr-util library for Apache 2.0.50 and earlier allow remote attackers to cause a denial of service (child process crash) via a certain URI, as demonstrated using the Codenomicon HTTP Test Tool.
18393| [CVE-2004-0751] The char_buffer_read function in the mod_ssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service (segmentation fault).
18394| [CVE-2004-0748] mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.
18395| [CVE-2004-0747] Buffer overflow in Apache 2.0.50 and earlier allows local users to gain apache privileges via a .htaccess file that causes the overflow during expansion of environment variables.
18396| [CVE-2004-0700] Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
18397| [CVE-2004-0646] Buffer overflow in the WriteToLog function for JRun 3.0 through 4.0 web server connectors, such as (1) mod_jrun and (2) mod_jrun20 for Apache, with verbose logging enabled, allows remote attackers to execute arbitrary code via a long HTTP header Content-Type field or other fields.
18398| [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
18399| [CVE-2004-0493] The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
18400| [CVE-2004-0492] Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.
18401| [CVE-2004-0490] cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
18402| [CVE-2004-0488] Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
18403| [CVE-2004-0263] PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information.
18404| [CVE-2004-0174] Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a "short-lived connection on a rarely-accessed listening socket."
18405| [CVE-2004-0173] Directory traversal vulnerability in Apache 1.3.29 and earlier, and Apache 2.0.48 and earlier, when running on Cygwin, allows remote attackers to read arbitrary files via a URL containing "..%5C" (dot dot encoded backslash) sequences.
18406| [CVE-2004-0113] Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
18407| [CVE-2004-0009] Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user.
18408| [CVE-2003-1581] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
18409| [CVE-2003-1580] The Apache HTTP Server 2.0.44, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
18410| [CVE-2003-1573] The PointBase 4.6 database component in the J2EE 1.4 reference implementation (J2EE/RI) allows remote attackers to execute arbitrary programs, conduct a denial of service, and obtain sensitive information via a crafted SQL statement, related to "inadequate security settings and library bugs in sun.* and org.apache.* packages."
18411| [CVE-2003-1521] Sun Java Plug-In 1.4 through 1.4.2_02 allows remote attackers to repeatedly access the floppy drive via the createXmlDocument method in the org.apache.crimson.tree.XmlDocument class, which violates the Java security model.
18412| [CVE-2003-1516] The org.apache.xalan.processor.XSLProcessorVersion class in Java Plug-in 1.4.2_01 allows signed and unsigned applets to share variables, which violates the Java security model and could allow remote attackers to read or write data belonging to a signed applet.
18413| [CVE-2003-1502] mod_throttle 3.0 allows local users with Apache privileges to access shared memory that points to a file that is writable by the apache user, which could allow local users to gain privileges.
18414| [CVE-2003-1418] Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child proccess IDs (PID).
18415| [CVE-2003-1307] ** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP."
18416| [CVE-2003-1172] Directory traversal vulnerability in the view-source sample file in Apache Software Foundation Cocoon 2.1 and 2.2 allows remote attackers to access arbitrary files via a .. (dot dot) in the filename parameter.
18417| [CVE-2003-1171] Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 allows remote attackers to execute arbitrary code via a server side script that sends a large amount of data.
18418| [CVE-2003-1138] The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page configured, via a GET request containing a double slash (//).
18419| [CVE-2003-1054] mod_access_referer 1.0.2 allows remote attackers to cause a denial of service (crash) via a malformed Referer header that is missing a hostname, as parsed by the ap_parse_uri_components function in Apache, which triggers a null dereference.
18420| [CVE-2003-0993] mod_access in Apache 1.3 before 1.3.30, when running big-endian 64-bit platforms, does not properly parse Allow/Deny rules using IP addresses without a netmask, which could allow remote attackers to bypass intended access restrictions.
18421| [CVE-2003-0987] mod_digest for Apache before 1.3.31 does not properly verify the nonce of a client response by using a AuthNonce secret.
18422| [CVE-2003-0866] The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
18423| [CVE-2003-0844] mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.
18424| [CVE-2003-0843] Format string vulnerability in mod_gzip_printf for mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode and using the Apache log, allows remote attackers to execute arbitrary code via format string characters in an HTTP GET request with an "Accept-Encoding: gzip" header.
18425| [CVE-2003-0789] mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could cause Apache to send the output of a CGI program to the wrong client.
18426| [CVE-2003-0771] Gallery.pm in Apache::Gallery (aka A::G) uses predictable temporary filenames when running Inline::C, which allows local users to execute arbitrary code by creating and modifying the files before Apache::Gallery does.
18427| [CVE-2003-0658] Docview before 1.1-18 in Caldera OpenLinux 3.1.1, SCO Linux 4.0, OpenServer 5.0.7, configures the Apache web server in a way that allows remote attackers to read arbitrary publicly readable files via a certain URL, possibly related to rewrite rules.
18428| [CVE-2003-0542] Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.
18429| [CVE-2003-0460] The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.
18430| [CVE-2003-0254] Apache 2 before 2.0.47, when running on an IPv6 host, allows attackers to cause a denial of service (CPU consumption by infinite loop) when the FTP proxy server fails to create an IPv6 socket.
18431| [CVE-2003-0253] The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.
18432| [CVE-2003-0249] ** DISPUTED ** PHP treats unknown methods such as "PoSt" as a GET request, which could allow attackers to intended access restrictions if PHP is running on a server that passes on all methods, such as Apache httpd 2.0, as demonstrated using a Limit directive. NOTE: this issue has been disputed by the Apache security team, saying "It is by design that PHP allows scripts to process any request method. A script which does not explicitly verify the request method will hence be processed as normal for arbitrary methods. It is therefore expected behaviour that one cannot implement per-method access control using the Apache configuration alone, which is the assumption made in this report."
18433| [CVE-2003-0245] Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.
18434| [CVE-2003-0192] Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite.
18435| [CVE-2003-0189] The authentication module for Apache 2.0.40 through 2.0.45 on Unix does not properly handle threads safely when using the crypt_r or crypt functions, which allows remote attackers to cause a denial of service (failed Basic authentication with valid usernames and passwords) when a threaded MPM is used.
18436| [CVE-2003-0134] Unknown vulnerability in filestat.c for Apache running on OS2, versions 2.0 through 2.0.45, allows unknown attackers to cause a denial of service via requests related to device names.
18437| [CVE-2003-0132] A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
18438| [CVE-2003-0083] Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences, a different vulnerability than CVE-2003-0020.
18439| [CVE-2003-0020] Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.
18440| [CVE-2003-0017] Apache 2.0 before 2.0.44 on Windows platforms allows remote attackers to obtain certain files via an HTTP request that ends in certain illegal characters such as ">", which causes a different filename to be processed and served.
18441| [CVE-2003-0016] Apache before 2.0.44, when running on unpatched Windows 9x and Me operating systems, allows remote attackers to cause a denial of service or execute arbitrary code via an HTTP request containing MS-DOS device names.
18442| [CVE-2002-2310] ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than Apache, which allows remote attackers to obtain usernames and passwords.
18443| [CVE-2002-2309] php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.
18444| [CVE-2002-2272] Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
18445| [CVE-2002-2103] Apache before 1.3.24, when writing to the log file, records a spoofed hostname from the reverse lookup of an IP address, even when a double-reverse lookup fails, which allows remote attackers to hide the original source of activities.
18446| [CVE-2002-2029] PHP, when installed on Windows with Apache and ScriptAlias for /php/ set to c:/php/, allows remote attackers to read arbitrary files and possibly execute arbitrary programs via an HTTP request for php.exe with a filename in the query string.
18447| [CVE-2002-2012] Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request.
18448| [CVE-2002-2009] Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
18449| [CVE-2002-2008] Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
18450| [CVE-2002-2007] The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
18451| [CVE-2002-2006] The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
18452| [CVE-2002-1895] The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
18453| [CVE-2002-1850] mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
18454| [CVE-2002-1793] HTTP Server mod_ssl module running on HP-UX 11.04 with Virtualvault OS (VVOS) 4.5 through 4.6 closes the connection when the Apache server times out during an SSL request, which may allow attackers to cause a denial of service.
18455| [CVE-2002-1658] Buffer overflow in htdigest in Apache 1.3.26 and 1.3.27 may allow attackers to execute arbitrary code via a long user argument. NOTE: since htdigest is normally only locally accessible and not setuid or setgid, there are few attack vectors which would lead to an escalation of privileges, unless htdigest is executed from a CGI program. Therefore this may not be a vulnerability.
18456| [CVE-2002-1635] The Apache configuration file (httpd.conf) in Oracle 9i Application Server (9iAS) uses a Location alias for /perl directory instead of a ScriptAlias, which allows remote attackers to read the source code of arbitrary CGI files via a URL containing the /perl directory instead of /cgi-bin.
18457| [CVE-2002-1593] mod_dav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service (CPU consumption) in a preforked multi-processing module.
18458| [CVE-2002-1592] The ap_log_rerror function in Apache 2.0 through 2.035, when a CGI application encounters an error, sends error messages to the client that include the full path for the server, which allows remote attackers to obtain sensitive information.
18459| [CVE-2002-1567] Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
18460| [CVE-2002-1394] Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
18461| [CVE-2002-1233] A regression error in the Debian distributions of the apache-ssl package (before 1.3.9 on Debian 2.2, and before 1.3.26 on Debian 3.0), for Apache 1.3.27 and earlier, allows local users to read or modify the Apache password file via a symlink attack on temporary files when the administrator runs (1) htpasswd or (2) htdigest, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2001-0131.
18462| [CVE-2002-1157] Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
18463| [CVE-2002-1156] Apache 2.0.42 allows remote attackers to view the source code of a CGI script via a POST request to a directory with both WebDAV and CGI enabled.
18464| [CVE-2002-1148] The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
18465| [CVE-2002-0935] Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
18466| [CVE-2002-0843] Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.
18467| [CVE-2002-0840] Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.
18468| [CVE-2002-0839] The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
18469| [CVE-2002-0682] Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
18470| [CVE-2002-0661] Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. (dot dot) sequences containing \ (backslash) characters.
18471| [CVE-2002-0658] OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.
18472| [CVE-2002-0654] Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathname in the resulting error message, or (2) via an error message that occurs when a script (child process) cannot be invoked.
18473| [CVE-2002-0653] Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
18474| [CVE-2002-0513] The PHP administration script in popper_mod 1.2.1 and earlier relies on Apache .htaccess authentication, which allows remote attackers to gain privileges if the script is not appropriately configured by the administrator.
18475| [CVE-2002-0493] Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
18476| [CVE-2002-0392] Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
18477| [CVE-2002-0259] InstantServers MiniPortal 1.1.5 and earlier stores sensitive login and account data in plaintext in (1) .pwd files in the miniportal/apache directory, or (2) mplog.txt, which could allow local users to gain privileges.
18478| [CVE-2002-0249] PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.
18479| [CVE-2002-0240] PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.
18480| [CVE-2002-0082] The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
18481| [CVE-2002-0061] Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically cmd.exe.
18482| [CVE-2001-1556] The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
18483| [CVE-2001-1534] mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's using predictable information including host IP address, system time and server process ID, which allows local users to obtain session ID's and bypass authentication when these session ID's are used for authentication.
18484| [CVE-2001-1510] Allaire JRun 2.3.3, 3.0 and 3.1 running on IIS 4.0 and 5.0, iPlanet, Apache, JRun web server (JWS), and possibly other web servers allows remote attackers to read arbitrary files and directories by appending (1) "%3f.jsp", (2) "?.jsp" or (3) "?" to the requested URL.
18485| [CVE-2001-1449] The default installation of Apache before 1.3.19 on Mandrake Linux 7.1 through 8.0 and Linux Corporate Server 1.0.1 allows remote attackers to list the directory index of arbitrary web directories.
18486| [CVE-2001-1385] The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
18487| [CVE-2001-1342] Apache before 1.3.20 on Windows and OS/2 systems allows remote attackers to cause a denial of service (GPF) via an HTTP request for a URI that contains a large number of / (slash) or other characters, which causes certain functions to dereference a null pointer.
18488| [CVE-2001-1217] Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.
18489| [CVE-2001-1216] Buffer overflow in PL/SQL Apache module in Oracle 9i Application Server allows remote attackers to execute arbitrary code via a long request for a help page.
18490| [CVE-2001-1072] Apache with mod_rewrite enabled on most UNIX systems allows remote attackers to bypass RewriteRules by inserting extra / (slash) characters into the requested path, which causes the regular expression in the RewriteRule to fail.
18491| [CVE-2001-1013] Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
18492| [CVE-2001-0925] The default installation of Apache before 1.3.19 allows remote attackers to list directories instead of the multiview index.html file via an HTTP request for a path that contains many / (slash) characters, which causes the path to be mishandled by (1) mod_negotiation, (2) mod_dir, or (3) mod_autoindex.
18493| [CVE-2001-0829] A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
18494| [CVE-2001-0766] Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by Apache's filters.
18495| [CVE-2001-0731] Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the "M=D" query string.
18496| [CVE-2001-0730] split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header.
18497| [CVE-2001-0729] Apache 1.3.20 on Windows servers allows remote attackers to bypass the default index page and list directory contents via a URL with a large number of / (slash) characters.
18498| [CVE-2001-0590] Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
18499| [CVE-2001-0131] htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack.
18500| [CVE-2001-0108] PHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.
18501| [CVE-2001-0042] PHP 3.x (PHP3) on Apache 1.3.6 allows remote attackers to read arbitrary files via a modified .. (dot dot) attack containing "%5c" (encoded backslash) sequences.
18502| [CVE-2000-1247] The default configuration of the jserv-status handler in jserv.conf in Apache JServ 1.1.2 includes an "allow from 127.0.0.1" line, which allows local users to discover JDBC passwords or other sensitive information via a direct request to the jserv/ URI.
18503| [CVE-2000-1210] Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
18504| [CVE-2000-1206] Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite, or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
18505| [CVE-2000-1205] Cross site scripting vulnerabilities in Apache 1.3.0 through 1.3.11 allow remote attackers to execute script as other web site visitors via (1) the printenv CGI (printenv.pl), which does not encode its output, (2) pages generated by the ap_send_error_response function such as a default 404, which does not add an explicit charset, or (3) various messages that are generated by certain Apache modules or core code. NOTE: the printenv issue might still exist for web browsers that can render text/plain content types as HTML, such as Internet Explorer, but CVE regards this as a design limitation of those browsers, not Apache. The printenv.pl/acuparam vector, discloser on 20070724, is one such variant.
18506| [CVE-2000-1204] Vulnerability in the mod_vhost_alias virtual hosting module for Apache 1.3.9, 1.3.11 and 1.3.12 allows remote attackers to obtain the source code for CGI programs if the cgi-bin directory is under the document root.
18507| [CVE-2000-1168] IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request.
18508| [CVE-2000-1016] The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to read package documentation and obtain system configuration information via an HTTP request for the /doc/packages URL.
18509| [CVE-2000-0913] mod_rewrite in Apache 1.3.12 and earlier allows remote attackers to read arbitrary files if a RewriteRule directive is expanded to include a filename whose name contains a regular expression.
18510| [CVE-2000-0883] The default configuration of mod_perl for Apache as installed on Mandrake Linux 6.1 through 7.1 sets the /perl/ directory to be browseable, which allows remote attackers to list the contents of that directory.
18511| [CVE-2000-0869] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 enables WebDAV, which allows remote attackers to list arbitrary diretories via the PROPFIND HTTP request method.
18512| [CVE-2000-0868] The default configuration of Apache 1.3.12 in SuSE Linux 6.4 allows remote attackers to read source code for CGI scripts by replacing the /cgi-bin/ in the requested URL with /cgi-bin-sdb/.
18513| [CVE-2000-0791] Trustix installs the httpsd program for Apache-SSL with world-writeable permissions, which allows local users to replace it with a Trojan horse.
18514| [CVE-2000-0760] The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
18515| [CVE-2000-0759] Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
18516| [CVE-2000-0628] The source.asp example script in the Apache ASP module Apache::ASP 1.93 and earlier allows remote attackers to modify files.
18517| [CVE-2000-0505] The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters.
18518| [CVE-1999-1412] A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.
18519| [CVE-1999-1293] mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands, which causes Apache to dump core.
18520| [CVE-1999-1237] Multiple buffer overflows in smbvalid/smbval SMB authentication library, as used in Apache::AuthenSmb and possibly other modules, allows remote attackers to execute arbitrary commands via (1) a long username, (2) a long password, and (3) other unspecified methods.
18521| [CVE-1999-1199] Apache WWW server 1.3.1 and earlier allows remote attackers to cause a denial of service (resource exhaustion) via a large number of MIME headers with the same name, aka the "sioux" vulnerability.
18522| [CVE-1999-1053] guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".
18523| [CVE-1999-0926] Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
18524| [CVE-1999-0678] A default configuration of Apache on Debian GNU/Linux sets the ServerRoot to /usr/doc, which allows remote users to read documentation files for the entire server.
18525| [CVE-1999-0448] IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.
18526| [CVE-1999-0289] The Apache web server for Win32 may provide access to restricted files when a . (dot) is appended to a requested URL.
18527| [CVE-1999-0236] ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
18528| [CVE-1999-0107] Buffer overflow in Apache 1.2.5 and earlier allows a remote attacker to cause a denial of service with a large number of GET requests containing a large number of / characters.
18529| [CVE-1999-0071] Apache httpd cookie buffer overflow for versions 1.1.1 and earlier.
18530|
18531| SecurityFocus - https://www.securityfocus.com/bid/:
18532| [104554] Apache HBase CVE-2018-8025 Security Bypass Vulnerability
18533| [104465] Apache Geode CVE-2017-15695 Remote Code Execution Vulnerability
18534| [104418] Apache Storm CVE-2018-8008 Arbitrary File Write Vulnerability
18535| [104399] Apache Storm CVE-2018-1332 User Impersonation Vulnerability
18536| [104348] Apache UIMA CVE-2017-15691 XML External Entity Injection Vulnerability
18537| [104313] Apache NiFi XML External Entity Injection and Denial of Service Vulnerability
18538| [104259] Apache Geode CVE-2017-12622 Authorization Bypass Vulnerability
18539| [104257] Apache Sling XSS Protection API CVE-2017-15717 Cross Site Scripting Vulnerability
18540| [104253] Apache ZooKeeper CVE-2018-8012 Security Bypass Vulnerability
18541| [104252] Apache Batik CVE-2018-8013 Information Disclosure Vulnerability
18542| [104239] Apache Solr CVE-2018-8010 XML External Entity Multiple Information Disclosure Vulnerabilities
18543| [104215] Apache ORC CVE-2018-8015 Denial of Service Vulnerability
18544| [104203] Apache Tomcat CVE-2018-8014 Security Bypass Vulnerability
18545| [104161] Apache Ambari CVE-2018-8003 Directory Traversal Vulnerability
18546| [104140] Apache Derby CVE-2018-1313 Security Bypass Vulnerability
18547| [104135] Apache Tika CVE-2018-1338 Denial of Service Vulnerability
18548| [104008] Apache Fineract CVE-2018-1291 SQL Injection Vulnerability
18549| [104007] Apache Fineract CVE-2018-1292 SQL Injection Vulnerability
18550| [104005] Apache Fineract CVE-2018-1289 SQL Injection Vulnerability
18551| [104001] Apache Tika CVE-2018-1335 Remote Command Injection Vulnerability
18552| [103975] Apache Fineract CVE-2018-1290 SQL Injection Vulnerability
18553| [103974] Apache Solr CVE-2018-1308 XML External Entity Injection Vulnerability
18554| [103772] Apache Traffic Server CVE-2017-7671 Denial of Service Vulnerability
18555| [103770] Apache Traffic Server CVE-2017-5660 Security Bypass Vulnerability
18556| [103751] Apache Hive CVE-2018-1282 SQL Injection Vulnerability
18557| [103750] Apache Hive CVE-2018-1284 Security Bypass Vulnerability
18558| [103692] Apache Ignite CVE-2018-1295 Arbitrary Code Execution Vulnerability
18559| [103528] Apache HTTP Server CVE-2018-1302 Denial of Service Vulnerability
18560| [103525] Apache HTTP Server CVE-2017-15715 Remote Security Bypass Vulnerability
18561| [103524] Apache HTTP Server CVE-2018-1312 Remote Security Bypass Vulnerability
18562| [103522] Apache HTTP Server CVE-2018-1303 Denial of Service Vulnerability
18563| [103520] Apache HTTP Server CVE-2018-1283 Remote Security Vulnerability
18564| [103516] Apache Struts CVE-2018-1327 Denial of Service Vulnerability
18565| [103515] Apache HTTP Server CVE-2018-1301 Denial of Service Vulnerability
18566| [103512] Apache HTTP Server CVE-2017-15710 Denial of Service Vulnerability
18567| [103508] Apache Syncope CVE-2018-1321 Multiple Remote Code Execution Vulnerabilities
18568| [103507] Apache Syncope CVE-2018-1322 Multiple Information Disclosure Vulnerabilities
18569| [103490] Apache Commons Compress CVE-2018-1324 Multiple Denial Of Service Vulnerabilities
18570| [103434] APACHE Allura CVE-2018-1319 HTTP Response Splitting Vulnerability
18571| [103389] Apache Tomcat JK Connector CVE-2018-1323 Directory Traversal Vulnerability
18572| [103222] Apache CloudStack CVE-2013-4317 Information Disclosure Vulnerability
18573| [103219] Apache Xerces-C CVE-2017-12627 Null Pointer Dereference Denial of Service Vulnerability
18574| [103206] Apache Geode CVE-2017-15693 Remote Code Execution Vulnerability
18575| [103205] Apache Geode CVE-2017-15692 Remote Code Execution Vulnerability
18576| [103170] Apache Tomcat CVE-2018-1304 Security Bypass Vulnerability
18577| [103144] Apache Tomcat CVE-2018-1305 Security Bypass Vulnerability
18578| [103102] Apache Oozie CVE-2017-15712 Information Disclosure Vulnerability
18579| [103098] Apache Karaf CVE-2016-8750 LDAP Injection Vulnerability
18580| [103069] Apache Tomcat CVE-2017-15706 Remote Security Weakness
18581| [103068] Apache JMeter CVE-2018-1287 Security Bypass Vulnerability
18582| [103067] Apache Qpid Dispatch Router 'router_core/connections.c' Denial of Service Vulnerability
18583| [103036] Apache CouchDB CVE-2017-12636 Remote Code Execution Vulnerability
18584| [103025] Apache Thrift CVE-2016-5397 Remote Command Injection Vulnerability
18585| [102879] Apache POI CVE-2017-12626 Multiple Denial of Service Vulnerabilities
18586| [102842] Apache NiFi CVE-2017-12632 Host Header Injection Vulnerability
18587| [102815] Apache NiFi CVE-2017-15697 Multiple Cross Site Scripting Vulnerabilities
18588| [102488] Apache Geode CVE-2017-9795 Remote Code Execution Vulnerability
18589| [102229] Apache Sling CVE-2017-15700 Information Disclosure Vulnerability
18590| [102226] Apache Drill CVE-2017-12630 Cross Site Scripting Vulnerability
18591| [102154] Multiple Apache Products CVE-2017-15708 Remote Code Execution Vulnerability
18592| [102127] Apache CXF Fediz CVE-2017-12631 Multiple Cross Site Request Forgery Vulnerabilities
18593| [102041] Apache Qpid Broker-J CVE-2017-15701 Denial of Service Vulnerability
18594| [102040] Apache Qpid Broker CVE-2017-15702 Security Weakness
18595| [102021] Apache Struts CVE-2017-15707 Denial of Service Vulnerability
18596| [101980] EMC RSA Authentication Agent for Web: Apache Web Server Authentication Bypass Vulnerability
18597| [101876] Apache Camel CVE-2017-12634 Deserialization Remote Code Execution Vulnerability
18598| [101874] Apache Camel CVE-2017-12633 Deserialization Remote Code Execution Vulnerability
18599| [101872] Apache Karaf CVE-2014-0219 Local Denial of Service Vulnerability
18600| [101868] Apache CouchDB CVE-2017-12635 Remote Privilege Escalation Vulnerability
18601| [101859] Apache CXF CVE-2017-12624 Denial of Service Vulnerability
18602| [101844] Apache Sling Servlets Post CVE-2017-11296 Cross Site Scripting Vulnerability
18603| [101686] Apache Hive CVE-2017-12625 Information Disclosure Vulnerability
18604| [101644] Apache Wicket CVE-2012-5636 Cross Site Scripting Vulnerability
18605| [101631] Apache Traffic Server CVE-2015-3249 Multiple Remote Code Execution Vulnerabilities
18606| [101630] Apache Traffic Server CVE-2014-3624 Access Bypass Vulnerability
18607| [101625] Apache jUDDI CVE-2009-1197 Security Bypass Vulnerability
18608| [101623] Apache jUDDI CVE-2009-1198 Cross Site Scripting Vulnerability
18609| [101620] Apache Subversion 'libsvn_fs_fs/fs_fs.c' Denial of Service Vulnerability
18610| [101585] Apache OpenOffice Multiple Remote Code Execution Vulnerabilities
18611| [101577] Apache Wicket CVE-2016-6806 Cross Site Request Forgery Vulnerability
18612| [101575] Apache Wicket CVE-2014-0043 Information Disclosure Vulnerability
18613| [101570] Apache Geode CVE-2017-9797 Information Disclosure Vulnerability
18614| [101562] Apache Derby CVE-2010-2232 Arbitrary File Overwrite Vulnerability
18615| [101560] Apache Portable Runtime Utility CVE-2017-12613 Multiple Information Disclosure Vulnerabilities
18616| [101558] Apache Portable Runtime Utility Local Out-of-Bounds Read Denial of Service Vulnerability
18617| [101532] Apache James CVE-2017-12628 Arbitrary Command Execution Vulnerability
18618| [101516] Apache HTTP Server CVE-2017-12171 Security Bypass Vulnerability
18619| [101261] Apache Solr/Lucene CVE-2017-12629 Information Disclosure and Remote Code Execution Vulnerabilities
18620| [101230] Apache Roller CVE-2014-0030 XML External Entity Injection Vulnerability
18621| [101173] Apache IMPALA CVE-2017-9792 Information Disclosure Vulnerability
18622| [101052] Apache Commons Jelly CVE-2017-12621 Security Bypass Vulnerability
18623| [101027] Apache Mesos CVE-2017-7687 Denial of Service Vulnerability
18624| [101023] Apache Mesos CVE-2017-9790 Denial of Service Vulnerability
18625| [100954] Apache Tomcat CVE-2017-12617 Incomplete Fix Remote Code Execution Vulnerability
18626| [100946] Apache Wicket CVE-2014-7808 Cross Site Request Forgery Vulnerability
18627| [100901] Apache Tomcat CVE-2017-12615 Remote Code Execution Vulnerability
18628| [100897] Apache Tomcat CVE-2017-12616 Information Disclosure Vulnerability
18629| [100880] Apache Directory LDAP API CVE-2015-3250 Unspecified Information Disclosure Vulnerability
18630| [100872] Apache HTTP Server CVE-2017-9798 Information Disclosure Vulnerability
18631| [100870] Apache Solr CVE-2017-9803 Remote Privilege Escalation Vulnerability
18632| [100859] puppetlabs-apache CVE-2017-2299 Information Disclosure Vulnerability
18633| [100829] Apache Struts CVE-2017-12611 Remote Code Execution Vulnerability
18634| [100823] Apache Spark CVE-2017-12612 Deserialization Remote Code Execution Vulnerability
18635| [100612] Apache Struts CVE-2017-9804 Incomplete Fix Denial of Service Vulnerability
18636| [100611] Apache Struts CVE-2017-9793 Denial of Service Vulnerability
18637| [100609] Apache Struts CVE-2017-9805 Remote Code Execution Vulnerability
18638| [100587] Apache Atlas CVE-2017-3155 Cross Frame Scripting Vulnerability
18639| [100581] Apache Atlas CVE-2017-3154 Information Disclosure Vulnerability
18640| [100578] Apache Atlas CVE-2017-3153 Cross Site Scripting Vulnerability
18641| [100577] Apache Atlas CVE-2017-3152 Cross Site Scripting Vulnerability
18642| [100547] Apache Atlas CVE-2017-3151 HTML Injection Vulnerability
18643| [100536] Apache Atlas CVE-2017-3150 Cross Site Scripting Vulnerability
18644| [100449] Apache Pony Mail CVE-2016-4460 Authentication Bypass Vulnerability
18645| [100447] Apache2Triad Multiple Security Vulnerabilities
18646| [100284] Apache Sling Servlets Post CVE-2017-9802 Cross Site Scripting Vulnerability
18647| [100280] Apache Tomcat CVE-2017-7674 Security Bypass Vulnerability
18648| [100259] Apache Subversion CVE-2017-9800 Remote Command Execution Vulnerability
18649| [100256] Apache Tomcat CVE-2017-7675 Directory Traversal Vulnerability
18650| [100235] Apache Storm CVE-2017-9799 Remote Code Execution Vulnerability
18651| [100082] Apache Commons Email CVE-2017-9801 SMTP Header Injection Vulnerability
18652| [99873] Apache Sling XSS Protection API CVE-2016-6798 XML External Entity Injection Vulnerability
18653| [99870] Apache Sling API CVE-2016-5394 Cross Site Scripting Vulnerability
18654| [99603] Apache Spark CVE-2017-7678 Cross Site Scripting Vulnerability
18655| [99592] Apache OpenMeetings CVE-2017-7685 Security Bypass Vulnerability
18656| [99587] Apache OpenMeetings CVE-2017-7673 Security Bypass Vulnerability
18657| [99586] Apache OpenMeetings CVE-2017-7688 Security Bypass Vulnerability
18658| [99584] Apache OpenMeetings CVE-2017-7684 Denial of Service Vulnerability
18659| [99577] Apache OpenMeetings CVE-2017-7663 Cross Site Scripting Vulnerability
18660| [99576] Apache OpenMeetings CVE-2017-7664 XML External Entity Injection Vulnerability
18661| [99569] Apache HTTP Server CVE-2017-9788 Memory Corruption Vulnerability
18662| [99568] Apache HTTP Server CVE-2017-9789 Denial of Service Vulnerability
18663| [99563] Apache Struts CVE-2017-7672 Denial of Service Vulnerability
18664| [99562] Apache Struts Spring AOP Functionality Denial of Service Vulnerability
18665| [99509] Apache Impala CVE-2017-5652 Information Disclosure Vulnerability
18666| [99508] Apache IMPALA CVE-2017-5640 Authentication Bypass Vulnerability
18667| [99486] Apache Traffic Control CVE-2017-7670 Denial of Service Vulnerability
18668| [99485] Apache Solr CVE-2017-7660 Security Bypass Vulnerability
18669| [99484] Apache Struts CVE-2017-9791 Remote Code Execution Vulnerability
18670| [99292] Apache Ignite CVE-2017-7686 Information Disclosure Vulnerability
18671| [99170] Apache HTTP Server CVE-2017-7679 Buffer Overflow Vulnerability
18672| [99137] Apache HTTP Server CVE-2017-7668 Denial of Service Vulnerability
18673| [99135] Apache HTTP Server CVE-2017-3167 Authentication Bypass Vulnerability
18674| [99134] Apache HTTP Server CVE-2017-3169 Denial of Service Vulnerability
18675| [99132] Apache HTTP Server CVE-2017-7659 Denial of Service Vulnerability
18676| [99112] Apache Thrift CVE-2015-3254 Denial of Service Vulnerability
18677| [99067] Apache Ranger CVE-2016-8751 HTML Injection Vulnerability
18678| [99018] Apache NiFi CVE-2017-7667 Cross Frame Scripting Vulnerability
18679| [99009] Apache NiFi CVE-2017-7665 Cross Site Scripting Vulnerability
18680| [98961] Apache Ranger CVE-2017-7677 Security Bypass Vulnerability
18681| [98958] Apache Ranger CVE-2017-7676 Security Bypass Vulnerability
18682| [98888] Apache Tomcat CVE-2017-5664 Security Bypass Vulnerability
18683| [98814] Apache Zookeeper CVE-2017-5637 Denial of Service Vulnerability
18684| [98795] Apache Hadoop CVE-2017-7669 Remote Privilege Escalation Vulnerability
18685| [98739] Apache Knox CVE-2017-5646 User Impersonation Vulnerability
18686| [98669] Apache Hive CVE-2016-3083 Security Bypass Vulnerability
18687| [98646] Apache Atlas CVE-2016-8752 Information Disclosure Vulnerability
18688| [98570] Apache Archiva CVE-2017-5657 Multiple Cross-Site Request Forgery Vulnerabilities
18689| [98489] Apache CXF Fediz CVE-2017-7661 Multiple Cross Site Request Forgery Vulnerabilities
18690| [98485] Apache CXF Fediz CVE-2017-7662 Cross Site Request Forgery Vulnerability
18691| [98466] Apache Ambari CVE-2017-5655 Insecure Temporary File Handling Vulnerability
18692| [98365] Apache Cordova For Android CVE-2016-6799 Information Disclosure Vulnerability
18693| [98025] Apache Hadoop CVE-2017-3161 Cross Site Scripting Vulnerability
18694| [98017] Apache Hadoop CVE-2017-3162 Input Validation Vulnerability
18695| [97971] Apache CXF CVE-2017-5656 Information Disclosure Vulnerability
18696| [97968] Apache CXF CVE-2017-5653 Spoofing Vulnerability
18697| [97967] Apache ActiveMQ CVE-2015-7559 Denial of Service Vulnerability
18698| [97949] Apache Traffic Server CVE-2017-5659 Denial of Service Vulnerability
18699| [97948] Apache Batik CVE-2017-5662 XML External Entity Information Disclosure Vulnerability
18700| [97947] Apache FOP CVE-2017-5661 XML External Entity Information Disclosure Vulnerability
18701| [97945] Apache Traffic Server CVE-2016-5396 Denial of Service Vulnerability
18702| [97702] Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability
18703| [97582] Apache CXF CVE-2016-6812 Cross Site Scripting Vulnerability
18704| [97579] Apache CXF JAX-RS CVE-2016-8739 XML External Entity Injection Vulnerability
18705| [97544] Apache Tomcat CVE-2017-5651 Information Disclosure Vulnerability
18706| [97531] Apache Tomcat CVE-2017-5650 Denial of Service Vulnerability
18707| [97530] Apache Tomcat CVE-2017-5648 Information Disclosure Vulnerability
18708| [97509] Apache Ignite CVE-2016-6805 Information Disclosure and XML External Entity Injection Vulnerabilities
18709| [97383] Apache Flex BlazeDS CVE-2017-5641 Remote Code Execution Vulnerability
18710| [97378] Apache Geode CVE-2017-5649 Information Disclosure Vulnerability
18711| [97229] Apache Ambari CVE-2016-4976 Local Information Disclosure Vulnerability
18712| [97226] Apache Camel CVE-2017-5643 Server Side Request Forgery Security Bypass Vulnerability
18713| [97184] Apache Ambari CVE-2016-6807 Remote Command Execution Vulnerability
18714| [97179] Apache Camel CVE-2016-8749 Java Deserialization Multiple Remote Code Execution Vulnerabilities
18715| [96983] Apache POI CVE-2017-5644 Denial Of Service Vulnerability
18716| [96895] Apache Tomcat CVE-2016-8747 Information Disclosure Vulnerability
18717| [96731] Apache NiFi CVE-2017-5636 Remote Code Injection Vulnerability
18718| [96730] Apache NiFi CVE-2017-5635 Security Bypass Vulnerability
18719| [96729] Apache Struts CVE-2017-5638 Remote Code Execution Vulnerability
18720| [96540] IBM Development Package for Apache Spark CVE-2016-4970 Denial of Service Vulnerability
18721| [96398] Apache CXF CVE-2017-3156 Information Disclosure Vulnerability
18722| [96321] Apache Camel CVE-2017-3159 Remote Code Execution Vulnerability
18723| [96293] Apache Tomcat 'http11/AbstractInputBuffer.java' Denial of Service Vulnerability
18724| [96228] Apache Brooklyn Cross Site Request Forgery and Multiple Cross Site Scripting Vulnerabilities
18725| [95998] Apache Ranger CVE-2016-8746 Security Bypass Vulnerability
18726| [95929] Apache Groovy CVE-2016-6497 Information Disclosure Vulnerability
18727| [95838] Apache Cordova For Android CVE-2017-3160 Man in the Middle Security Bypass Vulnerability
18728| [95675] Apache Struts Remote Code Execution Vulnerability
18729| [95621] Apache NiFi CVE-2106-8748 Cross Site Scripting Vulnerability
18730| [95429] Apache Groovy CVE-2016-6814 Remote Code Execution Vulnerability
18731| [95335] Apache Hadoop CVE-2016-3086 Information Disclosure Vulnerability
18732| [95168] Apache Wicket CVE-2016-6793 Denial of Service Vulnerability
18733| [95136] Apache Qpid Broker for Java CVE-2016-8741 Remote Information Disclosure Vulnerability
18734| [95078] Apache HTTP Server CVE-2016-0736 Remote Security Vulnerability
18735| [95077] Apache HTTP Server CVE-2016-8743 Security Bypass Vulnerability
18736| [95076] Apache HTTP Server CVE-2016-2161 Denial of Service Vulnerability
18737| [95020] Apache Tika CVE-2015-3271 Remote Information Disclosure Vulnerability
18738| [94950] Apache Hadoop CVE-2016-5001 Local Information Disclosure Vulnerability
18739| [94882] Apache ActiveMQ CVE-2016-6810 HTML Injection Vulnerability
18740| [94828] Apache Tomcat CVE-2016-8745 Information Disclosure Vulnerability
18741| [94766] Apache CouchDB CVE-2016-8742 Local Privilege Escalation Vulnerability
18742| [94657] Apache Struts CVE-2016-8738 Denial of Service Vulnerability
18743| [94650] Apache HTTP Server CVE-2016-8740 Denial of Service Vulnerability
18744| [94588] Apache Subversion CVE-2016-8734 XML External Entity Denial of Service Vulnerability
18745| [94513] Apache Karaf CVE-2016-8648 Remote Code Execution Vulnerability
18746| [94463] Apache Tomcat CVE-2016-8735 Remote Code Execution Vulnerability
18747| [94462] Apache Tomcat CVE-2016-6817 Denial of Service Vulnerability
18748| [94461] Apache Tomcat CVE-2016-6816 Security Bypass Vulnerability
18749| [94418] Apache OpenOffice CVE-2016-6803 Local Privilege Escalation Vulnerability
18750| [94247] Apache Tika CVE-2016-6809 Remote Code Execution Vulnerability
18751| [94221] Apache Ranger CVE-2016-6815 Local Privilege Escalation Vulnerability
18752| [94145] Apache OpenMeetings CVE-2016-8736 Remote Code Execution Vulnerability
18753| [93945] Apache CloudStack CVE-2016-6813 Authorization Bypass Vulnerability
18754| [93944] Apache Tomcat Security Manager CVE-2016-6796 Security Bypass Vulnerability
18755| [93943] Apache Tomcat CVE-2016-6794 Security Bypass Vulnerability
18756| [93942] Apache Tomcat Security Manager CVE-2016-5018 Security Bypass Vulnerability
18757| [93940] Apache Tomcat CVE-2016-6797 Security Bypass Vulnerability
18758| [93939] Apache Tomcat CVE-2016-0762 Information Disclosure Vulnerability
18759| [93774] Apache OpenOffice CVE-2016-6804 DLL Loading Remote Code Execution Vulnerability
18760| [93773] Apache Struts CVE-2016-6795 Directory Traversal Vulnerability
18761| [93478] Apache Tomcat CVE-2016-6325 Local Privilege Escalation Vulnerability
18762| [93472] Apache Tomcat CVE-2016-5425 Insecure File Permissions Vulnerability
18763| [93429] Apache Tomcat JK Connector CVE-2016-6808 Remote Buffer Overflow Vulnerability
18764| [93263] Apache Tomcat CVE-2016-1240 Local Privilege Escalation Vulnerability
18765| [93236] Apache MyFaces Trinidad CVE-2016-5019 Remote Code Execution Vulnerability
18766| [93142] Apache ActiveMQ Artemis CVE-2016-4978 Remote Code Execution Vulnerability
18767| [93132] Apache Derby CVE-2015-1832 XML External Entity Information Disclosure Vulnerability
18768| [93044] Apache Zookeeper CVE-2016-5017 Buffer Overflow Vulnerability
18769| [92966] Apache Jackrabbit CVE-2016-6801 Cross-Site Request Forgery Vulnerability
18770| [92947] Apache Shiro CVE-2016-6802 Remote Security Bypass Vulnerability
18771| [92905] Apache CXF Fediz CVE-2016-4464 Security Bypass Vulnerability
18772| [92577] Apache Ranger CVE-2016-5395 HTML Injection Vulnerability
18773| [92331] Apache HTTP Server CVE-2016-1546 Remote Denial of Service Vulnerability
18774| [92328] Apache Hive CVE-2016-0760 Multiple Remote Code Execution Vulnerabilities
18775| [92320] Apache APR-util and httpd CVE-2016-6312 Denial of Service Vulnerability
18776| [92100] Apache POI CVE-2016-5000 XML External Entity Injection Vulnerability
18777| [92079] Apache OpenOffice CVE-2016-1513 Remote Code Execution Vulnerability
18778| [91818] Apache Tomcat CVE-2016-5388 Security Bypass Vulnerability
18779| [91816] Apache HTTP Server CVE-2016-5387 Security Bypass Vulnerability
18780| [91788] Apache Qpid Proton CVE-2016-4467 Certificate Verification Security Bypass Vulnerability
18781| [91738] Apache XML-RPC CVE-2016-5003 Remote Code Execution Vulnerability
18782| [91736] Apache XML-RPC Multiple Security Vulnerabilities
18783| [91707] Apache Archiva CVE-2016-5005 HTML Injection Vulnerability
18784| [91703] Apache Archiva CVE-2016-4469 Multiple Cross-Site Request Forgery Vulnerabilities
18785| [91566] Apache HTTP Server CVE-2016-4979 Authentication Bypass Vulnerability
18786| [91537] Apache QPID CVE-2016-4974 Deserialization Security Bypass Vulnerability
18787| [91501] Apache Xerces-C CVE-2016-4463 Stack Buffer Overflow Vulnerability
18788| [91453] Apache Commons FileUpload CVE-2016-3092 Denial Of Service Vulnerability
18789| [91284] Apache Struts CVE-2016-4431 Security Bypass Vulnerability
18790| [91282] Apache Struts CVE-2016-4433 Security Bypass Vulnerability
18791| [91281] Apache Struts CVE-2016-4430 Cross-Site Request Forgery Vulnerability
18792| [91280] Apache Struts CVE-2016-4436 Security Bypass Vulnerability
18793| [91278] Apache Struts CVE-2016-4465 Denial of Service Vulnerability
18794| [91277] Apache Struts Incomplete Fix Remote Code Execution Vulnerability
18795| [91275] Apache Struts CVE-2016-4438 Remote Code Execution Vulnerability
18796| [91217] Apache Continuum 'saveInstallation.action' Command Execution Vulnerability
18797| [91141] Apache CloudStack CVE-2016-3085 Authentication Bypass Vulnerability
18798| [91068] Apache Struts CVE-2016-1181 Remote Code Execution Vulnerability
18799| [91067] Apache Struts CVE-2016-1182 Security Bypass Vulnerability
18800| [91024] Apache Shiro CVE-2016-4437 Information Disclosure Vulnerability
18801| [90988] Apache Ranger CVE-2016-2174 SQL Injection Vulnerability
18802| [90961] Apache Struts CVE-2016-3093 Denial of Service Vulnerability
18803| [90960] Apache Struts CVE-2016-3087 Remote Code Execution Vulnerability
18804| [90921] Apache Qpid CVE-2016-4432 Authentication Bypass Vulnerability
18805| [90920] Apache Qpid CVE-2016-3094 Denial of Service Vulnerability
18806| [90902] Apache PDFBox CVE-2016-2175 XML External Entity Injection Vulnerability
18807| [90897] Apache Tika CVE-2016-4434 XML External Entity Injection Vulnerability
18808| [90827] Apache ActiveMQ CVE-2016-3088 Multiple Arbitrary File Upload Vulnerabilities
18809| [90755] Apache Ambari CVE-2016-0707 Multiple Local Information Disclosure Vulnerabilities
18810| [90482] Apache CVE-2004-1387 Local Security Vulnerability
18811| [89762] Apache CVE-2001-1556 Remote Security Vulnerability
18812| [89417] Apache Subversion CVE-2016-2167 Authentication Bypass Vulnerability
18813| [89326] RETIRED: Apache Subversion CVE-2016-2167 Security Bypass Vulnerability
18814| [89320] Apache Subversion CVE-2016-2168 Remote Denial of Service Vulnerability
18815| [88826] Apache Struts CVE-2016-3082 Remote Code Execution Vulnerability
18816| [88797] Apache Cordova For iOS CVE-2015-5208 Arbitrary Code Execution Vulnerability
18817| [88764] Apache Cordova iOS CVE-2015-5207 Multiple Security Bypass Vulnerabilities
18818| [88701] Apache CVE-2001-1449 Remote Security Vulnerability
18819| [88635] Apache CVE-2000-1204 Remote Security Vulnerability
18820| [88590] Apache WWW server CVE-1999-1199 Denial-Of-Service Vulnerability
18821| [88496] Apache CVE-2000-1206 Remote Security Vulnerability
18822| [87828] Apache CVE-1999-1237 Remote Security Vulnerability
18823| [87784] Apache CVE-1999-1293 Denial-Of-Service Vulnerability
18824| [87327] Apache Struts CVE-2016-3081 Remote Code Execution Vulnerability
18825| [86622] Apache Stats CVE-2007-0975 Remote Security Vulnerability
18826| [86399] Apache CVE-2007-1743 Local Security Vulnerability
18827| [86397] Apache CVE-2007-1742 Local Security Vulnerability
18828| [86311] Apache Struts CVE-2016-4003 Cross Site Scripting Vulnerability
18829| [86174] Apache Wicket CVE-2015-5347 Cross Site Scripting Vulnerability
18830| [85971] Apache OFBiz CVE-2016-2170 Java Deserialization Remote Code Execution Vulnerability
18831| [85967] Apache OFBiz CVE-2015-3268 HTML Injection Vulnerability
18832| [85759] Apache Jetspeed CVE-2016-2171 Unauthorized Access Vulnerability
18833| [85758] Apache Jetspeed CVE-2016-0712 Cross Site Scripting Vulnerability
18834| [85756] Apache Jetspeed CVE-2016-0710 Multiple SQL Injection Vulnerabilities
18835| [85755] Apache Jetspeed CVE-2016-0711 Mulitple HTML Injection Vulnerabilities
18836| [85754] Apache Jetspeed CVE-2016-0709 Directory Traversal Vulnerability
18837| [85730] Apache Subversion CVE-2015-5343 Integer Overflow Vulnerability
18838| [85691] Apache Ranger CVE-2016-0735 Security Bypass Vulnerability
18839| [85578] Apache ActiveMQ CVE-2010-1244 Cross-Site Request Forgery Vulnerability
18840| [85554] Apache OpenMeetings CVE-2016-2164 Multiple Information Disclosure Vulnerabilities
18841| [85553] Apache OpenMeetings CVE-2016-0783 Information Disclosure Vulnerability
18842| [85552] Apache OpenMeetings CVE-2016-2163 HTML Injection Vulnerability
18843| [85550] Apache OpenMeetings CVE-2016-0784 Directory Traversal Vulnerability
18844| [85386] Apache Hadoop CVE-2015-7430 Local Privilege Escalation Vulnerability
18845| [85377] Apache Qpid Proton Python API CVE-2016-2166 Man in the Middle Security Bypass Vulnerability
18846| [85205] Apache Solr CVE-2015-8796 Cross Site Scripting Vulnerability
18847| [85203] Apache Solr CVE-2015-8795 Mulitple HTML Injection Vulnerabilities
18848| [85163] Apache Geronimo CVE-2008-0732 Local Security Vulnerability
18849| [85131] Apache Struts 'TextParseUtil.translateVariables()' Method Remote Code Execution Vulnerability
18850| [85070] Apache Struts CVE-2016-2162 Cross Site Scripting Vulnerability
18851| [85066] Apache Struts CVE-2016-0785 Remote Code Execution Vulnerability
18852| [84422] Apache TomEE CVE-2016-0779 Unspecified Security Vulnerability
18853| [84321] Apache ActiveMQ CVE-2016-0734 Clickjacking Vulnerability
18854| [84316] Apache ActiveMQ CVE-2016-0782 Multiple Cross Site Scripting Vulnerabilities
18855| [83910] Apache Wicket CVE-2015-7520 Cross Site Scripting Vulnerability
18856| [83423] Apache Xerces-C CVE-2016-0729 Buffer Overflow Vulnerability
18857| [83330] Apache Tomcat CVE-2015-5351 Cross Site Request Forgery Vulnerability
18858| [83329] Apache Tomcat CVE-2015-5174 Directory Traversal Vulnerability
18859| [83328] Apache Tomcat CVE-2015-5345 Directory Traversal Vulnerability
18860| [83327] Apache Tomcat Security Manager CVE-2016-0714 Remote Code Execution Vulnerability
18861| [83326] Apache Tomcat CVE-2016-0763 Security Bypass Vulnerability
18862| [83324] Apache Tomcat Security Manager CVE-2016-0706 Information Disclosure Vulnerability
18863| [83323] Apache Tomcat CVE-2015-5346 Session Fixation Vulnerability
18864| [83259] Apache Hadoop CVE-2015-1776 Information Disclosure Vulnerability
18865| [83243] Apache Solr CVE-2015-8797 Cross Site Scripting Vulnerability
18866| [83119] Apache Sling CVE-2016-0956 Information Disclosure Vulnerability
18867| [83002] Apache CVE-2000-1205 Cross-Site Scripting Vulnerability
18868| [82871] Apache Ranger Authentication Bypass and Security Bypass Vulnerabilities
18869| [82800] Apache CloudStack CVE-2015-3251 Information Disclosure Vulnerability
18870| [82798] Apache CloudStack CVE-2015-3252 Authentication Bypass Vulnerability
18871| [82732] Apache Gallery CVE-2003-0771 Local Security Vulnerability
18872| [82676] Apache CVE-2003-1581 Cross-Site Scripting Vulnerability
18873| [82550] Apache Struts CVE-2015-5209 Security Bypass Vulnerability
18874| [82300] Apache Subversion CVE-2015-5259 Integer Overflow Vulnerability
18875| [82260] Apache Camel CVE-2015-5344 Remote Code Execution Vulnerability
18876| [82234] Apache Hive CVE-2015-7521 Security Bypass Vulnerability
18877| [82082] Apache CVE-1999-0289 Remote Security Vulnerability
18878| [81821] Apache Distribution for Solaris CVE-2007-2080 SQL-Injection Vulnerability
18879| [80696] Apache Camel CVE-2015-5348 Information Disclosure Vulnerability
18880| [80525] Apache CVE-2003-1580 Remote Security Vulnerability
18881| [80354] Drupal Apache Solr Search Module Access Bypass Vulnerability
18882| [80193] Apache CVE-1999-0107 Denial-Of-Service Vulnerability
18883| [79812] Apache Directory Studio CVE-2015-5349 Command Injection Vulnerability
18884| [79744] Apache HBase CVE-2015-1836 Unauthorized Access Vulnerability
18885| [79204] Apache TomEE 'EjbObjectInputStream' Remote Code Execution Vulnerability
18886| [77679] Apache Cordova For Android CVE-2015-8320 Weak Randomization Security Bypass Vulnerability
18887| [77677] Apache Cordova For Android CVE-2015-5256 Security Bypass Vulnerability
18888| [77591] Apache CXF SAML SSO Processing CVE-2015-5253 Security Bypass Vulnerability
18889| [77521] Apache Commons Collections 'InvokerTransformer.java' Remote Code Execution Vulnerability
18890| [77110] Apache HttpComponents HttpClient CVE-2015-5262 Denial of Service Vulnerability
18891| [77086] Apache Ambari CVE-2015-1775 Server Side Request Forgery Security Bypass Vulnerability
18892| [77085] Apache Ambari CVE-2015-3270 Remote Privilege Escalation Vulnerability
18893| [77082] Apache Ambari 'targetURI' Parameter Open Redirection Vulnerability
18894| [77059] Apache Ambari CVE-2015-3186 Cross Site Scripting Vulnerability
18895| [76933] Apache James Server Unspecified Command Execution Vulnerability
18896| [76832] Apache cordova-plugin-file-transfer CVE-2015-5204 HTTP Header Injection Vulnerability
18897| [76625] Apache Struts CVE-2015-5169 Cross Site Scripting Vulnerability
18898| [76624] Apache Struts CVE-2015-2992 Cross Site Scripting Vulnerability
18899| [76522] Apache Tapestry CVE-2014-1972 Security Bypass Vulnerability
18900| [76486] Apache CXF Fediz CVE-2015-5175 Denial of Service Vulnerability
18901| [76452] Apache ActiveMQ CVE-2015-1830 Directory Traversal Vulnerability
18902| [76446] Apache Subversion 'libsvn_fs_fs/tree.c' Denial of Service Vulnerability
18903| [76274] Apache Subversion CVE-2015-3184 Information Disclosure Vulnerability
18904| [76273] Apache Subversion CVE-2015-3187 Information Disclosure Vulnerability
18905| [76272] Apache ActiveMQ CVE-2014-3576 Denial of Service Vulnerability
18906| [76221] Apache Ranger CVE-2015-0266 Access Bypass Vulnerability
18907| [76208] Apache Ranger CVE-2015-0265 JavaScript Code Injection Vulnerability
18908| [76025] Apache ActiveMQ Artemis CVE-2015-3208 XML External Entity Information Disclosure Vulnerability
18909| [75965] Apache HTTP Server CVE-2015-3185 Security Bypass Vulnerability
18910| [75964] Apache HTTP Server CVE-2015-0253 Remote Denial of Service Vulnerability
18911| [75963] Apache HTTP Server CVE-2015-3183 Security Vulnerability
18912| [75940] Apache Struts CVE-2015-1831 Security Bypass Vulnerability
18913| [75919] Apache Groovy CVE-2015-3253 Remote Code Execution Vulnerability
18914| [75338] Apache Storm CVE-2015-3188 Remote Code Execution Vulnerability
18915| [75275] Drupal Apache Solr Real-Time Module Access Bypass Vulnerability
18916| [74866] Apache Cordova For Android CVE-2015-1835 Security Bypass Vulnerability
18917| [74839] Apache Sling API and Sling Servlets CVE-2015-2944 Cross Site Scripting Vulnerability
18918| [74761] Apache Jackrabbit CVE-2015-1833 XML External Entity Information Disclosure Vulnerability
18919| [74686] Apache Ambari '/var/lib/ambari-server/ambari-env.sh' Local Privilege Escalation Vulnerability
18920| [74665] Apache Tomcat CVE-2014-7810 Security Bypass Vulnerability
18921| [74475] Apache Tomcat CVE-2014-0230 Denial of Service Vulnerability
18922| [74423] Apache Struts CVE-2015-0899 Security Bypass Vulnerability
18923| [74338] Apache OpenOffice HWP Filter Memory Corruption Vulnerability
18924| [74265] Apache Tomcat 'mod_jk' CVE-2014-8111 Information Disclosure Vulnerability
18925| [74260] Apache Subversion CVE-2015-0248 Multiple Denial of Service Vulnerabilities
18926| [74259] Apache Subversion 'deadprops.c' Security Bypass Vulnerability
18927| [74204] PHP 'sapi/apache2handler/sapi_apache2.c' Remote Code Execution Vulnerability
18928| [74158] Apache HTTP Server 'protocol.c' Remote Denial of Service Vulnerability
18929| [73954] Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability
18930| [73851] Apache2 CVE-2012-0216 Cross-Site Scripting Vulnerability
18931| [73478] Apache Cassandra CVE-2015-0225 Remote Code Execution Vulnerability
18932| [73041] Apache HTTP Server 'mod_lua' Module Denial of Service Vulnerability
18933| [73040] Apache HTTP Server 'mod_lua.c' Local Access Bypass Vulnerability
18934| [72809] Apache Standard Taglibs CVE-2015-0254 XML External Entity Injection Vulnerability
18935| [72717] Apache Tomcat CVE-2014-0227 Chunk Request Remote Denial Of Service Vulnerability
18936| [72557] Apache WSS4J CVE-2015-0227 Security Bypass Vulnerability
18937| [72553] Apache WSS4J CVE-2015-0226 Information Disclosure Vulnerability
18938| [72513] Apache ActiveMQ CVE-2014-3612 LDAP Authentication Bypass Vulnerability
18939| [72511] Apache ActiveMQ CVE-2014-8110 Multiple Cross Site Scripting Vulnerabilities
18940| [72510] Apache ActiveMQ CVE-2014-3600 XML External Entity Injection Vulnerability
18941| [72508] Apache ActiveMQ Apollo CVE-2014-3579 XML External Entity Injection Vulnerability
18942| [72319] Apache Qpid CVE-2015-0223 Security Bypass Vulnerability
18943| [72317] Apache Qpid CVE-2015-0224 Incomplete Fix Multiple Denial of Service Vulnerabilities
18944| [72115] Apache Santuario 'XML Signature Verification' Security Bypass Vulnerability
18945| [72053] Apache HTTP Server 'mod_remoteip.c' IP Address Spoofing Vulnerability
18946| [72030] Apache Qpid CVE-2015-0203 Multiple Denial of Service Vulnerabilities
18947| [71879] Apache Traffic Server 'HttpTransact.cc' Denial of Service Vulnerability
18948| [71726] Apache Subversion CVE-2014-3580 Remote Denial of Service Vulnerability
18949| [71725] Apache Subversion CVE-2014-8108 Remote Denial of Service Vulnerability
18950| [71657] Apache HTTP Server 'mod_proxy_fcgi' Module Denial of Service Vulnerability
18951| [71656] Apache HTTP Server 'mod_cache' Module Denial of Service Vulnerability
18952| [71548] Apache Struts CVE-2014-7809 Security Bypass Vulnerability
18953| [71466] Apache Hadoop CVE-2014-3627 Information Disclosure Vulnerability
18954| [71353] Apache HTTP Server 'LuaAuthzProvider' Authorization Bypass Vulnerability
18955| [71004] Apache Qpid CVE-2014-3629 XML External Entity Injection Vulnerability
18956| [70970] Apache Traffic Server Cross Site Scripting Vulnerability
18957| [70738] Apache CXF CVE-2014-3584 Denial of Service Vulnerability
18958| [70736] Apache CXF SAML SubjectConfirmation Security Bypass Vulnerability
18959| [69728] Apache Tomcat CVE-2013-4444 Arbitrary File Upload Vulnerability
18960| [69648] Apache POI CVE-2014-3574 Denial Of Service Vulnerability
18961| [69647] Apache POI OpenXML parser CVE-2014-3529 XML External Entity Information Disclosure Vulnerability
18962| [69351] Apache OpenOffice Calc CVE-2014-3524 Command Injection Vulnerability
18963| [69295] Apache Axis Incomplete Fix CVE-2014-3596 SSL Certificate Validation Security Bypass Vulnerability
18964| [69286] Apache OFBiz CVE-2014-0232 Multiple Cross Site Scripting Vulnerabilities
18965| [69258] Apache HttpComponents Incomplete Fix CVE-2014-3577 SSL Validation Security Bypass Vulnerability
18966| [69257] Apache HttpComponents Incomplete Fix SSL Certificate Validation Security Bypass Vulnerability
18967| [69248] Apache HTTP Server CVE-2013-4352 Remote Denial of Service Vulnerability
18968| [69237] Apache Subversion CVE-2014-3522 SSL Certificate Validation Information Disclosure Vulnerability
18969| [69173] Apache Traffic Server CVE-2014-3525 Unspecified Security Vulnerability
18970| [69046] Apache Cordova For Android CVE-2014-3502 Information Disclosure Vulnerability
18971| [69041] Apache Cordova For Android CVE-2014-3501 Security Bypass Vulnerability
18972| [69038] Apache Cordova For Android CVE-2014-3500 Security Bypass Vulnerability
18973| [68995] Apache Subversion CVE-2014-3528 Insecure Authentication Weakness
18974| [68966] Apache Subversion 'irkerbridge.py' Local Privilege Escalation Vulnerability
18975| [68965] Apache Subversion 'svnwcsub.py' Local Privilege Escalation Vulnerability
18976| [68863] Apache HTTP Server 'mod_cache' Module Remote Denial of Service Vulnerability
18977| [68747] Apache HTTP Server CVE-2014-3523 Remote Denial of Service Vulnerability
18978| [68745] Apache HTTP Server CVE-2014-0118 Remote Denial of Service Vulnerability
18979| [68742] Apache HTTP Server CVE-2014-0231 Remote Denial of Service Vulnerability
18980| [68740] Apache HTTP Server CVE-2014-0117 Remote Denial of Service Vulnerability
18981| [68678] Apache HTTP Server 'mod_status' CVE-2014-0226 Remote Code Execution Vulnerability
18982| [68445] Apache CXF UsernameToken Information Disclosure Vulnerability
18983| [68441] Apache CXF SAML Tokens Validation Security Bypass Vulnerability
18984| [68431] Apache Syncope CVE-2014-3503 Insecure Password Generation Weakness
18985| [68229] Apache Harmony PRNG Entropy Weakness
18986| [68111] Apache 'mod_wsgi' Module Privilege Escalation Vulnerability
18987| [68072] Apache Tomcat CVE-2014-0186 Remote Denial of Service Vulnerability
18988| [68039] Apache Hive CVE-2014-0228 Security Bypass Vulnerability
18989| [67673] Apache Tomcat CVE-2014-0095 AJP Request Remote Denial Of Service Vulnerability
18990| [67671] Apache Tomcat CVE-2014-0075 Chunk Request Remote Denial Of Service Vulnerability
18991| [67669] Apache Tomcat CVE-2014-0119 XML External Entity Information Disclosure Vulnerability
18992| [67668] Apache Tomcat CVE-2014-0099 Request Processing Information Disclosure Vulnerability
18993| [67667] Apache Tomcat CVE-2014-0096 XML External Entity Information Disclosure Vulnerability
18994| [67534] Apache 'mod_wsgi' Module CVE-2014-0242 Information Disclosure Vulnerability
18995| [67532] Apache 'mod_wsgi' Module Local Privilege Escalation Vulnerability
18996| [67530] Apache Solr Search Template Cross Site Scripting Vulnerability
18997| [67236] Apache CXF CVE-2014-0109 Remote Denial of Service Vulnerability
18998| [67232] Apache CXF CVE-2014-0110 Denial of Service Vulnerability
18999| [67121] Apache Struts ClassLoader Manipulation CVE-2014-0114 Security Bypass Vulnerability
19000| [67081] Apache Struts 'getClass()' Method Security Bypass Vulnerability
19001| [67064] Apache Struts ClassLoader Manipulation Incomplete Fix Security Bypass Vulnerability
19002| [67013] Apache Zookeeper CVE-2014-0085 Local Information Disclosure Vulnerability
19003| [66998] Apache Archiva CVE-2013-2187 Unspecified Cross Site Scripting Vulnerability
19004| [66991] Apache Archiva CVE-2013-2187 HTML Injection Vulnerability
19005| [66927] Apache Syncope CVE-2014-0111 Remote Code Execution Vulnerability
19006| [66474] Apache CouchDB Universally Unique IDentifier (UUID) Remote Denial of Service Vulnerability
19007| [66397] Apache Xalan-Java Library CVE-2014-0107 Security Bypass Vulnerability
19008| [66303] Apache HTTP Server Multiple Denial of Service Vulnerabilities
19009| [66041] RETIRED: Apache Struts CVE-2014-0094 Classloader Manipulation Security Bypass Vulnerability
19010| [65999] Apache Struts ClassLoader Manipulation CVE-2014-0094 Security Bypass Vulnerability
19011| [65967] Apache Cordova File-Transfer Unspecified Security Vulnerability
19012| [65959] Apache Cordova InAppBrowser Remote Privilege Escalation Vulnerability
19013| [65935] Apache Shiro 'login.jsp' Authentication Bypass Vulnerability
19014| [65902] Apache Camel CVE-2014-0003 Remote Code Execution Vulnerability
19015| [65901] Apache Camel CVE-2014-0002 XML External Entity Information Disclosure Vulnerability
19016| [65773] Apache Tomcat CVE-2013-4286 Security Bypass Vulnerability
19017| [65769] Apache Tomcat CVE-2014-0033 Session Fixation Vulnerability
19018| [65768] Apache Tomcat CVE-2013-4590 XML External Entity Information Disclosure Vulnerability
19019| [65767] Apache Tomcat CVE-2013-4322 Incomplete Fix Denial of Service Vulnerability
19020| [65615] Apache ActiveMQ 'refresh' Parameter Cross Site Scripting Vulnerability
19021| [65434] Apache Subversion 'mod_dav_svn' Module SVNListParentPath Denial of Service Vulnerability
19022| [65431] Apache Wicket CVE-2013-2055 Information Disclosure Vulnerability
19023| [65400] Apache Commons FileUpload CVE-2014-0050 Denial Of Service Vulnerability
19024| [64782] Apache CloudStack Virtual Router Component Security Bypass Vulnerability
19025| [64780] Apache CloudStack Unauthorized Access Vulnerability
19026| [64617] Apache Libcloud Digital Ocean API Local Information Disclosure Vulnerability
19027| [64437] Apache Santuario XML Security For JAVA XML Signature Denial of Service Vulnerability
19028| [64427] Apache Solr Multiple XML External Entity Injection Vulnerabilities
19029| [64009] Apache Solr CVE-2013-6408 XML External Entity Injection Vulnerability
19030| [64008] Apache Solr CVE-2013-6407 XML External Entity Injection Vulnerability
19031| [63981] Apache Subversion 'mod_dav_svn' Module Denial of Service Vulnerability
19032| [63966] Apache Subversion CVE-2013-4505 Security Bypass Vulnerability
19033| [63963] Apache Roller CVE-2013-4171 Cross Site Scripting Vulnerability
19034| [63935] Apache Solr 'SolrResourceLoader' Directory Traversal Vulnerability
19035| [63928] Apache Roller CVE-2013-4212 OGNL Expression Injection Remote Code Execution Vulnerability
19036| [63515] Apache Tomcat Manager Component CVE-2013-6357 Cross Site Request Forgery Vulnerability
19037| [63403] Apache Struts Multiple Cross Site Scripting Vulnerabilities
19038| [63400] Apache 'mod_pagespeed' Module Unspecified Cross Site Scripting Vulnerability
19039| [63260] Apache Shindig CVE-2013-4295 XML External Entity Information Disclosure Vulnerability
19040| [63241] Apache Sling 'AbstractAuthenticationFormServlet' Open Redirection Vulnerability
19041| [63174] Apache Commons FileUpload 'DiskFileItem' Class Null Byte Arbitrary File Write Vulnerability
19042| [62939] Apache 'mod_fcgid' Module CVE-2013-4365 Heap Buffer Overflow Vulnerability
19043| [62903] Apache Sling 'deepGetOrCreateNode()' Function Denial Of Service Vulnerability
19044| [62706] Apache Camel CVE-2013-4330 Information Disclosure Vulnerability
19045| [62677] Apache 'mod_accounting' Module CVE-2013-5697 SQL Injection Vulnerability
19046| [62674] TYPO3 Apache Solr Unspecified Cross Site Scripting and PHP Code Execution Vulnerabilities
19047| [62587] Apache Struts CVE-2013-4316 Remote Code Execution Vulnerability
19048| [62584] Apache Struts CVE-2013-4310 Security Bypass Vulnerability
19049| [62266] Apache Subversion CVE-2013-4277 Insecure Temporary File Creation Vulnerability
19050| [61984] Apache Hadoop RPC Authentication CVE-2013-2192 Man in the Middle Security Bypass Vulnerability
19051| [61981] Apache HBase RPC Authentication Man In The Middle Security Bypass Vulnerability
19052| [61638] Apache CloudStack CVE-2013-2136 Multiple Cross Site Scripting Vulnerabilities
19053| [61454] Apache Subversion CVE-2013-4131 Denial Of Service Vulnerability
19054| [61379] Apache HTTP Server CVE-2013-2249 Unspecified Remote Security Vulnerability
19055| [61370] Apache OFBiz CVE-2013-2317 'View Log' Cross Site Scripting Vulnerability
19056| [61369] Apache OFBiz Nested Expression Remote Code Execution Vulnerability
19057| [61196] Apache Struts CVE-2013-2248 Multiple Open Redirection Vulnerabilities
19058| [61189] Apache Struts CVE-2013-2251 Multiple Remote Command Execution Vulnerabilities
19059| [61129] Apache HTTP Server CVE-2013-1896 Remote Denial of Service Vulnerability
19060| [61030] Apache CXF CVE-2013-2160 Multiple Remote Denial of Service Vulnerabilities
19061| [60875] Apache Geronimo RMI Classloader Security Bypass Vulnerability
19062| [60846] Apache Santuario XML Security for JAVA XML Signature CVE-2013-2172 Security Bypass Vulnerability
19063| [60817] Apache Santuario XML Security for C++ CVE-2013-2210 Heap Buffer Overflow Vulnerability
19064| [60800] Apache Qpid Python Client SSL Certificate Verification Information Disclosure Vulnerability
19065| [60599] Apache Santuario XML Security for C++ CVE-2013-2156 Remote Heap Buffer Overflow Vulnerability
19066| [60595] Apache Santuario XML Security for C++ XML Signature CVE-2013-2155 Denial of Service Vulnerability
19067| [60594] Apache Santuario XML Security for C++ CVE-2013-2154 Stack Buffer Overflow Vulnerability
19068| [60592] Apache Santuario XML Security for C++ XML Signature CVE-2013-2153 Security Bypass Vulnerability
19069| [60534] Apache OpenJPA Object Deserialization Arbitrary File Creation or Overwrite Vulnerability
19070| [60346] Apache Struts CVE-2013-2134 OGNL Expression Injection Vulnerability
19071| [60345] Apache Struts CVE-2013-2135 OGNL Expression Injection Vulnerability
19072| [60267] Apache Subversion CVE-2013-1968 Remote Denial of Service Vulnerability
19073| [60265] Apache Subversion CVE-2013-2088 Command Injection Vulnerability
19074| [60264] Apache Subversion CVE-2013-2112 Remote Denial of Service Vulnerability
19075| [60187] Apache Tomcat DIGEST Authentication CVE-2013-2051 Incomplete Fix Security Weakness
19076| [60186] Apache Tomcat CVE-2013-1976 Insecure Temporary File Handling Vulnerability
19077| [60167] Apache Struts 'includeParams' CVE-2013-2115 Incomplete Fix Security Bypass Vulnerability
19078| [60166] Apache Struts 'includeParams' CVE-2013-1966 Security Bypass Vulnerability
19079| [60082] Apache Struts 'ParameterInterceptor' Class OGNL CVE-2013-1965 Security Bypass Vulnerability
19080| [59826] Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability
19081| [59799] Apache Tomcat CVE-2013-2067 Session Fixation Vulnerability
19082| [59798] Apache Tomcat CVE-2013-2071 Information Disclosure Vulnerability
19083| [59797] Apache Tomcat CVE-2012-3544 Denial of Service Vulnerability
19084| [59670] Apache VCL Multiple Input Validation Vulnerabilities
19085| [59464] Apache CloudStack CVE-2013-2758 Hash Information Disclosure Vulnerability
19086| [59463] Apache CloudStack CVE-2013-2756 Authentication Bypass Vulnerability
19087| [59402] Apache ActiveMQ CVE-2013-3060 Information Disclosure and Denial of Service Vulnerability
19088| [59401] Apache ActiveMQ CVE-2012-6551 Denial of Service Vulnerability
19089| [59400] Apache ActiveMQ CVE-2012-6092 Multiple Cross Site Scripting Vulnerabilities
19090| [58898] Apache Subversion CVE-2013-1884 Remote Denial of Service Vulnerability
19091| [58897] Apache Subversion 'mod_dav_svn/lock.c' Remote Denial of Service Vulnerability
19092| [58895] Apache Subversion 'mod_dav_svn' Remote Denial of Service Vulnerability
19093| [58455] Apache Rave User RPC API CVE-2013-1814 Information Disclosure Vulnerability
19094| [58379] Apache Qpid CVE-2012-4446 Authentication Bypass Vulnerability
19095| [58378] Apache Qpid CVE-2012-4460 Denial of Service Vulnerability
19096| [58376] Apache Qpid CVE-2012-4458 Denial of Service Vulnerability
19097| [58337] Apache Qpid CVE-2012-4459 Denial of Service Vulnerability
19098| [58326] Apache Commons FileUpload CVE-2013-0248 Insecure Temporary File Creation Vulnerability
19099| [58325] Debian Apache HTTP Server CVE-2013-1048 Symlink Attack Local Privilege Escalation Vulnerability
19100| [58323] Apache Subversion 'svn_fs_file_length()' Remote Denial of Service Vulnerability
19101| [58165] Apache HTTP Server Multiple Cross Site Scripting Vulnerabilities
19102| [58136] Apache Maven CVE-2013-0253 SSL Certificate Validation Security Bypass Vulnerability
19103| [58124] Apache Tomcat 'log/logdir' Directory Insecure File Permissions Vulnerability
19104| [58073] Apache Commons HttpClient CVE-2012-5783 SSL Certificate Validation Security Bypass Vulnerability
19105| [57876] Apache CXF WS-SecurityPolicy Authentication Bypass Vulnerability
19106| [57874] Apache CXF CVE-2012-5633 Security Bypass Vulnerability
19107| [57463] Apache OFBiz CVE-2013-0177 Multiple Cross Site Scripting Vulnerabilities
19108| [57425] Apache CXF CVE-2012-5786 SSL Certificate Validation Security Bypass Vulnerability
19109| [57321] Apache CouchDB CVE-2012-5650 Cross Site Scripting Vulnerability
19110| [57314] Apache CouchDB CVE-2012-5649 Remote Code Execution Vulnerability
19111| [57267] Apache Axis2/C SSL Certificate Validation Security Bypass Vulnerability
19112| [57259] Apache CloudStack CVE-2012-5616 Local Information Disclosure Vulnerability
19113| [56814] Apache Tomcat CVE-2012-4431 Cross-Site Request Forgery Vulnerability
19114| [56813] Apache Tomcat CVE-2012-4534 Denial of Service Vulnerability
19115| [56812] Apache Tomcat CVE-2012-3546 Security Bypass Vulnerability
19116| [56753] Apache Apache HTTP Server 'mod_proxy_ajp Module Denial Of Service Vulnerability
19117| [56686] Apache Tomcat CVE-2012-5568 Denial of Service Vulnerability
19118| [56408] Apache Axis and Axis2/Java SSL Certificate Validation Security Bypass Vulnerability
19119| [56403] Apache Tomcat DIGEST Authentication Multiple Security Weaknesses
19120| [56402] Apache Tomcat CVE-2012-2733 Denial of Service Vulnerability
19121| [56171] Apache OFBiz CVE-2012-3506 Unspecified Security Vulnerability
19122| [55876] Apache CloudStack CVE-2012-4501 Security Bypass Vulnerability
19123| [55628] Apache CXF SOAP Action Spoofing Security Bypass Vulnerability
19124| [55608] Apache Qpid (qpidd) Denial of Service Vulnerability
19125| [55536] Apache 'mod_pagespeed' Module Cross Site Scripting and Security Bypass Vulnerabilities
19126| [55508] Apache Axis2 XML Signature Wrapping Security Vulnerability
19127| [55445] Apache Wicket CVE-2012-3373 Cross Site Scripting Vulnerability
19128| [55346] Apache Struts Cross Site Request Forgery and Denial of Service Vulnerabilities
19129| [55290] Drupal Apache Solr Autocomplete Module Cross Site Scripting Vulnerability
19130| [55165] Apache Struts2 Skill Name Remote Code Execution Vulnerability
19131| [55154] Apache 'mod-rpaf' Module Denial of Service Vulnerability
19132| [55131] Apache HTTP Server HTML-Injection And Information Disclosure Vulnerabilities
19133| [54954] Apache QPID NullAuthenticator Authentication Bypass Vulnerability
19134| [54798] Apache Libcloud Man In The Middle Vulnerability
19135| [54358] Apache Hadoop CVE-2012-3376 Information Disclosure Vulnerability
19136| [54341] Apache Sling CVE-2012-2138 Denial Of Service Vulnerability
19137| [54268] Apache Hadoop Symlink Attack Local Privilege Escalation Vulnerability
19138| [54189] Apache Roller Cross Site Request Forgery Vulnerability
19139| [54187] Apache Roller CVE-2012-2381 Cross Site Scripting Vulnerability
19140| [53880] Apache CXF Child Policies Security Bypass Vulnerability
19141| [53877] Apache CXF Elements Validation Security Bypass Vulnerability
19142| [53676] Apache Commons Compress and Apache Ant CVE-2012-2098 Denial Of Service Vulnerability
19143| [53487] Apache POI CVE-2012-0213 Denial Of Service Vulnerability
19144| [53455] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability
19145| [53305] Apache Qpid CVE-2011-3620 Unauthorized Access Security Bypass Vulnerability
19146| [53046] Apache HTTP Server 'LD_LIBRARY_PATH' Insecure Library Loading Arbitrary Code Execution Vulnerability
19147| [53025] Apache OFBiz Unspecified Remote Code Execution Vulnerability
19148| [53023] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
19149| [52939] Apache Hadoop CVE-2012-1574 Unspecified User Impersonation Vulnerability
19150| [52702] Apache Struts2 'XSLTResult.java' Remote Arbitrary File Upload Vulnerability
19151| [52696] Apache Traffic Server HTTP Host Header Handling Heap Based Buffer Overflow Vulnerability
19152| [52680] Apache Wicket 'pageMapName' Parameter Cross Site Scripting Vulnerability
19153| [52679] Apache Wicket Hidden Files Information Disclosure Vulnerability
19154| [52565] Apache 'mod_fcgid' Module Denial Of Service Vulnerability
19155| [52146] TYPO3 Apache Solr Extension Unspecified Cross Site Scripting Vulnerability
19156| [51939] Apache MyFaces 'ln' Parameter Information Disclosure Vulnerability
19157| [51917] Apache APR Hash Collision Denial Of Service Vulnerability
19158| [51902] Apache Struts Multiple HTML Injection Vulnerabilities
19159| [51900] Apache Struts CVE-2012-1007 Multiple Cross Site Scripting Vulnerabilities
19160| [51886] Apache CXF UsernameToken Policy Validation Security Bypass Vulnerability
19161| [51869] Apache HTTP Server CVE-2011-3639 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
19162| [51706] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
19163| [51705] Apache HTTP Server CVE-2012-0021 mod_log_config Denial Of Service Vulnerability
19164| [51628] Apache Struts 'ParameterInterceptor' Class OGNL (CVE-2011-3923) Security Bypass Vulnerability
19165| [51447] Apache Tomcat Parameter Handling Denial of Service Vulnerability
19166| [51442] Apache Tomcat Request Object Security Bypass Vulnerability
19167| [51407] Apache HTTP Server Scoreboard Local Security Bypass Vulnerability
19168| [51257] Apache Struts Remote Command Execution and Arbitrary File Overwrite Vulnerabilities
19169| [51238] Apache Geronimo Hash Collision Denial Of Service Vulnerability
19170| [51200] Apache Tomcat Hash Collision Denial Of Service Vulnerability
19171| [50940] Apache Struts Session Tampering Security Bypass Vulnerability
19172| [50912] RETIRED: Apache MyFaces CVE-2011-4343 Information Disclosure Vulnerability
19173| [50904] Apache ActiveMQ Failover Mechanism Remote Denial Of Service Vulnerability
19174| [50848] Apache MyFaces EL Expression Evaluation Security Bypass Vulnerability
19175| [50802] Apache HTTP Server 'mod_proxy' Reverse Proxy Security Bypass Vulnerability
19176| [50639] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
19177| [50603] Apache Tomcat Manager Application Security Bypass Vulnerability
19178| [50494] Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
19179| [49957] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
19180| [49762] Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses
19181| [49728] Apache Struts Conversion Error OGNL Expression Evaluation Vulnerability
19182| [49616] Apache HTTP Server CVE-2011-3348 Denial Of Service Vulnerability
19183| [49470] Apache Tomcat CVE-2007-6286 Duplicate Request Processing Security Vulnerability
19184| [49353] Apache Tomcat AJP Protocol Security Bypass Vulnerability
19185| [49303] Apache HTTP Server CVE-2011-3192 Denial Of Service Vulnerability
19186| [49290] Apache Wicket Cross Site Scripting Vulnerability
19187| [49147] Apache Tomcat CVE-2011-2481 Information Disclosure Vulnerability
19188| [49143] Apache Commons Daemon 'jsvc' Information Disclosure Vulnerability
19189| [48667] Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
19190| [48653] Apache 'mod_authnz_external' Module SQL Injection Vulnerability
19191| [48611] Apache XML Security for C++ Signature Key Parsing Denial of Service Vulnerability
19192| [48456] Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability
19193| [48015] Apache Archiva Multiple Cross Site Request Forgery Vulnerabilities
19194| [48011] Apache Archiva Multiple Cross Site Scripting and HTML Injection Vulnerabilities
19195| [47929] Apache APR 'apr_fnmatch.c' Denial of Service Vulnerability
19196| [47890] Apache Struts 'javatemplates' Plugin Multiple Cross Site Scripting Vulnerabilities
19197| [47886] Apache Tomcat SecurityConstraints Security Bypass Vulnerability
19198| [47820] Apache APR 'apr_fnmatch()' Denial of Service Vulnerability
19199| [47784] Apache Struts XWork 's:submit' HTML Tag Cross Site Scripting Vulnerability
19200| [47199] Apache Tomcat HTTP BIO Connector Information Disclosure Vulnerability
19201| [47196] Apache Tomcat Login Constraints Security Bypass Vulnerability
19202| [46974] Apache HttpComponents 'HttpClient' Information Disclosure Vulnerability
19203| [46953] Apache MPM-ITK Module Security Weakness
19204| [46734] Subversion 'mod_dav_svn' Apache Server NULL Pointer Dereference Denial Of Service Vulnerability
19205| [46685] Apache Tomcat '@ServletSecurity' Annotations Security Bypass Vulnerability
19206| [46311] Apache Continuum and Archiva Cross Site Scripting Vulnerability
19207| [46177] Apache Tomcat SecurityManager Security Bypass Vulnerability
19208| [46174] Apache Tomcat HTML Manager Interface HTML Injection Vulnerability
19209| [46166] Apache Tomcat JVM Denial of Service Vulnerability
19210| [46164] Apache Tomcat NIO Connector Denial of Service Vulnerability
19211| [46066] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
19212| [45655] Apache Subversion Server Component Multiple Remote Denial Of Service Vulnerabilities
19213| [45123] Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability
19214| [45095] Apache Archiva Cross Site Request Forgery Vulnerability
19215| [45015] Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities
19216| [44900] Apache 'mod_fcgid' Module Unspecified Stack Buffer Overflow Vulnerability
19217| [44616] Apache Shiro Directory Traversal Vulnerability
19218| [44355] Apache MyFaces Encrypted View State Oracle Padding Security Vulnerability
19219| [44068] Apache::AuthenHook Local Information Disclosure Vulnerability
19220| [43862] Apache QPID SSL Connection Denial of Service Vulnerability
19221| [43673] Apache APR-util 'apr_brigade_split_line()' Denial of Service Vulnerability
19222| [43637] Apache XML-RPC SAX Parser Information Disclosure Vulnerability
19223| [43111] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
19224| [42637] Apache Derby 'BUILTIN' Authentication Insecure Password Hashing Vulnerability
19225| [42501] Apache CouchDB Cross Site Request Forgery Vulnerability
19226| [42492] Apache CXF XML DTD Processing Security Vulnerability
19227| [42121] Apache SLMS Insufficient Quoting Cross Site Request Forgery Vulnerability
19228| [42102] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
19229| [41963] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
19230| [41544] Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities
19231| [41076] Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability
19232| [40976] Apache Axis2 Document Type Declaration Processing Security Vulnerability
19233| [40827] Apache 'mod_proxy_http' Timeout Handling Information Disclosure Vulnerability
19234| [40343] Apache Axis2 'xsd' Parameter Directory Traversal Vulnerability
19235| [40327] Apache Axis2 'engagingglobally' Cross-Site Scripting Vulnerability
19236| [39771] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
19237| [39636] Apache ActiveMQ Source Code Information Disclosure Vulnerability
19238| [39635] Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability
19239| [39538] Apache mod_auth_shadow Race Condition Security Bypass Vulnerability
19240| [39489] Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities
19241| [39119] Apache ActiveMQ 'createDestination.action' HTML Injection Vulnerability
19242| [38580] Apache Subrequest Handling Information Disclosure Vulnerability
19243| [38494] Apache 'mod_isapi' Memory Corruption Vulnerability
19244| [38491] Apache mod_proxy_ajp Module Incoming Request Body Denial Of Service Vulnerability
19245| [37966] Apache 1.3 mod_proxy HTTP Chunked Encoding Integer Overflow Vulnerability
19246| [37945] Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability
19247| [37944] Apache Tomcat WAR File Directory Traversal Vulnerability
19248| [37942] Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability
19249| [37149] Apache Tomcat 404 Error Page Cross Site Scripting Vulnerability
19250| [37027] RETIRED: Apache APR 'apr_uri_parse_hostinfo' Off By One Remote Code Execution Vulnerability
19251| [36990] Apache HTTP TRACE Cross Site Scripting Vulnerability
19252| [36954] Apache Tomcat Windows Installer Insecure Password Vulnerability
19253| [36889] TYPO3 Apache Solr Search Extension Unspecified Cross Site Scripting Vulnerability
19254| [36596] Apache HTTP Server Solaris Event Port Pollset Support Remote Denial Of Service Vulnerability
19255| [36260] Apache mod_proxy_ftp Module NULL Pointer Dereference Denial Of Service Vulnerability
19256| [36254] Apache mod_proxy_ftp Remote Command Injection Vulnerability
19257| [35949] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
19258| [35840] Apache HTTP Server HTTP-Basic Authentication Bypass Vulnerability
19259| [35623] Apache 'mod_deflate' Remote Denial Of Service Vulnerability
19260| [35565] Apache 'mod_proxy' Remote Denial Of Service Vulnerability
19261| [35416] Apache Tomcat XML Parser Information Disclosure Vulnerability
19262| [35263] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
19263| [35253] Apache APR-util 'xml/apr_xml.c' Denial of Service Vulnerability
19264| [35251] Apache APR-util 'apr_brigade_vprintf' Off By One Vulnerability
19265| [35221] Apache APR-util 'apr_strmatch_precompile()' Integer Underflow Vulnerability
19266| [35196] Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness
19267| [35193] Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability
19268| [35115] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
19269| [34686] Apache Struts Multiple Cross Site Scripting Vulnerabilities
19270| [34663] Apache 'mod_proxy_ajp' Information Disclosure Vulnerability
19271| [34657] Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities
19272| [34562] Apache Geronimo Application Server Multiple Remote Vulnerabilities
19273| [34552] Apache ActiveMQ Web Console Multiple Unspecified HTML Injection Vulnerabilities
19274| [34412] Apache Tomcat mod_jk Content Length Information Disclosure Vulnerability
19275| [34399] Apache Struts Unspecified Cross Site Scripting Vulnerability
19276| [34383] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
19277| [33913] Apache Tomcat POST Data Information Disclosure Vulnerability
19278| [33360] Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities
19279| [33110] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
19280| [32657] Novell NetWare ApacheAdmin Security Bypass Vulnerability
19281| [31805] Apache HTTP Server OS Fingerprinting Unspecified Security Vulnerability
19282| [31761] Oracle WebLogic Server Apache Connector Stack Based Buffer Overflow Vulnerability
19283| [31698] Apache Tomcat 'RemoteFilterValve' Security Bypass Vulnerability
19284| [31165] Kolab Groupware Server Apache Log File User Password Information Disclosure Vulnerability
19285| [30560] Apache 'mod_proxy_ftp' Wildcard Characters Cross-Site Scripting Vulnerability
19286| [30496] Apache Tomcat 'HttpServletResponse.sendError()' Cross Site Scripting Vulnerability
19287| [30494] Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability
19288| [29653] Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
19289| [29502] Apache Tomcat Host Manager Cross Site Scripting Vulnerability
19290| [28576] Apache-SSL Environment Variable Information Disclosure and Privilege Escalation Vulnerability
19291| [28484] Apache Tomcat Requests Containing MS-DOS Device Names Information Disclosure Vulnerability
19292| [28483] Apache Tomcat 'allowLinking' Accepts NULL Byte in URI Information Disclosure Vulnerability
19293| [28482] Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability
19294| [28481] Apache Tomcat Cross-Site Scripting Vulnerability
19295| [28477] Apache Tomcat AJP Connector Information Disclosure Vulnerability
19296| [27752] Apache mod_jk2 Host Header Multiple Stack Based Buffer Overflow Vulnerabilities
19297| [27706] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
19298| [27703] Apache Tomcat Parameter Processing Remote Information Disclosure Vulnerability
19299| [27409] Apache 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
19300| [27365] Apache Tomcat SingleSignOn Remote Information Disclosure Vulnerability
19301| [27237] Apache HTTP Server 2.2.6, 2.0.61 and 1.3.39 'mod_status' Cross-Site Scripting Vulnerability
19302| [27236] Apache 'mod_proxy_balancer' Multiple Vulnerabilities
19303| [27234] Apache 'mod_proxy_ftp' Undefined Charset UTF-7 Cross-Site Scripting Vulnerability
19304| [27006] Apache Tomcat JULI Logging Component Default Security Policy Vulnerability
19305| [26939] Apache HTTP Server Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
19306| [26838] Apache mod_imagemap and mod_imap Cross-Site Scripting Vulnerability
19307| [26762] Apache::AuthCAS Cookie SQL Injection Vulnerability
19308| [26663] Apache HTTP Server 413 Error HTTP Request Method Cross-Site Scripting Weakness
19309| [26287] Apache Geronimo SQLLoginModule Authentication Bypass Vulnerability
19310| [26070] Apache Tomcat WebDav Remote Information Disclosure Vulnerability
19311| [25804] Apache Geronimo Management EJB Security Bypass Vulnerability
19312| [25653] Apache Mod_AutoIndex.C Undefined Charset Cross-Site Scripting Vulnerability
19313| [25531] Apache Tomcat Cal2.JSP Cross-Site Scripting Vulnerability
19314| [25489] Apache HTTP Server Mod_Proxy Denial of Service Vulnerability
19315| [25316] Apache Tomcat Multiple Remote Information Disclosure Vulnerabilities
19316| [25314] Apache Tomcat Host Manager Servlet Cross Site Scripting Vulnerability
19317| [25174] Apache Tomcat Error Message Reporting Cross Site Scripting Vulnerability
19318| [24999] Apache Tomcat SendMailServlet Cross-Site Scripting Vulnerability
19319| [24759] MySQLDumper Apache Access Control Authentication Bypass Vulnerability
19320| [24649] Apache HTTP Server Mod_Cache Denial of Service Vulnerability
19321| [24645] Apache HTTP Server Mod_Status Cross-Site Scripting Vulnerability
19322| [24553] Apache Mod_Mem_Cache Information Disclosure Vulnerability
19323| [24524] Apache Tomcat Accept-Language Cross Site Scripting Vulnerability
19324| [24480] Apache MyFaces Tomahawk JSF Framework Autoscroll Parameter Cross Site Scripting Vulnerability
19325| [24476] Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability
19326| [24475] Apache Tomcat Manager and Host Manager Upload Script Cross-Site Scripting Vulnerability
19327| [24215] Apache HTTP Server Worker Process Multiple Denial of Service Vulnerabilities
19328| [24147] Apache Tomcat JK Connector Double Encoding Security Bypass Vulnerability
19329| [24058] Apache Tomcat Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
19330| [23687] Apache AXIS Non-Existent WSDL Path Information Disclosure Vulnerability
19331| [23438] Apache HTTPD suEXEC Local Multiple Privilege Escalation Weaknesses
19332| [22960] Apache HTTP Server Tomcat Directory Traversal Vulnerability
19333| [22849] Apache mod_python Output Filter Mode Information Disclosure Vulnerability
19334| [22791] Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability
19335| [22732] Debian Apache Root Shell Local Privilege Escalation Vulnerabilities
19336| [22388] Apache Stats Extract Function Multiple Input Validation Vulnerabilities
19337| [21865] Apache And Microsoft IIS Range Denial of Service Vulnerability
19338| [21214] Apache Mod_Auth_Kerb Off-By-One Denial of Service Vulnerability
19339| [20527] Apache Mod_TCL Remote Format String Vulnerability
19340| [19661] Apache HTTP Server Arbitrary HTTP Request Headers Security Weakness
19341| [19447] Apache CGI Script Source Code Information Disclosure Vulnerability
19342| [19204] Apache Mod_Rewrite Off-By-One Buffer Overflow Vulnerability
19343| [19106] Apache Tomcat Information Disclosure Vulnerability
19344| [18138] Apache James SMTP Denial Of Service Vulnerability
19345| [17342] Apache Struts Multiple Remote Vulnerabilities
19346| [17095] Apache Log4Net Denial Of Service Vulnerability
19347| [16916] Apache mod_python FileSession Code Execution Vulnerability
19348| [16710] Apache Libapreq2 Quadratic Behavior Denial of Service Vulnerability
19349| [16260] Apache Geronimo Multiple Input Validation Vulnerabilities
19350| [16153] Apache mod_auth_pgsql Multiple Format String Vulnerabilities
19351| [16152] Apache Mod_SSL Custom Error Document Remote Denial Of Service Vulnerability
19352| [15834] Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability
19353| [15765] Apache James Spooler Memory Leak Denial Of Service Vulnerability
19354| [15762] Apache MPM Worker.C Denial Of Service Vulnerability
19355| [15512] Apache Struts Error Response Cross-Site Scripting Vulnerability
19356| [15413] PHP Apache 2 Virtual() Safe_Mode and Open_Basedir Restriction Bypass Vulnerability
19357| [15325] Apache Tomcat Simultaneous Directory Listing Denial Of Service Vulnerability
19358| [15224] Apache Mod_Auth_Shadow Authentication Bypass Vulnerability
19359| [15177] PHP Apache 2 Local Denial of Service Vulnerability
19360| [14982] ApacheTop Insecure Temporary File Creation Vulnerability
19361| [14721] Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability
19362| [14660] Apache CGI Byterange Request Denial of Service Vulnerability
19363| [14366] Apache mod_ssl CRL Handling Off-By-One Buffer Overflow Vulnerability
19364| [14106] Apache HTTP Request Smuggling Vulnerability
19365| [13778] Apache HTPasswd Password Command Line Argument Buffer Overflow Vulnerability
19366| [13777] Apache HTPasswd User Command Line Argument Buffer Overflow Vulnerability
19367| [13756] Apache Tomcat Java Security Manager Bypass Vulnerability
19368| [13537] Apache HTDigest Realm Command Line Argument Buffer Overflow Vulnerability
19369| [12877] Apache mod_ssl ssl_io_filter_cleanup Remote Denial Of Service Vulnerability
19370| [12795] Apache Tomcat Remote Malformed Request Denial Of Service Vulnerability
19371| [12619] Apache Software Foundation Batik Squiggle Browser Access Validation Vulnerability
19372| [12519] Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
19373| [12308] Apache Utilities Insecure Temporary File Creation Vulnerability
19374| [12217] Apache mod_auth_radius Malformed RADIUS Server Reply Integer Overflow Vulnerability
19375| [12181] Mod_DOSEvasive Apache Module Local Insecure Temporary File Creation Vulnerability
19376| [11803] Apache Jakarta Results.JSP Remote Cross-Site Scripting Vulnerability
19377| [11471] Apache mod_include Local Buffer Overflow Vulnerability
19378| [11360] Apache mod_ssl SSLCipherSuite Restriction Bypass Vulnerability
19379| [11239] Apache Satisfy Directive Access Control Bypass Vulnerability
19380| [11187] Apache Web Server Remote IPv6 Buffer Overflow Vulnerability
19381| [11185] Apache Mod_DAV LOCK Denial Of Service Vulnerability
19382| [11182] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
19383| [11154] Apache mod_ssl Remote Denial of Service Vulnerability
19384| [11094] Apache mod_ssl Denial Of Service Vulnerability
19385| [10789] Apache mod_userdir Module Information Disclosure Vulnerability
19386| [10736] Apache 'mod_ssl' Log Function Format String Vulnerability
19387| [10619] Apache ap_escape_html Memory Allocation Denial Of Service Vulnerability
19388| [10508] Apache Mod_Proxy Remote Negative Content-Length Buffer Overflow Vulnerability
19389| [10478] ClueCentral Apache Suexec Patch Security Weakness
19390| [10355] Apache 'mod_ssl' 'ssl_util_uuencode_binary()' Stack Buffer Overflow Vulnerability
19391| [10212] Apache mod_auth Malformed Password Potential Memory Corruption Vulnerability
19392| [9933] Apache mod_disk_cache Module Client Authentication Credential Storage Weakness
19393| [9930] Apache Error and Access Logs Escape Sequence Injection Vulnerability
19394| [9921] Apache Connection Blocking Denial Of Service Vulnerability
19395| [9885] Apache Mod_Security Module SecFilterScanPost Off-By-One Buffer Overflow Vulnerability
19396| [9874] Apache HTAccess LIMIT Directive Bypass Configuration Error Weakness
19397| [9829] Apache Mod_Access Access Control Rule Bypass Vulnerability
19398| [9826] Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnerability
19399| [9733] Apache Cygwin Directory Traversal Vulnerability
19400| [9599] Apache mod_php Global Variables Information Disclosure Weakness
19401| [9590] Apache-SSL Client Certificate Forging Vulnerability
19402| [9571] Apache mod_digest Client-Supplied Nonce Verification Vulnerability
19403| [9471] Apache mod_perl Module File Descriptor Leakage Vulnerability
19404| [9404] Mod-Auth-Shadow Apache Module Expired User Credential Weakness
19405| [9302] Apache mod_php Module File Descriptor Leakage Vulnerability
19406| [9129] Apache mod_python Module Malformed Query Denial of Service Vulnerability
19407| [8926] Apache Web Server mod_cgid Module CGI Data Redirection Vulnerability
19408| [8919] Apache Mod_Security Module Heap Corruption Vulnerability
19409| [8911] Apache Web Server Multiple Module Local Buffer Overflow Vulnerability
19410| [8898] Red Hat Apache Directory Index Default Configuration Error
19411| [8883] Apache Cocoon Directory Traversal Vulnerability
19412| [8824] Apache Tomcat Non-HTTP Request Denial Of Service Vulnerability
19413| [8822] Apache Mod_Throttle Module Local Shared Memory Corruption Vulnerability
19414| [8725] Apache2 MOD_CGI STDERR Denial Of Service Vulnerability
19415| [8707] Apache htpasswd Password Entropy Weakness
19416| [8561] Apache::Gallery Insecure Local File Storage Privilege Escalation Vulnerability
19417| [8287] Mod_Mylo Apache Module REQSTR Buffer Overflow Vulnerability
19418| [8226] Apache HTTP Server Multiple Vulnerabilities
19419| [8138] Apache Web Server Type-Map Recursive Loop Denial Of Service Vulnerability
19420| [8137] Apache Web Server Prefork MPM Denial Of Service Vulnerability
19421| [8136] Macromedia Apache Web Server Encoded Space Source Disclosure Vulnerability
19422| [8135] Apache Web Server FTP Proxy IPV6 Denial Of Service Vulnerability
19423| [8134] Apache Web Server SSLCipherSuite Weak CipherSuite Renegotiation Weakness
19424| [7768] Apache Tomcat Insecure Directory Permissions Vulnerability
19425| [7725] Apache Basic Authentication Module Valid User Login Denial Of Service Vulnerability
19426| [7723] Apache APR_PSPrintf Memory Corruption Vulnerability
19427| [7448] Apache Mod_Auth_Any Remote Command Execution Vulnerability
19428| [7375] Apache Mod_Access_Referer NULL Pointer Dereference Denial of Service Vulnerability
19429| [7332] Apache Web Server OS2 Filestat Denial Of Service Vulnerability
19430| [7255] Apache Web Server File Descriptor Leakage Vulnerability
19431| [7254] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
19432| [6943] Apache Web Server MIME Boundary Information Disclosure Vulnerability
19433| [6939] Apache Web Server ETag Header Information Disclosure Weakness
19434| [6722] Apache Tomcat Web.XML File Contents Disclosure Vulnerability
19435| [6721] Apache Tomcat Null Byte Directory/File Disclosure Vulnerability
19436| [6720] Apache Tomcat Example Web Application Cross Site Scripting Vulnerability
19437| [6662] Apache Web Server MS-DOS Device Name Denial Of Service Vulnerability
19438| [6661] Apache Web Server Default Script Mapping Bypass Vulnerability
19439| [6660] Apache Web Server Illegal Character HTTP Request File Disclosure Vulnerability
19440| [6659] Apache Web Server MS-DOS Device Name Arbitrary Code Execution Vulnerability
19441| [6562] Apache Tomcat Invoker Servlet File Disclosure Vulnerability
19442| [6320] Apache/Tomcat Mod_JK Chunked Encoding Denial Of Service Vulnerability
19443| [6117] Apache mod_php File Descriptor Leakage Vulnerability
19444| [6065] Apache 2 WebDAV CGI POST Request Information Disclosure Vulnerability
19445| [5996] Apache AB.C Web Benchmarking Buffer Overflow Vulnerability
19446| [5995] Apache AB.C Web Benchmarking Read_Connection() Buffer Overflow Vulnerability
19447| [5993] Multiple Apache HTDigest Buffer Overflow Vulnerabilities
19448| [5992] Apache HTDigest Insecure Temporary File Vulnerability
19449| [5991] Apache HTDigest Arbitrary Command Execution Vulnerability
19450| [5990] Apache HTPasswd Insecure Temporary File Vulnerability
19451| [5981] Multiple Apache HTDigest and HTPassWD Component Vulnerabilites
19452| [5884] Apache Web Server Scoreboard Memory Segment Overwriting SIGUSR1 Sending Vulnerability
19453| [5847] Apache Server Side Include Cross Site Scripting Vulnerability
19454| [5838] Apache Tomcat 3.2 Directory Disclosure Vulnerability
19455| [5816] Apache 2 mod_dav Denial Of Service Vulnerability
19456| [5791] HP VirtualVault Apache mod_ssl Denial Of Service Vulnerability
19457| [5787] Apache Oversized STDERR Buffer Denial Of Service Vulnerability
19458| [5786] Apache Tomcat DefaultServlet File Disclosure Vulnerability
19459| [5542] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
19460| [5486] Apache 2.0 CGI Path Disclosure Vulnerability
19461| [5485] Apache 2.0 Path Disclosure Vulnerability
19462| [5434] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
19463| [5256] Apache httpd 2.0 CGI Error Path Disclosure Vulnerability
19464| [5194] Apache Tomcat DOS Device Name Cross Site Scripting Vulnerability
19465| [5193] Apache Tomcat Servlet Mapping Cross Site Scripting Vulnerability
19466| [5067] Apache Tomcat Null Character Malformed Request Denial Of Service Vulnerability
19467| [5054] Apache Tomcat Web Root Path Disclosure Vulnerability
19468| [5033] Apache Chunked-Encoding Memory Corruption Vulnerability
19469| [4995] Apache Tomcat JSP Engine Denial of Service Vulnerability
19470| [4878] Apache Tomcat RealPath.JSP Malformed Request Information Disclosure Vulnerability
19471| [4877] Apache Tomcat Example Files Web Root Path Disclosure Vulnerability
19472| [4876] Apache Tomcat Source.JSP Malformed Request Information Disclosure Vulnerability
19473| [4575] Apache Tomcat Servlet Path Disclosure Vulnerability
19474| [4557] Apache Tomcat System Path Information Disclosure Vulnerability
19475| [4437] Apache Error Message Cross-Site Scripting Vulnerability
19476| [4431] Apache PrintEnv/Test_CGI Script Injection Vulnerability
19477| [4358] Apache Double-Reverse Lookup Log Entry Spoofing Vulnerability
19478| [4335] Apache Win32 Batch File Remote Command Execution Vulnerability
19479| [4292] Oracle 9iAS Apache PL/SQL Module Web Administration Access Vulnerability
19480| [4189] Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
19481| [4057] Apache 2 for Windows OPTIONS request Path Disclosure Vulnerability
19482| [4056] Apache 2 for Windows php.exe Path Disclosure Vulnerability
19483| [4037] Oracle 9iAS Apache PL/SQL Module Denial of Service Vulnerability
19484| [4032] Oracle 9iAS Apache PL/SQL Module Multiple Buffer Overflows Vulnerability
19485| [3796] Apache HTTP Request Unexpected Behavior Vulnerability
19486| [3790] Apache Non-Existent Log Directory Denial Of Service Vulnerability
19487| [3786] Apache Win32 PHP.EXE Remote File Disclosure Vulnerability
19488| [3727] Oracle 9I Application Server PL/SQL Apache Module Directory Traversal Vulnerability
19489| [3726] Oracle 9I Application Server PL/SQL Apache Module Buffer Overflow Vulnerability
19490| [3596] Apache Split-Logfile File Append Vulnerability
19491| [3521] Apache mod_usertrack Predictable ID Generation Vulnerability
19492| [3335] Red Hat Linux Apache Remote Username Enumeration Vulnerability
19493| [3316] MacOS X Client Apache Directory Contents Disclosure Vulnerability
19494| [3256] Apache mod_auth_oracle Remote SQL Query Manipulation Vulnerability
19495| [3255] Apache mod_auth_mysql Remote SQL Query Manipulation Vulnerability
19496| [3254] Apache AuthPG Remote SQL Query Manipulation Vulnerability
19497| [3253] Apache mod_auth_pgsql_sys Remote SQL Query Manipulation Vulnerability
19498| [3251] Apache mod_auth_pgsql Remote SQL Query Manipulation Vulnerability
19499| [3176] Apache Mod ReWrite Rules Bypassing Image Linking Vulnerability
19500| [3169] Apache Server Address Disclosure Vulnerability
19501| [3009] Apache Possible Directory Index Disclosure Vulnerability
19502| [2982] Apache Tomcat Cross-Site Scripting Vulnerability
19503| [2852] MacOS X Client Apache File Protection Bypass Vulnerability
19504| [2740] Apache Web Server HTTP Request Denial of Service Vulnerability
19505| [2518] Apache Tomcat 3.0 Directory Traversal Vulnerability
19506| [2503] Apache Artificially Long Slash Path Directory Listing Vulnerability
19507| [2300] NCSA/Apache httpd ScriptAlias Source Retrieval Vulnerability
19508| [2216] Apache Web Server DoS Vulnerability
19509| [2182] Apache /tmp File Race Vulnerability
19510| [2171] Oracle Apache+WebDB Documented Backdoor Vulnerability
19511| [2060] Apache Web Server with Php 3 File Disclosure Vulnerability
19512| [1821] Apache mod_cookies Buffer Overflow Vulnerability
19513| [1728] Apache Rewrite Module Arbitrary File Disclosure Vulnerability
19514| [1658] SuSE Apache CGI Source Code Viewing Vulnerability
19515| [1656] SuSE Apache WebDAV Directory Listings Vulnerability
19516| [1575] Trustix Apache-SSL RPM Permissions Vulnerability
19517| [1548] Apache Jakarta-Tomcat /admin Context Vulnerability
19518| [1532] Apache Tomcat Snoop Servlet Information Disclosure Vulnerability
19519| [1531] Apache Tomcat 3.1 Path Revealing Vulnerability
19520| [1457] Apache::ASP source.asp Example Script Vulnerability
19521| [1284] Apache HTTP Server (win32) Root Directory Access Vulnerability
19522| [1083] Cobalt Raq Apache .htaccess Disclosure Vulnerability
19523|
19524| IBM X-Force - https://exchange.xforce.ibmcloud.com:
19525| [86258] Apache CloudStack text fields cross-site scripting
19526| [85983] Apache Subversion mod_dav_svn module denial of service
19527| [85875] Apache OFBiz UEL code execution
19528| [85874] Apache OFBiz Webtools View Log screen cross-site scripting
19529| [85871] Apache HTTP Server mod_session_dbd unspecified
19530| [85756] Apache Struts OGNL expression command execution
19531| [85755] Apache Struts DefaultActionMapper class open redirect
19532| [85586] Apache ActiveMQ CVE-2013-1879 cross-site scripting
19533| [85574] Apache HTTP Server mod_dav denial of service
19534| [85573] Apache Struts Showcase App OGNL code execution
19535| [85496] Apache CXF denial of service
19536| [85423] Apache Geronimo RMI classloader code execution
19537| [85326] Apache Santuario XML Security for C++ buffer overflow
19538| [85323] Apache Santuario XML Security for Java spoofing
19539| [85319] Apache Qpid Python client SSL spoofing
19540| [85019] Apache Santuario XML Security for C++ CVE-2013-2156 buffer overflow
19541| [85018] Apache Santuario XML Security for C++ CVE-2013-2155 denial of service
19542| [85017] Apache Santuario XML Security for C++ CVE-2013-2154 buffer overflow
19543| [85016] Apache Santuario XML Security for C++ CVE-2013-2153 spoofing
19544| [84952] Apache Tomcat CVE-2012-3544 denial of service
19545| [84763] Apache Struts CVE-2013-2135 security bypass
19546| [84762] Apache Struts CVE-2013-2134 security bypass
19547| [84719] Apache Subversion CVE-2013-2088 command execution
19548| [84718] Apache Subversion CVE-2013-2112 denial of service
19549| [84717] Apache Subversion CVE-2013-1968 denial of service
19550| [84577] Apache Tomcat security bypass
19551| [84576] Apache Tomcat symlink
19552| [84543] Apache Struts CVE-2013-2115 security bypass
19553| [84542] Apache Struts CVE-2013-1966 security bypass
19554| [84154] Apache Tomcat session hijacking
19555| [84144] Apache Tomcat denial of service
19556| [84143] Apache Tomcat information disclosure
19557| [84111] Apache HTTP Server command execution
19558| [84043] Apache Virtual Computing Lab cross-site scripting
19559| [84042] Apache Virtual Computing Lab cross-site scripting
19560| [83782] Apache CloudStack information disclosure
19561| [83781] Apache CloudStack security bypass
19562| [83720] Apache ActiveMQ cross-site scripting
19563| [83719] Apache ActiveMQ denial of service
19564| [83718] Apache ActiveMQ denial of service
19565| [83263] Apache Subversion denial of service
19566| [83262] Apache Subversion denial of service
19567| [83261] Apache Subversion denial of service
19568| [83259] Apache Subversion denial of service
19569| [83035] Apache mod_ruid2 security bypass
19570| [82852] Apache Qpid federation_tag security bypass
19571| [82851] Apache Qpid qpid::framing::Buffer denial of service
19572| [82758] Apache Rave User RPC API information disclosure
19573| [82663] Apache Subversion svn_fs_file_length() denial of service
19574| [82642] Apache Qpid qpid::framing::Buffer::checkAvailable() denial of service
19575| [82641] Apache Qpid AMQP denial of service
19576| [82626] Apache HTTP Server on Debian GNU/Linux Debian apache2ctl symlink
19577| [82618] Apache Commons FileUpload symlink
19578| [82360] Apache HTTP Server manager interface cross-site scripting
19579| [82359] Apache HTTP Server hostnames cross-site scripting
19580| [82338] Apache Tomcat log/logdir information disclosure
19581| [82328] Apache Maven and Apache Maven Wagon SSL spoofing
19582| [82268] Apache OpenJPA deserialization command execution
19583| [81981] Apache CXF UsernameTokens security bypass
19584| [81980] Apache CXF WS-Security security bypass
19585| [81398] Apache OFBiz cross-site scripting
19586| [81240] Apache CouchDB directory traversal
19587| [81226] Apache CouchDB JSONP code execution
19588| [81225] Apache CouchDB Futon user interface cross-site scripting
19589| [81211] Apache Axis2/C SSL spoofing
19590| [81167] Apache CloudStack DeployVM information disclosure
19591| [81166] Apache CloudStack AddHost API information disclosure
19592| [81165] Apache CloudStack createSSHKeyPair API information disclosure
19593| [80518] Apache Tomcat cross-site request forgery security bypass
19594| [80517] Apache Tomcat FormAuthenticator security bypass
19595| [80516] Apache Tomcat NIO denial of service
19596| [80408] Apache Tomcat replay-countermeasure security bypass
19597| [80407] Apache Tomcat HTTP Digest Access Authentication security bypass
19598| [80317] Apache Tomcat slowloris denial of service
19599| [79984] Apache Commons HttpClient SSL spoofing
19600| [79983] Apache CXF SSL spoofing
19601| [79830] Apache Axis2/Java SSL spoofing
19602| [79829] Apache Axis SSL spoofing
19603| [79809] Apache Tomcat DIGEST security bypass
19604| [79806] Apache Tomcat parseHeaders() denial of service
19605| [79540] Apache OFBiz unspecified
19606| [79487] Apache Axis2 SAML security bypass
19607| [79212] Apache Cloudstack code execution
19608| [78734] Apache CXF SOAP Action security bypass
19609| [78730] Apache Qpid broker denial of service
19610| [78617] Eucalyptus Apache Santuario (XML Security for Java) denial of service
19611| [78563] Apache mod_pagespeed module unspecified cross-site scripting
19612| [78562] Apache mod_pagespeed module security bypass
19613| [78454] Apache Axis2 security bypass
19614| [78452] Websense Web Security and Web Filter Apache Tomcat information disclosure
19615| [78451] Websense Web Security and Web Filter Apache Tomcat cross-site scripting
19616| [78321] Apache Wicket unspecified cross-site scripting
19617| [78183] Apache Struts parameters denial of service
19618| [78182] Apache Struts cross-site request forgery
19619| [78153] Apache Solr Autocomplete module for Drupal autocomplete results cross-site scripting
19620| [77987] mod_rpaf module for Apache denial of service
19621| [77958] Apache Struts skill name code execution
19622| [77914] Apache HTTP Server mod_negotiation module cross-site scripting
19623| [77913] Apache HTTP Server mod_proxy_ajp information disclosure
19624| [77568] Apache Qpid broker security bypass
19625| [77421] Apache Libcloud spoofing
19626| [77059] Oracle Solaris Cluster Apache Tomcat Agent unspecified
19627| [77046] Oracle Solaris Apache HTTP Server information disclosure
19628| [76837] Apache Hadoop information disclosure
19629| [76802] Apache Sling CopyFrom denial of service
19630| [76692] Apache Hadoop symlink
19631| [76535] Apache Roller console cross-site request forgery
19632| [76534] Apache Roller weblog cross-site scripting
19633| [76152] Apache CXF elements security bypass
19634| [76151] Apache CXF child policies security bypass
19635| [75983] MapServer for Windows Apache file include
19636| [75857] Apache Commons Compress and Apache Ant bzip2 denial of service
19637| [75558] Apache POI denial of service
19638| [75545] PHP apache_request_headers() buffer overflow
19639| [75302] Apache Qpid SASL security bypass
19640| [75211] Debian GNU/Linux apache 2 cross-site scripting
19641| [74901] Apache HTTP Server LD_LIBRARY_PATH privilege escalation
19642| [74871] Apache OFBiz FlexibleStringExpander code execution
19643| [74870] Apache OFBiz multiple cross-site scripting
19644| [74750] Apache Hadoop unspecified spoofing
19645| [74319] Apache Struts XSLTResult.java file upload
19646| [74313] Apache Traffic Server header buffer overflow
19647| [74276] Apache Wicket directory traversal
19648| [74273] Apache Wicket unspecified cross-site scripting
19649| [74181] Apache HTTP Server mod_fcgid module denial of service
19650| [73690] Apache Struts OGNL code execution
19651| [73432] Apache Solr extension for TYPO3 unspecified cross-site scripting
19652| [73100] Apache MyFaces in directory traversal
19653| [73096] Apache APR hash denial of service
19654| [73052] Apache Struts name cross-site scripting
19655| [73030] Apache CXF UsernameToken security bypass
19656| [72888] Apache Struts lastName cross-site scripting
19657| [72758] Apache HTTP Server httpOnly information disclosure
19658| [72757] Apache HTTP Server MPM denial of service
19659| [72585] Apache Struts ParameterInterceptor security bypass
19660| [72438] Apache Tomcat Digest security bypass
19661| [72437] Apache Tomcat Digest security bypass
19662| [72436] Apache Tomcat DIGEST security bypass
19663| [72425] Apache Tomcat parameter denial of service
19664| [72422] Apache Tomcat request object information disclosure
19665| [72377] Apache HTTP Server scoreboard security bypass
19666| [72345] Apache HTTP Server HTTP request denial of service
19667| [72229] Apache Struts ExceptionDelegator command execution
19668| [72089] Apache Struts ParameterInterceptor directory traversal
19669| [72088] Apache Struts CookieInterceptor command execution
19670| [72047] Apache Geronimo hash denial of service
19671| [72016] Apache Tomcat hash denial of service
19672| [71711] Apache Struts OGNL expression code execution
19673| [71654] Apache Struts interfaces security bypass
19674| [71620] Apache ActiveMQ failover denial of service
19675| [71617] Apache HTTP Server mod_proxy module information disclosure
19676| [71508] Apache MyFaces EL security bypass
19677| [71445] Apache HTTP Server mod_proxy security bypass
19678| [71203] Apache Tomcat servlets privilege escalation
19679| [71181] Apache HTTP Server ap_pregsub() denial of service
19680| [71093] Apache HTTP Server ap_pregsub() buffer overflow
19681| [70336] Apache HTTP Server mod_proxy information disclosure
19682| [69804] Apache HTTP Server mod_proxy_ajp denial of service
19683| [69472] Apache Tomcat AJP security bypass
19684| [69396] Apache HTTP Server ByteRange filter denial of service
19685| [69394] Apache Wicket multi window support cross-site scripting
19686| [69176] Apache Tomcat XML information disclosure
19687| [69161] Apache Tomcat jsvc information disclosure
19688| [68799] mod_authnz_external module for Apache mysql-auth.pl SQL injection
19689| [68541] Apache Tomcat sendfile information disclosure
19690| [68420] Apache XML Security denial of service
19691| [68238] Apache Tomcat JMX information disclosure
19692| [67860] Apache Rampart/C rampart_timestamp_token_validate security bypass
19693| [67804] Apache Subversion control rules information disclosure
19694| [67803] Apache Subversion control rules denial of service
19695| [67802] Apache Subversion baselined denial of service
19696| [67672] Apache Archiva multiple cross-site scripting
19697| [67671] Apache Archiva multiple cross-site request forgery
19698| [67564] Apache APR apr_fnmatch() denial of service
19699| [67532] IBM WebSphere Application Server org.apache.jasper.runtime.JspWriterImpl.response denial of service
19700| [67515] Apache Tomcat annotations security bypass
19701| [67480] Apache Struts s:submit information disclosure
19702| [67414] Apache APR apr_fnmatch() denial of service
19703| [67356] Apache Struts javatemplates cross-site scripting
19704| [67354] Apache Struts Xwork cross-site scripting
19705| [66676] Apache Tomcat HTTP BIO information disclosure
19706| [66675] Apache Tomcat web.xml security bypass
19707| [66640] Apache HttpComponents HttpClient Proxy-Authorization information disclosure
19708| [66241] Apache HttpComponents information disclosure
19709| [66154] Apache Tomcat ServletSecurity security bypass
19710| [65971] Apache Tomcat ServletSecurity security bypass
19711| [65876] Apache Subversion mod_dav_svn denial of service
19712| [65343] Apache Continuum unspecified cross-site scripting
19713| [65162] Apache Tomcat NIO connector denial of service
19714| [65161] Apache Tomcat javax.servlet.ServletRequest.getLocale() denial of service
19715| [65160] Apache Tomcat HTML Manager interface cross-site scripting
19716| [65159] Apache Tomcat ServletContect security bypass
19717| [65050] Apache CouchDB web-based administration UI cross-site scripting
19718| [64773] Oracle HTTP Server Apache Plugin unauthorized access
19719| [64473] Apache Subversion blame -g denial of service
19720| [64472] Apache Subversion walk() denial of service
19721| [64407] Apache Axis2 CVE-2010-0219 code execution
19722| [63926] Apache Archiva password privilege escalation
19723| [63785] Apache CouchDB LD_LIBRARY_PATH privilege escalation
19724| [63493] Apache Archiva credentials cross-site request forgery
19725| [63477] Apache Tomcat HttpOnly session hijacking
19726| [63422] Apache Tomcat sessionsList.jsp cross-site scripting
19727| [63303] Apache mod_fcgid module fcgid_header_bucket_read() buffer overflow
19728| [62959] Apache Shiro filters security bypass
19729| [62790] Apache Perl cgi module denial of service
19730| [62576] Apache Qpid exchange denial of service
19731| [62575] Apache Qpid AMQP denial of service
19732| [62354] Apache Qpid SSL denial of service
19733| [62235] Apache APR-util apr_brigade_split_line() denial of service
19734| [62181] Apache XML-RPC SAX Parser information disclosure
19735| [61721] Apache Traffic Server cache poisoning
19736| [61202] Apache Derby BUILTIN authentication functionality information disclosure
19737| [61186] Apache CouchDB Futon cross-site request forgery
19738| [61169] Apache CXF DTD denial of service
19739| [61070] Apache Jackrabbit search.jsp SQL injection
19740| [61006] Apache SLMS Quoting cross-site request forgery
19741| [60962] Apache Tomcat time cross-site scripting
19742| [60883] Apache mod_proxy_http information disclosure
19743| [60671] Apache HTTP Server mod_cache and mod_dav denial of service
19744| [60264] Apache Tomcat Transfer-Encoding denial of service
19745| [59746] Apache Axis2 axis2/axis2-admin page session hijacking
19746| [59588] Apache Axis2/Java XML DTD (Document Type Declaration) data denial of service
19747| [59413] Apache mod_proxy_http timeout information disclosure
19748| [59058] Apache MyFaces unencrypted view state cross-site scripting
19749| [58827] Apache Axis2 xsd file include
19750| [58790] Apache Axis2 modules cross-site scripting
19751| [58299] Apache ActiveMQ queueBrowse cross-site scripting
19752| [58169] Apache Tomcat Web Application Manager / Host Manager cross-site request forgery
19753| [58056] Apache ActiveMQ .jsp source code disclosure
19754| [58055] Apache Tomcat realm name information disclosure
19755| [58046] Apache HTTP Server mod_auth_shadow security bypass
19756| [57841] Apache Open For Business Project (OFBiz) subject cross-site scripting
19757| [57840] Apache Open For Business Project (OFBiz) multiple parameters cross-site scripting
19758| [57429] Apache CouchDB algorithms information disclosure
19759| [57398] Apache ActiveMQ Web console cross-site request forgery
19760| [57397] Apache ActiveMQ createDestination.action cross-site scripting
19761| [56653] Apache HTTP Server DNS spoofing
19762| [56652] Apache HTTP Server DNS cross-site scripting
19763| [56625] Apache HTTP Server request header information disclosure
19764| [56624] Apache HTTP Server mod_isapi orphaned callback pointer code execution
19765| [56623] Apache HTTP Server mod_proxy_ajp denial of service
19766| [55941] mod_proxy module for Apache ap_proxy_send_fb() buffer overflow
19767| [55857] Apache Tomcat WAR files directory traversal
19768| [55856] Apache Tomcat autoDeploy attribute security bypass
19769| [55855] Apache Tomcat WAR directory traversal
19770| [55210] Intuit component for Joomla! Apache information disclosure
19771| [54533] Apache Tomcat 404 error page cross-site scripting
19772| [54182] Apache Tomcat admin default password
19773| [53878] Apache Solr Search (solr) extension for TYPO3 unspecified cross-site scripting
19774| [53666] Apache HTTP Server Solaris pollset support denial of service
19775| [53650] Apache HTTP Server HTTP basic-auth module security bypass
19776| [53124] mod_proxy_ftp module for Apache HTTP header security bypass
19777| [53041] mod_proxy_ftp module for Apache denial of service
19778| [52540] Apache Portable Runtime and Apache Portable Utility library multiple buffer overflow
19779| [51953] Apache Tomcat Path Disclosure
19780| [51952] Apache Tomcat Path Traversal
19781| [51951] Apache stronghold-status Information Disclosure
19782| [51950] Apache stronghold-info Information Disclosure
19783| [51949] Apache PHP Source Code Disclosure
19784| [51948] Apache Multiviews Attack
19785| [51946] Apache JServ Environment Status Information Disclosure
19786| [51945] Apache error_log Information Disclosure
19787| [51944] Apache Default Installation Page Pattern Found
19788| [51943] Apache AXIS XML Parser echoheaders.jws Sample Web Service Denial of Service
19789| [51942] Apache AXIS XML External Entity File Retrieval
19790| [51941] Apache AXIS Sample Servlet Information Leak
19791| [51940] Apache access_log Information Disclosure
19792| [51626] Apache mod_deflate denial of service
19793| [51532] mod_proxy module for the Apache HTTP Server stream_reqbody_cl denial of service
19794| [51365] Apache Tomcat RequestDispatcher security bypass
19795| [51273] Apache HTTP Server Incomplete Request denial of service
19796| [51195] Apache Tomcat XML information disclosure
19797| [50994] Apache APR-util xml/apr_xml.c denial of service
19798| [50993] Apache APR-util apr_brigade_vprintf denial of service
19799| [50964] Apache APR-util apr_strmatch_precompile() denial of service
19800| [50930] Apache Tomcat j_security_check information disclosure
19801| [50928] Apache Tomcat AJP denial of service
19802| [50884] Apache HTTP Server XML ENTITY denial of service
19803| [50808] Apache HTTP Server AllowOverride privilege escalation
19804| [50108] Apache Struts s:a tag and s:url tag cross-site scripting
19805| [50059] Apache mod_proxy_ajp information disclosure
19806| [49951] Apache Tiles Expression Language (EL) expressions cross-site scripting
19807| [49925] Apache Geronimo Web Administrative Console cross-site request forgery
19808| [49924] Apache Geronimo console/portal/Server/Monitoring cross-site scripting
19809| [49921] Apache ActiveMQ Web interface cross-site scripting
19810| [49898] Apache Geronimo Services/Repository directory traversal
19811| [49725] Apache Tomcat mod_jk module information disclosure
19812| [49715] Apache mod_perl Apache::Status and Apache2::Status modules cross-site scripting
19813| [49712] Apache Struts unspecified cross-site scripting
19814| [49213] Apache Tomcat cal2.jsp cross-site scripting
19815| [48934] Apache Tomcat POST doRead method information disclosure
19816| [48211] Apache Tomcat header HTTP request smuggling
19817| [48163] libapache2-mod-auth-mysql module for Debian multibyte encoding SQL injection
19818| [48110] Apache Jackrabbit search.jsp and swr.jsp cross-site scripting
19819| [47709] Apache Roller "
19820| [47104] Novell Netware ApacheAdmin console security bypass
19821| [47086] Apache HTTP Server OS fingerprinting unspecified
19822| [46329] Apache Struts FilterDispatcher and DefaultStaticContentLoader class directory traversal
19823| [45791] Apache Tomcat RemoteFilterValve security bypass
19824| [44435] Oracle WebLogic Apache Connector buffer overflow
19825| [44411] Apache Tomcat allowLinking UTF-8 directory traversal
19826| [44223] Apache HTTP Server mod_proxy_ftp cross-site scripting
19827| [44156] Apache Tomcat RequestDispatcher directory traversal
19828| [44155] Apache Tomcat HttpServletResponse.sendError() cross-site scripting
19829| [43885] Oracle WebLogic Server Apache Connector buffer overflow
19830| [42987] Apache HTTP Server mod_proxy module denial of service
19831| [42915] Apache Tomcat JSP files path disclosure
19832| [42914] Apache Tomcat MS-DOS path disclosure
19833| [42892] Apache Tomcat unspecified unauthorized access
19834| [42816] Apache Tomcat Host Manager cross-site scripting
19835| [42303] Apache 403 error cross-site scripting
19836| [41618] Apache-SSL ExpandCert() authentication bypass
19837| [40761] Apache Derby RDBNAM parameter and DatabaseMetaData.getURL information disclosure
19838| [40736] Apache Tomcat HTTP/1.1 connector information disclosure
19839| [40614] Apache mod_jk2 HTTP Host header buffer overflow
19840| [40562] Apache Geronimo init information disclosure
19841| [40478] Novell Web Manager webadmin-apache.conf security bypass
19842| [40411] Apache Tomcat exception handling information disclosure
19843| [40409] Apache Tomcat native (APR based) connector weak security
19844| [40403] Apache Tomcat quotes and %5C cookie information disclosure
19845| [40388] Sun Java Plug-In org.apache.crimson.tree.XmlDocument security bypass
19846| [39893] Apache HTTP Server mod_negotiation HTTP response splitting
19847| [39867] Apache HTTP Server mod_negotiation cross-site scripting
19848| [39804] Apache Tomcat SingleSignOn information disclosure
19849| [39615] Apache HTTP Server mod_proxy_ftp.c UTF-7 cross-site scripting
19850| [39612] Apache HTTP Server mod_proxy_balancer buffer overflow
19851| [39608] Apache HTTP Server balancer manager cross-site request forgery
19852| [39476] Apache mod_proxy_balancer balancer_handler function denial of service
19853| [39474] Apache HTTP Server mod_proxy_balancer cross-site scripting
19854| [39472] Apache HTTP Server mod_status cross-site scripting
19855| [39201] Apache Tomcat JULI logging weak security
19856| [39158] Apache HTTP Server Windows SMB shares information disclosure
19857| [39001] Apache HTTP Server mod_imap and mod_imagemap module cross-site scripting
19858| [38951] Apache::AuthCAS Perl module cookie SQL injection
19859| [38800] Apache HTTP Server 413 error page cross-site scripting
19860| [38211] Apache Geronimo SQLLoginModule authentication bypass
19861| [37243] Apache Tomcat WebDAV directory traversal
19862| [37178] RHSA update for Apache HTTP Server mod_status module cross-site scripting not installed
19863| [37177] RHSA update for Apache HTTP Server Apache child process denial of service not installed
19864| [37119] RHSA update for Apache mod_auth_kerb off-by-one buffer overflow not installed
19865| [37100] RHSA update for Apache and IBM HTTP Server Expect header cross-site scripting not installed
19866| [36782] Apache Geronimo MEJB unauthorized access
19867| [36586] Apache HTTP Server UTF-7 cross-site scripting
19868| [36468] Apache Geronimo LoginModule security bypass
19869| [36467] Apache Tomcat functions.jsp cross-site scripting
19870| [36402] Apache Tomcat calendar cross-site request forgery
19871| [36354] Apache HTTP Server mod_proxy module denial of service
19872| [36352] Apache HTTP Server ap_proxy_date_canon() denial of service
19873| [36336] Apache Derby lock table privilege escalation
19874| [36335] Apache Derby schema privilege escalation
19875| [36006] Apache Tomcat "
19876| [36001] Apache Tomcat Host Manager Servlet alias cross-site scripting
19877| [35999] Apache Tomcat \"
19878| [35795] Apache Tomcat CookieExample cross-site scripting
19879| [35536] Apache Tomcat SendMailServlet example cross-site scripting
19880| [35384] Apache HTTP Server mod_cache module denial of service
19881| [35097] Apache HTTP Server mod_status module cross-site scripting
19882| [35095] Apache HTTP Server Prefork MPM module denial of service
19883| [34984] Apache HTTP Server recall_headers information disclosure
19884| [34966] Apache HTTP Server MPM content spoofing
19885| [34965] Apache HTTP Server MPM information disclosure
19886| [34963] Apache HTTP Server MPM multiple denial of service
19887| [34872] Apache MyFaces Tomahawk autoscroll parameter cross-site scripting
19888| [34869] Apache Tomcat JSP example Web application cross-site scripting
19889| [34868] Apache Tomcat Manager and Host Manager cross-site scripting
19890| [34496] Apache Tomcat JK Connector security bypass
19891| [34377] Apache Tomcat hello.jsp cross-site scripting
19892| [34212] Apache Tomcat SSL configuration security bypass
19893| [34210] Apache Tomcat Accept-Language cross-site scripting
19894| [34209] Apache Tomcat calendar application cross-site scripting
19895| [34207] Apache Tomcat implicit-objects.jsp cross-site scripting
19896| [34167] Apache Axis WSDL file path disclosure
19897| [34068] Apache Tomcat AJP connector information disclosure
19898| [33584] Apache HTTP Server suEXEC privilege escalation
19899| [32988] Apache Tomcat proxy module directory traversal
19900| [32794] Apache Tomcat JK Web Server Connector map_uri_to_worker() buffer overflow
19901| [32708] Debian Apache tty privilege escalation
19902| [32441] ApacheStats extract() PHP call unspecified
19903| [32128] Apache Tomcat default account
19904| [31680] Apache Tomcat RequestParamExample cross-site scripting
19905| [31649] Apache Tomcat Sample Servlet TroubleShooter detected
19906| [31557] BEA WebLogic Server and WebLogic Express Apache proxy plug-in denial of service
19907| [31236] Apache HTTP Server htpasswd.c strcpy buffer overflow
19908| [30456] Apache mod_auth_kerb off-by-one buffer overflow
19909| [29550] Apache mod_tcl set_var() format string
19910| [28620] Apache and IBM HTTP Server Expect header cross-site scripting
19911| [28357] Apache HTTP Server mod_alias script source information disclosure
19912| [28063] Apache mod_rewrite off-by-one buffer overflow
19913| [27902] Apache Tomcat URL information disclosure
19914| [26786] Apache James SMTP server denial of service
19915| [25680] libapache2 /tmp/svn file upload
19916| [25614] Apache Struts lookupMap cross-site scripting
19917| [25613] Apache Struts ActionForm denial of service
19918| [25612] Apache Struts isCancelled() security bypass
19919| [24965] Apache mod_python FileSession command execution
19920| [24716] Apache James spooler memory leak denial of service
19921| [24159] Apache Geronimo Web-Access-Log Viewer cross-site scripting
19922| [24158] Apache Geronimo jsp-examples cross-site scripting
19923| [24030] Apache auth_ldap module multiple format strings
19924| [24008] Apache mod_ssl custom error message denial of service
19925| [24003] Apache mod_auth_pgsql module multiple syslog format strings
19926| [23612] Apache mod_imap referer field cross-site scripting
19927| [23173] Apache Struts error message cross-site scripting
19928| [22942] Apache Tomcat directory listing denial of service
19929| [22858] Apache Multi-Processing Module code allows denial of service
19930| [22602] RHSA-2005:582 updates for Apache httpd not installed
19931| [22520] Apache mod-auth-shadow "
19932| [22466] ApacheTop symlink
19933| [22109] Apache HTTP Server ssl_engine_kernel client certificate validation
19934| [22006] Apache HTTP Server byte-range filter denial of service
19935| [21567] Apache mod_ssl off-by-one buffer overflow
19936| [21195] Apache HTTP Server header HTTP request smuggling
19937| [20383] Apache HTTP Server htdigest buffer overflow
19938| [19681] Apache Tomcat AJP12 request denial of service
19939| [18993] Apache HTTP server check_forensic symlink attack
19940| [18790] Apache Tomcat Manager cross-site scripting
19941| [18349] Apache HTTP server Apple HFS+ filesystem obtain information
19942| [18348] Apache HTTP server Apple HFS+ filesystem .DS_Store and .ht file disclosure
19943| [18347] Apache HTTP server Apple Mac OS X Server mod_digest_apple module could allow an attacker to replay responses
19944| [17961] Apache Web server ServerTokens has not been set
19945| [17930] Apache HTTP Server HTTP GET request denial of service
19946| [17785] Apache mod_include module buffer overflow
19947| [17671] Apache HTTP Server SSLCipherSuite bypass restrictions
19948| [17473] Apache HTTP Server Satisfy directive allows access to resources
19949| [17413] Apache htpasswd buffer overflow
19950| [17384] Apache HTTP Server environment variable configuration file buffer overflow
19951| [17382] Apache HTTP Server IPv6 apr_util denial of service
19952| [17366] Apache HTTP Server mod_dav module LOCK denial of service
19953| [17273] Apache HTTP Server speculative mode denial of service
19954| [17200] Apache HTTP Server mod_ssl denial of service
19955| [16890] Apache HTTP Server server-info request has been detected
19956| [16889] Apache HTTP Server server-status request has been detected
19957| [16705] Apache mod_ssl format string attack
19958| [16524] Apache HTTP Server ap_get_mime_headers_core denial of service
19959| [16387] Apache HTTP Server mod_proxy Content-Length buffer overflow
19960| [16230] Apache HTTP Server PHP denial of service
19961| [16214] Apache mod_ssl ssl_util_uuencode_binary buffer overflow
19962| [15958] Apache HTTP Server authentication modules memory corruption
19963| [15547] Apache HTTP Server mod_disk_cache local information disclosure
19964| [15540] Apache HTTP Server socket starvation denial of service
19965| [15467] Novell GroupWise WebAccess using Apache Web server allows viewing of files on the server
19966| [15422] Apache HTTP Server mod_access information disclosure
19967| [15419] Apache HTTP Server mod_ssl plain HTTP request denial of service
19968| [15293] Apache for Cygwin "
19969| [15065] Apache-SSL has a default password
19970| [15041] Apache HTTP Server mod_digest module could allow an attacker to replay responses
19971| [15015] Apache httpd server httpd.conf could allow a local user to bypass restrictions
19972| [14751] Apache Mod_python output filter information disclosure
19973| [14125] Apache HTTP Server mod_userdir module information disclosure
19974| [14075] Apache HTTP Server mod_php file descriptor leak
19975| [13703] Apache HTTP Server account
19976| [13689] Apache HTTP Server configuration allows symlinks
19977| [13688] Apache HTTP Server configuration allows SSI
19978| [13687] Apache HTTP Server Server: header value
19979| [13685] Apache HTTP Server ServerTokens value
19980| [13684] Apache HTTP Server ServerSignature value
19981| [13672] Apache HTTP Server config allows directory autoindexing
19982| [13671] Apache HTTP Server default content
19983| [13670] Apache HTTP Server config file directive references outside content root
19984| [13668] Apache HTTP Server httpd not running in chroot environment
19985| [13666] Apache HTTP Server CGI directory contains possible command interpreter or compiler
19986| [13664] Apache HTTP Server config file contains ScriptAlias entry
19987| [13663] Apache HTTP Server CGI support modules loaded
19988| [13661] Apache HTTP Server config file contains AddHandler entry
19989| [13660] Apache HTTP Server 500 error page not CGI script
19990| [13659] Apache HTTP Server 413 error page not CGI script
19991| [13658] Apache HTTP Server 403 error page not CGI script
19992| [13657] Apache HTTP Server 401 error page not CGI script
19993| [13552] Apache HTTP Server mod_cgid module information disclosure
19994| [13550] Apache GET request directory traversal
19995| [13516] Apache Cocoon XMLForm and JXForm could allow execution of code
19996| [13499] Apache Cocoon directory traversal allows downloading of boot.ini file
19997| [13429] Apache Tomcat non-HTTP request denial of service
19998| [13400] Apache HTTP server mod_alias and mod_rewrite buffer overflow
19999| [13295] Apache weak password encryption
20000| [13254] Apache Tomcat .jsp cross-site scripting
20001| [13125] Apache::Gallery Inline::C could allow arbitrary code execution
20002| [13086] Apache Jakarta Tomcat mod_jk format string allows remote access
20003| [12681] Apache HTTP Server mod_proxy could allow mail relaying
20004| [12662] Apache HTTP Server rotatelogs denial of service
20005| [12554] Apache Tomcat stores password in plain text
20006| [12553] Apache HTTP Server redirects and subrequests denial of service
20007| [12552] Apache HTTP Server FTP proxy server denial of service
20008| [12551] Apache HTTP Server prefork MPM denial of service
20009| [12550] Apache HTTP Server weaker than expected encryption
20010| [12549] Apache HTTP Server type-map file denial of service
20011| [12206] Apache Tomcat /opt/tomcat directory insecure permissions
20012| [12102] Apache Jakarta Tomcat MS-DOS device name request denial of service
20013| [12091] Apache HTTP Server apr_password_validate denial of service
20014| [12090] Apache HTTP Server apr_psprintf code execution
20015| [11804] Apache HTTP Server mod_access_referer denial of service
20016| [11750] Apache HTTP Server could leak sensitive file descriptors
20017| [11730] Apache HTTP Server error log and access log terminal escape sequence injection
20018| [11703] Apache long slash path allows directory listing
20019| [11695] Apache HTTP Server LF (Line Feed) denial of service
20020| [11694] Apache HTTP Server filestat.c denial of service
20021| [11438] Apache HTTP Server MIME message boundaries information disclosure
20022| [11412] Apache HTTP Server error log terminal escape sequence injection
20023| [11196] Apache Tomcat examples and ROOT Web applications cross-site scripting
20024| [11195] Apache Tomcat web.xml could be used to read files
20025| [11194] Apache Tomcat URL appended with a null character could list directories
20026| [11139] Apache HTTP Server mass virtual hosting with mod_rewrite or mod_vhost_alias could allow an attacker to obtain files
20027| [11126] Apache HTTP Server illegal character file disclosure
20028| [11125] Apache HTTP Server DOS device name HTTP POST code execution
20029| [11124] Apache HTTP Server DOS device name denial of service
20030| [11088] Apache HTTP Server mod_vhost_alias CGI source disclosure
20031| [10938] Apache HTTP Server printenv test CGI cross-site scripting
20032| [10771] Apache Tomcat mod_jk module multiple HTTP GET request buffer overflow
20033| [10575] Apache mod_php module could allow an attacker to take over the httpd process
20034| [10499] Apache HTTP Server WebDAV HTTP POST view source
20035| [10457] Apache HTTP Server mod_ssl "
20036| [10415] Apache HTTP Server htdigest insecure system() call could allow command execution
20037| [10414] Apache HTTP Server htdigest multiple buffer overflows
20038| [10413] Apache HTTP Server htdigest temporary file race condition
20039| [10412] Apache HTTP Server htpasswd temporary file race condition
20040| [10376] Apache Tomcat invoker servlet used in conjunction with the default servlet reveals source code
20041| [10348] Apache Tomcat HTTP GET request DOS device reference could cause a denial of service
20042| [10281] Apache HTTP Server ab.c ApacheBench long response buffer overflow
20043| [10280] Apache HTTP Server shared memory scorecard overwrite
20044| [10263] Apache Tomcat mod_jk or mod_jserv connector directory disclosure
20045| [10241] Apache HTTP Server Host: header cross-site scripting
20046| [10230] Slapper worm variants A, B, and C target OpenSSL/Apache systems
20047| [10208] Apache HTTP Server mod_dav denial of service
20048| [10206] HP VVOS Apache mod_ssl denial of service
20049| [10200] Apache HTTP Server stderr denial of service
20050| [10175] Apache Tomcat org.apache.catalina.servlets.DefaultServlet reveals source code
20051| [10169] Slapper worm variant (Slapper.C) targets OpenSSL/Apache systems
20052| [10154] Slapper worm variant (Slapper.B) targets OpenSSL/Apache systems
20053| [10098] Slapper worm targets OpenSSL/Apache systems
20054| [9876] Apache HTTP Server cgi/cgid request could disclose the path to a requested script
20055| [9875] Apache HTTP Server .var file request could disclose installation path
20056| [9863] Apache Tomcat web.xml file could allow a remote attacker to bypass restrictions
20057| [9808] Apache HTTP Server non-Unix version URL encoded directory traversal
20058| [9623] Apache HTTP Server ap_log_rerror() path disclosure
20059| [9520] Apache Tomcat /servlet/ mapping cross-site scripting
20060| [9415] Apache HTTP Server mod_ssl .htaccess off-by-one buffer overflow
20061| [9396] Apache Tomcat null character to threads denial of service
20062| [9394] Apache Tomcat HTTP request for LPT9 reveals Web root path
20063| [9249] Apache HTTP Server chunked encoding heap buffer overflow
20064| [9208] Apache Tomcat sample file requests could reveal directory listing and path to Web root directory
20065| [8932] Apache Tomcat example class information disclosure
20066| [8633] Apache HTTP Server with mod_rewrite could allow an attacker to bypass directives
20067| [8629] Apache HTTP Server double-reverse DNS lookup spoofing
20068| [8589] Apache HTTP Server for Windows DOS batch file remote command execution
20069| [8457] Oracle9i Application Server Apache PL/SQL HTTP Location header buffer overflow
20070| [8455] Oracle9i Application Server default installation could allow an attacker to access certain Apache Services
20071| [8400] Apache HTTP Server mod_frontpage buffer overflows
20072| [8326] Apache HTTP Server multiple MIME headers (sioux) denial of service
20073| [8308] Apache "
20074| [8275] Apache HTTP Server with Multiviews enabled could disclose directory contents
20075| [8119] Apache and PHP OPTIONS request reveals "
20076| [8054] Apache is running on the system
20077| [8029] Mandrake Linux default Apache configuration could allow an attacker to browse files and directories
20078| [8027] Mandrake Linux default Apache configuration has remote management interface enabled
20079| [8026] Mandrake Linux Apache sample programs could disclose sensitive information about the server
20080| [7836] Apache HTTP Server log directory denial of service
20081| [7815] Apache for Windows "
20082| [7810] Apache HTTP request could result in unexpected behavior
20083| [7599] Apache Tomcat reveals installation path
20084| [7494] Apache "
20085| [7419] Apache Web Server could allow remote attackers to overwrite .log files
20086| [7363] Apache Web Server hidden HTTP requests
20087| [7249] Apache mod_proxy denial of service
20088| [7129] Linux with Apache Web server could allow an attacker to determine if a specified username exists
20089| [7103] Apple Mac OS X used with Apache Web server could disclose directory contents
20090| [7059] Apache "
20091| [7057] Apache "
20092| [7056] Apache "
20093| [7055] Apache "
20094| [7054] Apache "
20095| [6997] Apache Jakarta Tomcat error message may reveal information
20096| [6971] Apache Jakarta Tomcat may reveal JSP source code with missing HTTP protocol specification
20097| [6970] Apache crafted HTTP request could reveal the internal IP address
20098| [6921] Apache long slash path allows directory listing
20099| [6687] Apple Mac OS X used with Apache Web server could allow arbitrary file disclosure
20100| [6527] Apache Web Server for Windows and OS2 denial of service
20101| [6316] Apache Jakarta Tomcat may reveal JSP source code
20102| [6305] Apache Jakarta Tomcat directory traversal
20103| [5926] Linux Apache symbolic link
20104| [5659] Apache Web server discloses files when used with php script
20105| [5310] Apache mod_rewrite allows attacker to view arbitrary files
20106| [5204] Apache WebDAV directory listings
20107| [5197] Apache Web server reveals CGI script source code
20108| [5160] Apache Jakarta Tomcat default installation
20109| [5099] Trustix Secure Linux installs Apache with world writable access
20110| [4968] Apache Jakarta Tomcat snoop servlet gives out information which could be used in attack
20111| [4967] Apache Jakarta Tomcat 404 error reveals the pathname of the requested file
20112| [4931] Apache source.asp example file allows users to write to files
20113| [4575] IBM HTTP Server running Apache allows users to directory listing and file retrieval
20114| [4205] Apache Jakarta Tomcat delivers file contents
20115| [2084] Apache on Debian by default serves the /usr/doc directory
20116| [1630] MessageMedia UnityMail and Apache Web server MIME header flood denial of service
20117| [697] Apache HTTP server beck exploit
20118| [331] Apache cookies buffer overflow
20119|
20120| Exploit-DB - https://www.exploit-db.com:
20121| [31130] Apache Tomcat <= 6.0.15 Cookie Quote Handling Remote Information Disclosure Vulnerability
20122| [31052] Apache <= 2.2.6 'mod_negotiation' HTML Injection and HTTP Response Splitting Vulnerability
20123| [30901] Apache HTTP Server 2.2.6 Windows Share PHP File Extension Mapping Information Disclosure Vulnerability
20124| [30835] Apache HTTP Server <= 2.2.4 413 Error HTTP Request Method Cross-Site Scripting Weakness
20125| [30563] Apache Tomcat <= 5.5.15 Cal2.JSP Cross-Site Scripting Vulnerability
20126| [30496] Apache Tomcat <= 6.0.13 Cookie Handling Quote Delimiter Session ID Disclosure
20127| [30495] Apache Tomcat <= 6.0.13 Host Manager Servlet Cross Site Scripting Vulnerability
20128| [30191] Apache MyFaces Tomahawk JSF Framework 1.1.5 Autoscroll Parameter Cross Site Scripting Vulnerability
20129| [30189] Apache Tomcat <= 6.0.13 JSP Example Web Applications Cross Site Scripting Vulnerability
20130| [30052] Apache Tomcat 6.0.10 Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities
20131| [29930] Apache AXIS 1.0 Non-Existent WSDL Path Information Disclosure Vulnerability
20132| [29859] Apache Roller OGNL Injection
20133| [29739] Apache HTTP Server Tomcat 5.x/6.0.x Directory Traversal Vulnerability
20134| [29435] Apache Tomcat 5.5.25 - CSRF Vulnerabilities
20135| [29316] Apache + PHP 5.x - Remote Code Execution (Multithreaded Scanner) (2)
20136| [29290] Apache / PHP 5.x Remote Code Execution Exploit
20137| [28713] Apache Tomcat/JBoss EJBInvokerServlet / JMXInvokerServlet (RMI over HTTP) Marshalled Object RCE
20138| [28424] Apache 2.x HTTP Server Arbitrary HTTP Request Headers Security Weakness
20139| [28365] Apache 2.2.2 CGI Script Source Code Information Disclosure Vulnerability
20140| [28254] Apache Tomcat 5 Information Disclosure Vulnerability
20141| [27915] Apache James 2.2 SMTP Denial of Service Vulnerability
20142| [27397] Apache suEXEC Privilege Elevation / Information Disclosure
20143| [27135] Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
20144| [27096] Apache Geronimo 1.0 Error Page XSS
20145| [27095] Apache Tomcat / Geronimo 1.0 Sample Script cal2.jsp time Parameter XSS
20146| [26710] Apache CXF prior to 2.5.10, 2.6.7 and 2.7.4 - Denial of Service
20147| [26542] Apache Struts 1.2.7 Error Response Cross-Site Scripting Vulnerability
20148| [25986] Plesk Apache Zeroday Remote Exploit
20149| [25980] Apache Struts includeParams Remote Code Execution
20150| [25625] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (2)
20151| [25624] Apache 1.3.x HTDigest Realm Command Line Argument Buffer Overflow Vulnerability (1)
20152| [24874] Apache Struts ParametersInterceptor Remote Code Execution
20153| [24744] Apache Rave 0.11 - 0.20 - User Information Disclosure
20154| [24694] Apache 1.3.x mod_include Local Buffer Overflow Vulnerability
20155| [24590] Apache 2.0.x mod_ssl Remote Denial of Service Vulnerability
20156| [23751] Apache Cygwin 1.3.x/2.0.x Directory Traversal Vulnerability
20157| [23581] Apache 2.0.4x mod_perl Module File Descriptor Leakage Vulnerability
20158| [23482] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (2)
20159| [23481] Apache 2.0.4x mod_php Module File Descriptor Leakage Vulnerability (1)
20160| [23296] Red Hat Apache 2.0.40 Directory Index Default Configuration Error
20161| [23282] apache cocoon 2.14/2.2 - Directory Traversal vulnerability
20162| [23245] Apache Tomcat 4.0.x Non-HTTP Request Denial of Service Vulnerability
20163| [23119] Apache::Gallery 0.4/0.5/0.6 Insecure Local File Storage Privilege Escalation Vulnerability
20164| [22505] Apache Mod_Access_Referer 1.0.2 NULL Pointer Dereference Denial of Service Vulnerability
20165| [22205] Apache Tomcat 3.x Null Byte Directory/File Disclosure Vulnerability
20166| [22191] Apache Web Server 2.0.x MS-DOS Device Name Denial of Service Vulnerability
20167| [22068] Apache 1.3.x,Tomcat 4.0.x/4.1.x Mod_JK Chunked Encoding Denial of Service Vulnerability
20168| [21885] Apache 1.3/2.0.x Server Side Include Cross Site Scripting Vulnerability
20169| [21882] Apache Tomcat 3.2 Directory Disclosure Vulnerability
20170| [21854] Apache 2.0.39/40 Oversized STDERR Buffer Denial of Service Vulnerability
20171| [21853] Apache Tomcat 3/4 DefaultServlet File Disclosure Vulnerability
20172| [21734] Apache Tomcat 4.1 JSP Request Cross Site Scripting Vulnerability
20173| [21719] Apache 2.0 Path Disclosure Vulnerability
20174| [21697] Apache 2.0 Encoded Backslash Directory Traversal Vulnerability
20175| [21605] Apache Tomcat 4.0.3 DoS Device Name Cross Site Scripting Vulnerability
20176| [21604] Apache Tomcat 4.0.3 Servlet Mapping Cross Site Scripting Vulnerability
20177| [21560] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (2)
20178| [21559] Apache 1.x/2.0.x Chunked-Encoding Memory Corruption Vulnerability (1)
20179| [21534] Apache Tomcat 3/4 JSP Engine Denial of Service Vulnerability
20180| [21492] Apache Tomcat 3.2.3/3.2.4 RealPath.JSP Malformed Request Information Disclosure
20181| [21491] Apache Tomcat 3.2.3/3.2.4 Example Files Web Root Path Disclosure
20182| [21490] Apache Tomcat 3.2.3/3.2.4 Source.JSP Malformed Request Information Disclosure
20183| [21412] Apache Tomcat 4.0/4.1 Servlet Path Disclosure Vulnerability
20184| [21350] Apache Win32 1.3.x/2.0.x Batch File Remote Command Execution Vulnerability
20185| [21204] Apache 1.3.20 Win32 PHP.EXE Remote File Disclosure Vulnerability
20186| [21112] Red Hat Linux 7.0 Apache Remote Username Enumeration Vulnerability
20187| [21067] Apache 1.0/1.2/1.3 Server Address Disclosure Vulnerability
20188| [21002] Apache 1.3 Possible Directory Index Disclosure Vulnerability
20189| [20911] Apache 1.3.14 Mac File Protection Bypass Vulnerability
20190| [20716] apache tomcat 3.0 - Directory Traversal vulnerability
20191| [20695] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (4)
20192| [20694] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (3)
20193| [20693] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (2)
20194| [20692] Apache 1.3 Artificially Long Slash Path Directory Listing Vulnerability (1)
20195| [20595] NCSA 1.3/1.4.x/1.5,Apache httpd 0.8.11/0.8.14 ScriptAlias Source Retrieval Vulnerability
20196| [20558] Apache 1.2 Web Server DoS Vulnerability
20197| [20466] Apache 1.3 Web Server with Php 3 File Disclosure Vulnerability
20198| [20435] Apache 0.8.x/1.0.x,NCSA httpd 1.x test-cgi Directory Listing Vulnerability
20199| [20272] Apache 1.2.5/1.3.1,UnityMail 2.0 MIME Header DoS Vulnerability
20200| [20210] Apache 1.3.12 WebDAV Directory Listings Vulnerability
20201| [20131] Apache Tomcat 3.1 Path Revealing Vulnerability
20202| [19975] Apache 1.3.6/1.3.9/1.3.11/1.3.12/1.3.20 Root Directory Access Vulnerability
20203| [19828] Cobalt RaQ 2.0/3.0 Apache .htaccess Disclosure Vulnerability
20204| [19536] Apache <= 1.1,NCSA httpd <= 1.5.2,Netscape Server 1.12/1.1/2.0 a nph-test-cgi Vulnerability
20205| [19231] PHP apache_request_headers Function Buffer Overflow
20206| [18984] Apache Struts <= 2.2.1.1 - Remote Command Execution
20207| [18897] Oracle Weblogic Apache Connector POST Request Buffer Overflow
20208| [18619] Apache Tomcat Remote Exploit (PUT Request) and Account Scanner
20209| [18452] Apache Struts Multiple Persistent Cross-Site Scripting Vulnerabilities
20210| [18442] Apache httpOnly Cookie Disclosure
20211| [18329] Apache Struts2 <= 2.3.1 - Multiple Vulnerabilities
20212| [18221] Apache HTTP Server Denial of Service
20213| [17969] Apache mod_proxy Reverse Proxy Exposure Vulnerability PoC
20214| [17696] Apache httpd Remote Denial of Service (memory exhaustion)
20215| [17691] Apache Struts < 2.2.0 - Remote Command Execution
20216| [16798] Apache mod_jk 1.2.20 Buffer Overflow
20217| [16782] Apache Win32 Chunked Encoding
20218| [16752] Apache module mod_rewrite LDAP protocol Buffer Overflow
20219| [16317] Apache Tomcat Manager Application Deployer Authenticated Code Execution
20220| [15710] Apache Archiva 1.0 - 1.3.1 CSRF Vulnerability
20221| [15319] Apache 2.2 (Windows) Local Denial of Service
20222| [14617] Apache JackRabbit 2.0.0 webapp XPath Injection
20223| [14489] Apache Tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
20224| [12721] Apache Axis2 1.4.1 - Local File Inclusion Vulnerability
20225| [12689] Authenticated Cross-Site Scripting Vulnerability (XSS) within Apache Axis2 administration console
20226| [12343] Apache Tomcat 5.5.0 to 5.5.29 & 6.0.0 to 6.0.26 - Information Disclosure Vulnerability
20227| [12330] Apache OFBiz - Multiple XSS
20228| [12264] Apache OFBiz - FULLADMIN Creator PoC Payload
20229| [12263] Apache OFBiz - SQL Remote Execution PoC Payload
20230| [11662] Apache Spamassassin Milter Plugin Remote Root Command Execution
20231| [11650] Apache 2.2.14 mod_isapi Dangling Pointer Remote SYSTEM Exploit
20232| [10811] Joomla.Tutorials GHDB: Apache directory listing Download Vulnerability
20233| [10292] Apache Tomcat 3.2.1 - 404 Error Page Cross Site Scripting Vulnerability
20234| [9995] Apache Tomcat Form Authentication Username Enumeration Weakness
20235| [9994] Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability
20236| [9993] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
20237| [8842] Apache mod_dav / svn Remote Denial of Service Exploit
20238| [8458] Apache Geronimo <= 2.1.3 - Multiple Directory Traversal Vulnerabilities
20239| [7264] Apache Tomcat runtime.getRuntime().exec() Privilege Escalation (win)
20240| [6229] apache tomcat < 6.0.18 utf8 - Directory Traversal vulnerability
20241| [6100] Apache mod_jk 1.2.19 Remote Buffer Overflow Exploit (win32)
20242| [6089] Bea Weblogic Apache Connector Code Exec / Denial of Service Exploit
20243| [5386] Apache Tomcat Connector jk2-2.0.2 (mod_jk2) Remote Overflow Exploit
20244| [5330] Apache 2.0 mod_jk2 2.0.2 - Remote Buffer Overflow Exploit (win32)
20245| [4552] Apache Tomcat (webdav) Remote File Disclosure Exploit (ssl support)
20246| [4530] Apache Tomcat (webdav) Remote File Disclosure Exploit
20247| [4162] Apache Tomcat Connector (mod_jk) Remote Exploit (exec-shield)
20248| [4093] Apache mod_jk 1.2.19/1.2.20 Remote Buffer Overflow Exploit
20249| [3996] Apache 2.0.58 mod_rewrite Remote Overflow Exploit (win2k3)
20250| [3680] Apache Mod_Rewrite Off-by-one Remote Overflow Exploit (win32)
20251| [3384] Ubuntu/Debian Apache 1.3.33/1.3.34 (CGI TTY) Local Root Exploit
20252| [2237] Apache < 1.3.37, 2.0.59, 2.2.3 (mod_rewrite) Remote Overflow PoC
20253| [2061] Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability
20254| [1056] Apache <= 2.0.49 Arbitrary Long HTTP Headers Denial of Service
20255| [855] Apache <= 2.0.52 HTTP GET request Denial of Service Exploit
20256| [764] Apache OpenSSL - Remote Exploit (Multiple Targets) (OpenFuckV2.c)
20257| [587] Apache <= 1.3.31 mod_include Local Buffer Overflow Exploit
20258| [466] htpasswd Apache 1.3.31 - Local Exploit
20259| [371] Apache HTTPd Arbitrary Long HTTP Headers DoS (c version)
20260| [360] Apache HTTPd Arbitrary Long HTTP Headers DoS
20261| [132] Apache 1.3.x - 2.0.48 - mod_userdir Remote Users Disclosure Exploit
20262| [126] Apache mod_gzip (with debug_mode) <= 1.2.26.1a Remote Exploit
20263| [67] Apache 1.3.x mod_mylo Remote Code Execution Exploit
20264| [38] Apache <= 2.0.45 APR Remote Exploit -Apache-Knacker.pl
20265| [34] Webfroot Shoutbox < 2.32 (Apache) Remote Exploit
20266| [11] Apache <= 2.0.44 Linux Remote Denial of Service Exploit
20267| [9] Apache HTTP Server 2.x Memory Leak Exploit
20268|
20269| OpenVAS (Nessus) - http://www.openvas.org:
20270| [902924] Apache Struts2 Showcase Skill Name Remote Code Execution Vulnerability
20271| [902837] PHP 'apache_request_headers()' Function Buffer Overflow Vulnerability (Windows)
20272| [902830] Apache HTTP Server 'httpOnly' Cookie Information Disclosure Vulnerability
20273| [902664] Apache Traffic Server HTTP Host Header Denial of Service Vulnerability
20274| [901203] Apache httpd Web Server Range Header Denial of Service Vulnerability
20275| [901110] Apache ActiveMQ Source Code Information Disclosure Vulnerability
20276| [901105] Apache OFBiz Multiple Cross Site Scripting Vulnerabilities
20277| [900842] Apache 'mod_proxy_ftp' Module Command Injection Vulnerability (Linux)
20278| [900841] Apache 'mod_proxy_ftp' Module Denial Of Service Vulnerability (Linux)
20279| [900573] Apache APR-Utils XML Parser Denial of Service Vulnerability
20280| [900572] Apache APR-Utils Multiple Denial of Service Vulnerabilities
20281| [900571] Apache APR-Utils Version Detection
20282| [900499] Apache mod_proxy_ajp Information Disclosure Vulnerability
20283| [900496] Apache Tiles Multiple XSS Vulnerability
20284| [900493] Apache Tiles Version Detection
20285| [900107] Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability
20286| [900021] Apache Tomcat Cross-Site Scripting and Security Bypass Vulnerabilities
20287| [880086] CentOS Update for apache CESA-2008:0004-01 centos2 i386
20288| [870175] RedHat Update for apache RHSA-2008:0004-01
20289| [864591] Fedora Update for apache-poi FEDORA-2012-10835
20290| [864383] Fedora Update for apache-commons-compress FEDORA-2012-8428
20291| [864280] Fedora Update for apache-commons-compress FEDORA-2012-8465
20292| [864250] Fedora Update for apache-poi FEDORA-2012-7683
20293| [864249] Fedora Update for apache-poi FEDORA-2012-7686
20294| [863993] Fedora Update for apache-commons-daemon FEDORA-2011-10880
20295| [863466] Fedora Update for apache-commons-daemon FEDORA-2011-10936
20296| [855821] Solaris Update for Apache 1.3 122912-19
20297| [855812] Solaris Update for Apache 1.3 122911-19
20298| [855737] Solaris Update for Apache 1.3 122911-17
20299| [855731] Solaris Update for Apache 1.3 122912-17
20300| [855695] Solaris Update for Apache 1.3 122911-16
20301| [855645] Solaris Update for Apache 1.3 122912-16
20302| [855587] Solaris Update for kernel update and Apache 108529-29
20303| [855566] Solaris Update for Apache 116973-07
20304| [855531] Solaris Update for Apache 116974-07
20305| [855524] Solaris Update for Apache 2 120544-14
20306| [855494] Solaris Update for Apache 1.3 122911-15
20307| [855478] Solaris Update for Apache Security 114145-11
20308| [855472] Solaris Update for Apache Security 113146-12
20309| [855179] Solaris Update for Apache 1.3 122912-15
20310| [855147] Solaris Update for kernel update and Apache 108528-29
20311| [855077] Solaris Update for Apache 2 120543-14
20312| [850196] SuSE Update for apache2 openSUSE-SU-2012:0314-1 (apache2)
20313| [850088] SuSE Update for apache2 SUSE-SA:2007:061
20314| [850009] SuSE Update for apache2,apache SUSE-SA:2008:021
20315| [841209] Ubuntu Update for apache2 USN-1627-1
20316| [840900] Ubuntu Update for apache2 USN-1368-1
20317| [840798] Ubuntu Update for apache2 USN-1259-1
20318| [840734] Ubuntu Update for apache2 USN-1199-1
20319| [840542] Ubuntu Update for apache2 vulnerabilities USN-1021-1
20320| [840504] Ubuntu Update for apache2 vulnerability USN-990-2
20321| [840399] Ubuntu Update for apache2 vulnerabilities USN-908-1
20322| [840304] Ubuntu Update for apache2 vulnerabilities USN-575-1
20323| [840118] Ubuntu Update for libapache2-mod-perl2 vulnerability USN-488-1
20324| [840092] Ubuntu Update for apache2 vulnerabilities USN-499-1
20325| [840039] Ubuntu Update for libapache2-mod-python vulnerability USN-430-1
20326| [835253] HP-UX Update for Apache Web Server HPSBUX02645
20327| [835247] HP-UX Update for Apache-based Web Server HPSBUX02612
20328| [835243] HP-UX Update for Apache Running Tomcat Servlet Engine HPSBUX02579
20329| [835236] HP-UX Update for Apache with PHP HPSBUX02543
20330| [835233] HP-UX Update for Apache-based Web Server HPSBUX02531
20331| [835224] HP-UX Update for Apache-based Web Server HPSBUX02465
20332| [835200] HP-UX Update for Apache Web Server Suite HPSBUX02431
20333| [835190] HP-UX Update for Apache Web Server Suite HPSBUX02401
20334| [835188] HP-UX Update for Apache HPSBUX02308
20335| [835181] HP-UX Update for Apache With PHP HPSBUX02332
20336| [835180] HP-UX Update for Apache with PHP HPSBUX02342
20337| [835172] HP-UX Update for Apache HPSBUX02365
20338| [835168] HP-UX Update for Apache HPSBUX02313
20339| [835148] HP-UX Update for Apache HPSBUX01064
20340| [835139] HP-UX Update for Apache with PHP HPSBUX01090
20341| [835131] HP-UX Update for Apache HPSBUX00256
20342| [835119] HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186
20343| [835104] HP-UX Update for Apache HPSBUX00224
20344| [835103] HP-UX Update for Apache mod_cgid HPSBUX00301
20345| [835101] HP-UX Update for Apache HPSBUX01232
20346| [835080] HP-UX Update for Apache HPSBUX02273
20347| [835078] HP-UX Update for ApacheStrong HPSBUX00255
20348| [835044] HP-UX Update for Apache HPSBUX01019
20349| [835040] HP-UX Update for Apache PHP HPSBUX00207
20350| [835025] HP-UX Update for Apache HPSBUX00197
20351| [835023] HP-UX Update for Apache HPSBUX01022
20352| [835022] HP-UX Update for Apache HPSBUX02292
20353| [835005] HP-UX Update for Apache HPSBUX02262
20354| [831759] Mandriva Update for apache-mod_security MDVSA-2012:182 (apache-mod_security)
20355| [831737] Mandriva Update for apache MDVSA-2012:154-1 (apache)
20356| [831534] Mandriva Update for apache MDVSA-2012:012 (apache)
20357| [831523] Mandriva Update for apache MDVSA-2012:003 (apache)
20358| [831491] Mandriva Update for apache MDVSA-2011:168 (apache)
20359| [831460] Mandriva Update for apache MDVSA-2011:144 (apache)
20360| [831449] Mandriva Update for apache MDVSA-2011:130 (apache)
20361| [831357] Mandriva Update for apache MDVSA-2011:057 (apache)
20362| [831132] Mandriva Update for apache MDVSA-2010:153 (apache)
20363| [831131] Mandriva Update for apache MDVSA-2010:152 (apache)
20364| [830989] Mandriva Update for apache-mod_auth_shadow MDVSA-2010:081 (apache-mod_auth_shadow)
20365| [830931] Mandriva Update for apache MDVSA-2010:057 (apache)
20366| [830926] Mandriva Update for apache MDVSA-2010:053 (apache)
20367| [830918] Mandriva Update for apache-mod_security MDVSA-2010:050 (apache-mod_security)
20368| [830799] Mandriva Update for apache-conf MDVSA-2009:300-2 (apache-conf)
20369| [830797] Mandriva Update for apache-conf MDVSA-2009:300-1 (apache-conf)
20370| [830791] Mandriva Update for apache-conf MDVA-2010:011 (apache-conf)
20371| [830652] Mandriva Update for apache MDVSA-2008:195 (apache)
20372| [830621] Mandriva Update for apache-conf MDVA-2008:129 (apache-conf)
20373| [830581] Mandriva Update for apache MDVSA-2008:016 (apache)
20374| [830294] Mandriva Update for apache MDKSA-2007:140 (apache)
20375| [830196] Mandriva Update for apache MDKSA-2007:235 (apache)
20376| [830112] Mandriva Update for apache MDKSA-2007:127 (apache)
20377| [830109] Mandriva Update for apache-mod_perl MDKSA-2007:083 (apache-mod_perl)
20378| [802425] Apache Struts2 Showcase Arbitrary Java Method Execution vulnerability
20379| [802423] Apache Struts CookBook/Examples Multiple Cross-Site Scripting Vulnerabilities
20380| [802422] Apache Struts Showcase Multiple Persistence Cross-Site Scripting Vulnerabilities
20381| [802415] Apache Tomcat Multiple Security Bypass Vulnerabilities (Win)
20382| [802385] Apache Tomcat Request Object Security Bypass Vulnerability (Win)
20383| [802384] Apache Tomcat Parameter Handling Denial of Service Vulnerability (Win)
20384| [802378] Apache Tomcat Hash Collision Denial Of Service Vulnerability
20385| [801942] Apache Archiva Multiple Vulnerabilities
20386| [801940] Apache Struts2 'XWork' Information Disclosure Vulnerability
20387| [801663] Apache Struts2/XWork Remote Command Execution Vulnerability
20388| [801521] Apache APR-util 'buckets/apr_brigade.c' Denial Of Service Vulnerability
20389| [801284] Apache Derby Information Disclosure Vulnerability
20390| [801203] Apache ActiveMQ Persistent Cross-Site Scripting Vulnerability
20391| [800837] Apache 'mod_deflate' Denial Of Service Vulnerability - July09
20392| [800827] Apache 'mod_proxy_http.c' Denial Of Service Vulnerability
20393| [800680] Apache APR Version Detection
20394| [800679] Apache APR and APR-util Multiple Integer Overflow Vulnerabilities
20395| [800678] Apache Roller 'q' Parameter Cross Site Scripting Vulnerability
20396| [800677] Apache Roller Version Detection
20397| [800279] Apache mod_jk Module Version Detection
20398| [800278] Apache Struts Cross Site Scripting Vulnerability
20399| [800277] Apache Tomcat mod_jk Information Disclosure Vulnerability
20400| [800276] Apache Struts Version Detection
20401| [800271] Apache Struts Directory Traversal Vulnerability
20402| [800024] Apache Tomcat RemoteFilterValve Security Bypass Vulnerability
20403| [103333] Apache HTTP Server 'ap_pregsub()' Function Local Denial of Service Vulnerability
20404| [103293] Apache HTTP Server 'mod_proxy' Reverse Proxy Information Disclosure Vulnerability
20405| [103122] Apache Web Server ETag Header Information Disclosure Weakness
20406| [103074] Apache Continuum Cross Site Scripting Vulnerability
20407| [103073] Apache Continuum Detection
20408| [103053] Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
20409| [101023] Apache Open For Business Weak Password security check
20410| [101020] Apache Open For Business HTML injection vulnerability
20411| [101019] Apache Open For Business service detection
20412| [100924] Apache Archiva Cross Site Request Forgery Vulnerability
20413| [100923] Apache Archiva Detection
20414| [100858] Apache 'mod_proxy_http' 2.2.9 for Unix Timeout Handling Information Disclosure Vulnerability
20415| [100814] Apache Axis2 Document Type Declaration Processing Security Vulnerability
20416| [100813] Apache Axis2 Detection
20417| [100797] Apache Traffic Server Remote DNS Cache Poisoning Vulnerability
20418| [100795] Apache Derby Detection
20419| [100762] Apache CouchDB Cross Site Request Forgery Vulnerability
20420| [100725] Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
20421| [100613] Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
20422| [100514] Apache Multiple Security Vulnerabilities
20423| [100211] Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability
20424| [100172] Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability
20425| [100171] Apache Web Server Linefeed Memory Allocation Denial Of Service Vulnerability
20426| [100130] Apache mod_perl 'Apache::Status' and 'Apache2::Status' Cross Site Scripting Vulnerability
20427| [72626] Debian Security Advisory DSA 2579-1 (apache2)
20428| [72612] FreeBSD Ports: apache22
20429| [71551] Gentoo Security Advisory GLSA 201206-25 (apache)
20430| [71550] Gentoo Security Advisory GLSA 201206-24 (apache tomcat)
20431| [71512] FreeBSD Ports: apache
20432| [71485] Debian Security Advisory DSA 2506-1 (libapache-mod-security)
20433| [71256] Debian Security Advisory DSA 2452-1 (apache2)
20434| [71238] Debian Security Advisory DSA 2436-1 (libapache2-mod-fcgid)
20435| [70737] FreeBSD Ports: apache
20436| [70724] Debian Security Advisory DSA 2405-1 (apache2)
20437| [70600] FreeBSD Ports: apache
20438| [70253] FreeBSD Ports: apache, apache-event, apache-itk, apache-peruser, apache-worker
20439| [70235] Debian Security Advisory DSA 2298-2 (apache2)
20440| [70233] Debian Security Advisory DSA 2298-1 (apache2)
20441| [69988] Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)
20442| [69338] Debian Security Advisory DSA 2202-1 (apache2)
20443| [67868] FreeBSD Ports: apache
20444| [66816] FreeBSD Ports: apache
20445| [66553] Mandriva Security Advisory MDVSA-2009:189-1 (apache-mod_auth_mysql)
20446| [66414] Mandriva Security Advisory MDVSA-2009:323 (apache)
20447| [66106] SuSE Security Advisory SUSE-SA:2009:050 (apache2,libapr1)
20448| [66081] SLES11: Security update for Apache 2
20449| [66074] SLES10: Security update for Apache 2
20450| [66070] SLES9: Security update for Apache 2
20451| [65998] SLES10: Security update for apache2-mod_python
20452| [65893] SLES10: Security update for Apache 2
20453| [65888] SLES10: Security update for Apache 2
20454| [65575] SLES9: Security update for apache2,apache2-prefork,apache2-worker
20455| [65510] SLES9: Security update for Apache 2
20456| [65472] SLES9: Security update for Apache
20457| [65467] SLES9: Security update for Apache
20458| [65450] SLES9: Security update for apache2
20459| [65390] SLES9: Security update for Apache2
20460| [65363] SLES9: Security update for Apache2
20461| [65309] SLES9: Security update for Apache and mod_ssl
20462| [65296] SLES9: Security update for webdav apache module
20463| [65283] SLES9: Security update for Apache2
20464| [65249] SLES9: Security update for Apache 2
20465| [65230] SLES9: Security update for Apache 2
20466| [65228] SLES9: Security update for Apache 2
20467| [65212] SLES9: Security update for apache2-mod_python
20468| [65209] SLES9: Security update for apache2-worker
20469| [65207] SLES9: Security update for Apache 2
20470| [65168] SLES9: Security update for apache2-mod_python
20471| [65142] SLES9: Security update for Apache2
20472| [65136] SLES9: Security update for Apache 2
20473| [65132] SLES9: Security update for apache
20474| [65131] SLES9: Security update for Apache 2 oes/CORE
20475| [65113] SLES9: Security update for apache2
20476| [65072] SLES9: Security update for apache and mod_ssl
20477| [65017] SLES9: Security update for Apache 2
20478| [64950] Mandrake Security Advisory MDVSA-2009:240 (apache)
20479| [64783] FreeBSD Ports: apache
20480| [64774] Ubuntu USN-802-2 (apache2)
20481| [64653] Ubuntu USN-813-2 (apache2)
20482| [64559] Debian Security Advisory DSA 1834-2 (apache2)
20483| [64532] Mandrake Security Advisory MDVSA-2009:189 (apache-mod_auth_mysql)
20484| [64527] Mandrake Security Advisory MDVSA-2009:184 (apache-mod_security)
20485| [64526] Mandrake Security Advisory MDVSA-2009:183 (apache-mod_security)
20486| [64500] Mandrake Security Advisory MDVSA-2009:168 (apache)
20487| [64443] Ubuntu USN-802-1 (apache2)
20488| [64426] Gentoo Security Advisory GLSA 200907-04 (apache)
20489| [64423] Debian Security Advisory DSA 1834-1 (apache2)
20490| [64391] Mandrake Security Advisory MDVSA-2009:149 (apache)
20491| [64377] Mandrake Security Advisory MDVSA-2009:124-1 (apache)
20492| [64251] Debian Security Advisory DSA 1816-1 (apache2)
20493| [64201] Ubuntu USN-787-1 (apache2)
20494| [64140] Mandrake Security Advisory MDVSA-2009:124 (apache)
20495| [64136] Mandrake Security Advisory MDVSA-2009:102 (apache)
20496| [63565] FreeBSD Ports: apache
20497| [63562] Ubuntu USN-731-1 (apache2)
20498| [61381] Gentoo Security Advisory GLSA 200807-06 (apache)
20499| [61185] FreeBSD Ports: apache
20500| [60582] Gentoo Security Advisory GLSA 200803-19 (apache)
20501| [60387] Slackware Advisory SSA:2008-045-02 apache
20502| [58826] FreeBSD Ports: apache-tomcat
20503| [58825] FreeBSD Ports: apache-tomcat
20504| [58804] FreeBSD Ports: apache
20505| [58745] Gentoo Security Advisory GLSA 200711-06 (apache)
20506| [58360] Debian Security Advisory DSA 1312-1 (libapache-mod-jk)
20507| [57851] Gentoo Security Advisory GLSA 200608-01 (apache)
20508| [57788] Debian Security Advisory DSA 1247-1 (libapache-mod-auth-kerb)
20509| [57335] Debian Security Advisory DSA 1167-1 (apache)
20510| [57201] Debian Security Advisory DSA 1131-1 (apache)
20511| [57200] Debian Security Advisory DSA 1132-1 (apache2)
20512| [57168] Slackware Advisory SSA:2006-209-01 Apache httpd
20513| [57145] FreeBSD Ports: apache
20514| [56731] Slackware Advisory SSA:2006-129-01 Apache httpd
20515| [56729] Slackware Advisory SSA:2006-130-01 Apache httpd redux
20516| [56246] Gentoo Security Advisory GLSA 200602-03 (Apache)
20517| [56212] Debian Security Advisory DSA 952-1 (libapache-auth-ldap)
20518| [56115] Debian Security Advisory DSA 935-1 (libapache2-mod-auth-pgsql)
20519| [56067] FreeBSD Ports: apache
20520| [55803] Slackware Advisory SSA:2005-310-04 apache
20521| [55519] Debian Security Advisory DSA 839-1 (apachetop)
20522| [55392] Gentoo Security Advisory GLSA 200509-12 (Apache)
20523| [55355] FreeBSD Ports: apache
20524| [55284] Debian Security Advisory DSA 807-1 (libapache-mod-ssl)
20525| [55261] Debian Security Advisory DSA 805-1 (apache2)
20526| [55259] Debian Security Advisory DSA 803-1 (apache)
20527| [55129] Gentoo Security Advisory GLSA 200508-15 (apache)
20528| [54739] Gentoo Security Advisory GLSA 200411-18 (apache)
20529| [54724] Gentoo Security Advisory GLSA 200411-03 (apache)
20530| [54712] Gentoo Security Advisory GLSA 200410-21 (apache)
20531| [54689] Gentoo Security Advisory GLSA 200409-33 (net=www/apache)
20532| [54677] Gentoo Security Advisory GLSA 200409-21 (apache)
20533| [54610] Gentoo Security Advisory GLSA 200407-03 (Apache)
20534| [54601] Gentoo Security Advisory GLSA 200406-16 (Apache)
20535| [54590] Gentoo Security Advisory GLSA 200406-05 (Apache)
20536| [54582] Gentoo Security Advisory GLSA 200405-22 (Apache)
20537| [54529] Gentoo Security Advisory GLSA 200403-04 (Apache)
20538| [54499] Gentoo Security Advisory GLSA 200310-04 (Apache)
20539| [54498] Gentoo Security Advisory GLSA 200310-03 (Apache)
20540| [54439] FreeBSD Ports: apache
20541| [53931] Slackware Advisory SSA:2004-133-01 apache
20542| [53903] Slackware Advisory SSA:2004-299-01 apache, mod_ssl, php
20543| [53902] Slackware Advisory SSA:2004-305-01 apache+mod_ssl
20544| [53878] Slackware Advisory SSA:2003-308-01 apache security update
20545| [53851] Debian Security Advisory DSA 135-1 (libapache-mod-ssl)
20546| [53849] Debian Security Advisory DSA 132-1 (apache-ssl)
20547| [53848] Debian Security Advisory DSA 131-1 (apache)
20548| [53784] Debian Security Advisory DSA 021-1 (apache)
20549| [53738] Debian Security Advisory DSA 195-1 (apache-perl)
20550| [53737] Debian Security Advisory DSA 188-1 (apache-ssl)
20551| [53735] Debian Security Advisory DSA 187-1 (apache)
20552| [53703] Debian Security Advisory DSA 532-1 (libapache-mod-ssl)
20553| [53577] Debian Security Advisory DSA 120-1 (libapache-mod-ssl, apache-ssl)
20554| [53568] Debian Security Advisory DSA 067-1 (apache,apache-ssl)
20555| [53519] Debian Security Advisory DSA 689-1 (libapache-mod-python)
20556| [53433] Debian Security Advisory DSA 181-1 (libapache-mod-ssl)
20557| [53282] Debian Security Advisory DSA 594-1 (apache)
20558| [53248] Debian Security Advisory DSA 558-1 (libapache-mod-dav)
20559| [53224] Debian Security Advisory DSA 532-2 (libapache-mod-ssl)
20560| [53215] Debian Security Advisory DSA 525-1 (apache)
20561| [53151] Debian Security Advisory DSA 452-1 (libapache-mod-python)
20562| [52529] FreeBSD Ports: apache+ssl
20563| [52501] FreeBSD Ports: apache
20564| [52461] FreeBSD Ports: apache
20565| [52390] FreeBSD Ports: apache
20566| [52389] FreeBSD Ports: apache
20567| [52388] FreeBSD Ports: apache
20568| [52383] FreeBSD Ports: apache
20569| [52339] FreeBSD Ports: apache+mod_ssl
20570| [52331] FreeBSD Ports: apache
20571| [52329] FreeBSD Ports: ru-apache+mod_ssl
20572| [52314] FreeBSD Ports: apache
20573| [52310] FreeBSD Ports: apache
20574| [15588] Detect Apache HTTPS
20575| [15555] Apache mod_proxy content-length buffer overflow
20576| [15554] Apache mod_include priviledge escalation
20577| [14771] Apache <= 1.3.33 htpasswd local overflow
20578| [14177] Apache mod_access rule bypass
20579| [13644] Apache mod_rootme Backdoor
20580| [12293] Apache Input Header Folding and mod_ssl ssl_io_filter_cleanup DoS Vulnerabilities
20581| [12280] Apache Connection Blocking Denial of Service
20582| [12239] Apache Error Log Escape Sequence Injection
20583| [12123] Apache Tomcat source.jsp malformed request information disclosure
20584| [12085] Apache Tomcat servlet/JSP container default files
20585| [11438] Apache Tomcat Directory Listing and File disclosure
20586| [11204] Apache Tomcat Default Accounts
20587| [11092] Apache 2.0.39 Win32 directory traversal
20588| [11046] Apache Tomcat TroubleShooter Servlet Installed
20589| [11042] Apache Tomcat DOS Device Name XSS
20590| [11041] Apache Tomcat /servlet Cross Site Scripting
20591| [10938] Apache Remote Command Execution via .bat files
20592| [10839] PHP.EXE / Apache Win32 Arbitrary File Reading Vulnerability
20593| [10773] MacOS X Finder reveals contents of Apache Web files
20594| [10766] Apache UserDir Sensitive Information Disclosure
20595| [10756] MacOS X Finder reveals contents of Apache Web directories
20596| [10752] Apache Auth Module SQL Insertion Attack
20597| [10704] Apache Directory Listing
20598| [10678] Apache /server-info accessible
20599| [10677] Apache /server-status accessible
20600| [10440] Check for Apache Multiple / vulnerability
20601|
20602| SecurityTracker - https://www.securitytracker.com:
20603| [1028865] Apache Struts Bugs Permit Remote Code Execution and URL Redirection Attacks
20604| [1028864] Apache Struts Wildcard Matching and Expression Evaluation Bugs Let Remote Users Execute Arbitrary Code
20605| [1028824] Apache mod_dav_svn URI Processing Flaw Lets Remote Users Deny Service
20606| [1028823] Apache Unspecified Flaw in mod_session_dbd Has Unspecified Impact
20607| [1028724] (HP Issues Fix for HP-UX) Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
20608| [1028722] (Red Hat Issues Fix for JBoss) Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
20609| [1028693] (Red Hat Issues Fix) Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
20610| [1028622] Apache Struts 'includeParams' Bugs Permit Remote Command Execution and Cross-Site Scripting Attacks
20611| [1028621] Apache Subversion Bugs Let Remote Authenticated Users Execute Arbitrary Commands and Deny Service
20612| [1028540] Apache mod_rewrite Input Validation Flaw Lets Remote Users Execute Arbitrary Commands
20613| [1028534] Apache Tomcat FORM Authenticator Lets Remote Users Conduct Session Fixation Attacks
20614| [1028533] Apache Tomcat Lack of Chunked Transfer Encoding Extension Size Limit Lets Remote Users Deny Service
20615| [1028532] Apache Tomcat AsyncListeners Bug May Disclose Information from One Request to Another User
20616| [1028515] Apache VCL Input Validation Flaw Lets Remote Authenticated Users Gain Elevated Privileges
20617| [1028457] Apache ActiveMQ Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Deny Service, and Obtain Potentially Sensitive Information
20618| [1028287] Apache CXF WSS4JInInterceptor Grants Service Access to Remote Users
20619| [1028286] Apache CXF WS-Security UsernameToken Processing Flaw Lets Remote Users Bypass Authentication
20620| [1028252] Apache Commons FileUpload Unsafe Temporary File Lets Local Users Gain Elevated Privileges
20621| [1028207] Apache Input Validation Bugs Permit Cross-Site Scripting Attacks
20622| [1027836] Apache Tomcat Connection Processing Bug Lets Remote Users Deny Service
20623| [1027834] Apache Tomcat Bug Lets Remote Users Bypass Cross-Site Request Forgery Prevention Filter
20624| [1027833] Apache Tomcat Bug Lets Remote Users Bypass Security Constraints
20625| [1027729] Apache Tomcat Header Processing Bug Lets Remote Users Deny Service
20626| [1027728] Apache Tomcat Lets Remote Users Conduct DIGEST Authentication Replay Attacks
20627| [1027554] Apache CXF Lets Remote Authenticated Users Execute Unauthorized SOAP Actions
20628| [1027508] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
20629| [1027421] Apache Web Server Bugs Permit Cross-Site Scripting and Information Disclosure Attacks
20630| [1027096] Apache Commons Compress BZip2CompressorOutputStream() Sorting Algorithm Lets Remote or Local Users Deny Service
20631| [1026932] Apache LD_LIBRARY_PATH Processing Lets Local Users Gain Elevated Privileges
20632| [1026928] Apache OFBiz Unspecified Flaw Lets Remote Users Execute Arbitrary Code
20633| [1026927] Apache OFBiz Input Validation Flaws Permit Cross-Site Scripting Attacks
20634| [1026847] Apache Traffic Server Host Header Processing Flaw Lets Remote Users Deny Service
20635| [1026846] Apache Wicket Discloses Hidden Application Files to Remote Users
20636| [1026839] Apache Wicket Input Validation Flaw in 'wicket:pageMapName' Parameter Permits Cross-Site Scripting Attacks
20637| [1026616] Apache Bugs Let Remote Users Deny Service and Obtain Cookie Data
20638| [1026575] Apache Struts ParameterInterceptor() Flaw Lets Remote Users Execute Arbitrary Commands
20639| [1026484] Apache Struts Bug Lets Remote Users Overwrite Files and Execute Arbitrary Code
20640| [1026477] Apache Tomcat Hash Table Collision Bug Lets Remote Users Deny Service
20641| [1026402] Apache Struts Conversion Error Lets Remote Users Inject Arbitrary Commands
20642| [1026353] Apache mod_proxy/mod_rewrite Bug Lets Remote Users Access Internal Servers
20643| [1026295] Apache Tomcat Lets Untrusted Web Applications Gain Elevated Privileges
20644| [1026267] Apache .htaccess File Integer Overflow Lets Local Users Execute Arbitrary Code
20645| [1026144] Apache mod_proxy Pattern Matching Bug Lets Remote Users Access Internal Servers
20646| [1026095] Apache Tomcat HTTP DIGEST Authentication Weaknesses Let Remote Users Conduct Bypass Attacks
20647| [1026054] Apache mod_proxy_ajp HTTP Processing Error Lets Remote Users Deny Service
20648| [1025993] Apache Tomcat AJP Protocol Processing Bug Lets Remote Users Bypass Authentication or Obtain Information
20649| [1025976] Apache Wicket Input Validation Flaw Permits Cross-Site Scripting Attacks
20650| [1025960] Apache httpd Byterange Filter Processing Error Lets Remote Users Deny Service
20651| [1025925] Apache Tomcat Commons Daemon jsvc Lets Local Users Gain Elevated Privileges
20652| [1025924] Apache Tomcat XML Validation Flaw Lets Applications Obtain Potentially Sensitive Information
20653| [1025788] Apache Tomcat Lets Malicious Applications Obtain Information and Deny Service
20654| [1025755] Apache Santuario Buffer Overflow Lets Remote Users Deny Service
20655| [1025712] Apache Tomcat Discloses Passwords to Local Users in Certain Cases
20656| [1025577] Apache Archiva Input Validation Hole Permits Cross-Site Scripting Attacks
20657| [1025576] Apache Archiva Request Validation Flaw Permits Cross-Site Request Forgery Attacks
20658| [1025527] Apache APR Library apr_fnmatch() Flaw Lets Remote Users Execute Arbitrary Code
20659| [1025303] Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
20660| [1025215] Apache Tomcat May Ignore @ServletSecurity Annotation Protections
20661| [1025066] Apache Continuum Input Validation Flaw Permits Cross-Site Request Forgery Attacks
20662| [1025065] Apache Continuum Input Validation Hole Permits Cross-Site Scripting Attacks
20663| [1025027] Apache Tomcat maxHttpHeaderSize Parsing Error Lets Remote Users Deny Service
20664| [1025026] Apache Tomcat Manager Input Validation Hole Permits Cross-Site Scripting Attacks
20665| [1025025] Apache Tomcat Security Manager Lets Local Users Bypass File Permissions
20666| [1024764] Apache Tomcat Manager Input Validation Hole in 'sessionList.jsp' Permits Cross-Site Scripting Attacks
20667| [1024417] Apache Traffic Server Insufficient Randomization Lets Remote Users Poison the DNS Cache
20668| [1024332] Apache mod_cache and mod_dav Request Processing Flaw Lets Remote Users Deny Service
20669| [1024180] Apache Tomcat 'Transfer-Encoding' Header Processing Flaw Lets Remote Users Deny Service and Obtain Potentially Sensitive Information
20670| [1024096] Apache mod_proxy_http May Return Results for a Different Request
20671| [1023942] Apache mod_proxy_ajp Error Condition Lets Remote Users Deny Service
20672| [1023941] Apache ap_read_request() Memory Error May Let Remote Users Access Potentially Sensitive Information
20673| [1023778] Apache ActiveMQ Input Validation Flaw Permits Cross-Site Scripting Attacks
20674| [1023701] Apache mod_isapi Error Processing Flaw May Let Remote Users Deny Service
20675| [1023533] Apache mod_proxy Integer Overflow May Let Remote Users Execute Arbitrary Code
20676| [1022988] Apache Solaris Support Code Bug Lets Remote Users Deny Service
20677| [1022529] Apache mod_deflate Connection State Bug Lets Remote Users Deny Service
20678| [1022509] Apache mod_proxy stream_reqbody_cl() Infinite Loop Lets Remote Users Deny Service
20679| [1022296] Apache IncludesNoExec Options Restrictions Can Be Bypass By Local Users
20680| [1022264] Apache mod_proxy_ajp Bug May Disclose Another User's Response Data
20681| [1022001] Apache Tomcat mod_jk May Disclose Responses to the Wrong User
20682| [1021988] mod_perl Input Validation Flaw in Apache::Status and Apache2::Status Permits Cross-Site Scripting Attacks
20683| [1021350] NetWare Bug Lets Remote Users Access the ApacheAdmin Console
20684| [1020635] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
20685| [1020520] Oracle WebLogic Apache Connector Lets Remote Users Execute Arbitrary Code
20686| [1020267] Apache mod_proxy Interim Response Process Bug Lets Remote Users Deny Service
20687| [1019784] Apache-SSL Certificate Processing Bug May Let Remote Users View Portions of Kernel Memory
20688| [1019256] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks
20689| [1019194] Apache Input Validation Hole in Mod_AutoIndex When the Character Set is Undefined May Permit Cross-Site Scripting Attacks
20690| [1019185] Apache Input Validation Hole in mod_proxy_ftp Permits Cross-Site Scripting Attacks
20691| [1019154] Apache Input Validation Hole in mod_status Permits Cross-Site Scripting Attacks
20692| [1019093] Apache Input Validation Hole in mod_imap Permits Cross-Site Scripting Attacks
20693| [1019030] Apache Input Validation Hole in Default HTTP 413 Error Page Permits Cross-Site Scripting Attacks
20694| [1018633] Apache mod_proxy Bug Lets Remote Users Deny Service
20695| [1018304] Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
20696| [1018303] Apache HTTPD mod_cache May Let Remote Users Deny Service
20697| [1018302] Apache mod_status Input Validation Hole Permits Cross-Site Scripting Attacks
20698| [1018269] Apache Tomcat Input Validation Hole in Processing Accept-Language Header Permits Cross-Site Scripting Attacks
20699| [1017904] Apache suEXEC Bugs May Let Local Users Gain Elevated Privileges
20700| [1017719] Apache Tomcat JK Web Server Connector Buffer Overflow in map_uri_to_worker() Lets Remote Users Execute Arbitrary Code
20701| [1017062] Apache mod_tcl Format String Bug in set_var() Function May Let Remote Users Execute Arbitrary Code
20702| [1016601] Apache mod_rewrite Off-by-one Error Lets Remote Users Execute Arbitrary Code
20703| [1016576] Apache Tomcat Discloses Directory Listings to Remote Users
20704| [1015447] Apache mod_ssl Null Pointer Dereference May Let Remote Users Deny Service
20705| [1015344] Apache mod_imap Input Validation Flaw in Referer Field Lets Remote Users Conduct Cross-Site Scripting Attacks
20706| [1015093] Apache Memory Leak in MPM 'worker.c' Code May Let Remote Users Deny Service
20707| [1014996] ApacheTop Unsafe Temporary File May Let Local Users Gain Elevated Privileges
20708| [1014833] Apache ssl_hook_Access() Function May Fail to Verify Client Certificates
20709| [1014826] Apache Memory Leak in 'byterange filter' Lets Remote Users Deny Service
20710| [1014575] Apache mod_ssl Off-by-one Buffer Overflow in Processing CRLs May Let Remote Users Deny Service
20711| [1014323] Apache Chunked Transfer-Encoding and Content-Length Processing Lets Remote Users Smuggle HTTP Requests
20712| [1013156] Apache mod_python Publisher Handler Discloses Information to Remote Users
20713| [1012829] Apache mod_auth_radius radcpy() Integer Overflow Lets Remote Users Deny Service in Certain Cases
20714| [1012416] Apache on Apple OS X Lets Remote Users Bypass Apache File Handlers and Directly Access Files
20715| [1012415] Apache on Apple HFS+ Filesystems May Disclose '.DS_Store' Files to Remote Users
20716| [1012414] Apache mod_digest_apple Lets Remote Users Replay Authentication Credentials
20717| [1012083] Apache Web Server Error in Processing Requests With Many Space Characters Lets Remote Users Deny Service
20718| [1011783] Apache mod_include Buffer Overflow Lets Local Users Execute Arbitrary Code
20719| [1011557] Apache mod_ssl SSLCipherSuite Directive Can By Bypassed in Certain Cases
20720| [1011385] Apache Satsify Directive Error May Let Remote Users Access Restricted Resources
20721| [1011340] Apache SSL Connection Abort State Error Lets Remote Users Deny Service
20722| [1011303] Apache ap_resolve_env() Buffer Overflow in Reading Configuration Files May Let Local Users Gain Elevated Privileges
20723| [1011299] Apache IPv6 Address Parsing Flaw May Let Remote Users Deny Service
20724| [1011248] Apache mod_dav LOCK Method Error May Let Remote Users Deny Service
20725| [1011213] Apache mod_ssl Can Be Crashed By Remote Users When Reverse Proxying SSL Connections
20726| [1010674] Apache Can Be Crashed By PHP Code Invoking Nested Remote Sockets
20727| [1010599] Apache httpd Header Line Memory Allocation Lets Remote Users Crash the Server
20728| [1010462] Apache mod_proxy Buffer Overflow May Let Remote Users Execute Arbitrary Code
20729| [1010322] Apache mod_ssl Stack Overflow in ssl_util_uuencode_binary() May Let Remote Users Execute Arbitrary Code
20730| [1010270] cPanel Apache mod_phpsuexec Options Let Local Users Gain Elevated Privileges
20731| [1009934] Apache Web Server Has Buffer Overflow in ebcdic2ascii() on Older Processor Architectures
20732| [1009516] Apache mod_survey HTML Report Format Lets Remote Users Conduct Cross-Site Scripting Attacks
20733| [1009509] Apache mod_disk_cache Stores Authentication Credentials on Disk
20734| [1009495] Apache Web Server Socket Starvation Flaw May Let Remote Users Deny Service
20735| [1009417] GroupWise WebAccess With Apache on NetWare Has Configuration Flaw That May Grant Web Access to Remote Users
20736| [1009338] Apache mod_access Parsing Flaw May Fail to Enforce Allow/Deny Rules
20737| [1009337] Apache mod_ssl Memory Leak Lets Remote Users Crash the Daemon
20738| [1009182] Apache for Cygwin '..%5C' Input Validation Flaw Discloses Files to Remote Users
20739| [1008973] PHP May Apply Incorrect php_admin_* Settings To Requests for Apache Virtual Hosts
20740| [1008967] Apache-SSL 'SSLFakeBasicAuth' Lets Remote Users Forge Client Certificates to Be Authenticated
20741| [1008920] Apache mod_digest May Validate Replayed Client Responses
20742| [1008828] Apache mod_python String Processing Bug Still Lets Remote Users Crash the Web Server
20743| [1008822] Apache mod_perl File Descriptor Leak May Let Local Users Hijack the http and https Services
20744| [1008675] mod_auth_shadow Apache Module Authenticates Expired Passwords
20745| [1008559] Apache mod_php File Descriptor Leak May Let Local Users Hijack the https Service
20746| [1008335] Apache mod_python String Processing Bug Lets Remote Users Crash the Web Server
20747| [1008196] Apache 2.x on Windows May Return Unexpected Files For URLs Ending With Certain Characters
20748| [1008030] Apache mod_rewrite Contains a Buffer Overflow
20749| [1008029] Apache mod_alias Contains a Buffer Overflow
20750| [1008028] Apache mod_cgid May Disclose CGI Output to Another Client
20751| [1007995] Apache Cocoon Forms May Let Remote Users Execute Arbitrary Java Code on the System
20752| [1007993] Apache Cocoon 'view-source' Sample Script Discloses Files to Remote Users
20753| [1007823] Apache Web Server mod_cgi Error May Let Malicious CGI Scripts Crash the Web Service
20754| [1007664] Apache::Gallery Unsafe Temporary Files May Let Local Users Gain Apache Web Server Privileges
20755| [1007557] Apache Web Server Does Not Filter Terminal Escape Sequences From Log Files
20756| [1007230] Apache HTTP Server 'rotatelogs' Bug on Win32 and OS/2 May Cause the Logging to Stop
20757| [1007146] Apache HTTP Server FTP Proxy Bug May Cause Denial of Service Conditions
20758| [1007145] Apache 'accept()' Errors May Cause Denial of Service Conditions
20759| [1007144] Apache Web Server 'type-map' File Error Permits Local Denial of Service Attacks
20760| [1007143] Apache 2.0 Web Server May Use a Weaker Encryption Implementation Than Specified in Some Cases
20761| [1006864] Apache Web Server Can Be Crashed By Remote Users Via mod_dav Flaws and Also Via Basic Authentication
20762| [1006709] Apache mod_survey Input Validation Flaw Lets Remote Users Fill Up Disk Space
20763| [1006614] Apache mod_ntlm Buffer Overflow and Format String Flaw Let Remote Users Execute Arbitary Code
20764| [1006591] Apache mod_access_referer Module Null Pointer Dereference May Faciliate Denial of Service Attacks
20765| [1006444] Apache 2.0 Web Server Line Feed Buffer Allocation Flaw Lets Remote Users Deny Service
20766| [1006021] Apache Tomcat Server URL Parsing Error May Disclose Otherwise Inaccessible Web Directory Listings and Files to Remote Users
20767| [1005963] Apache Web Server 2.x Windows Device Access Flaw Lets Remote Users Crash the Server or Possibly Execute Arbitrary Code
20768| [1005962] Apache Web Server Path Parsing Flaw May Allow Remote Users to Execute Code in Certain Configurations
20769| [1005848] Apache 'printenv' Script Input Validation Bugs in Older Versions May Let Remote Users Conduct Cross-Site Scripting Attacks
20770| [1005765] Apache mod_jk Module Processing Bug When Used With Tomcat May Disclose Information to Remote Users or Crash
20771| [1005548] Apache mod_php Module May Allow Local Users to Gain Control of the Web Port
20772| [1005499] Apache Web Server (2.0.42) May Disclose CGI Source Code to Remote Users When Used With WebDAV
20773| [1005410] Apache Tomcat Java Servlet Engine Can Be Crashed Via Multiple Requests for DOS Device Names
20774| [1005351] Apache Web Server (1.3.x) Shared Memory Scoreboard Bug Lets Certain Local Users Issue Signals With Root Privileges
20775| [1005331] Apache Web Server (2.x) SSI Server Signature Filtering Hole Lets Remote Users Conduct Cross-Site Scripting Attacks
20776| [1005290] Apache Tomcat Java Server Default Servlet Returns JSP Source Code to Remote Users
20777| [1005285] Apache Web Server 'mod_dav' Has Null Pointer Bug That May Allow Remote Users to Cause Denial of Service Conditions
20778| [1005010] Apache Web Server (2.0) Has Unspecified Flaw That Allows Remote Users to Obtain Sensitive Data and Cause Denial of Service Conditions
20779| [1004770] Apache 2.x Web Server ap_log_rerror() Function May Disclose Full Installation Path to Remote Users
20780| [1004745] Apache Tomcat Java Server Allows Cross-Site Scripting Attacks
20781| [1004636] Apache mod_ssl 'Off-by-One' Bug May Let Local Users Crash the Web Server or Possibly Execute Arbitrary Code
20782| [1004602] Apache Tomcat Java Server for Windows Can Be Crashed By Remote Users Sending Malicious Requests to Hang All Available Working Threads
20783| [1004586] Apache Tomcat Java Server May Disclose the Installation Path to Remote Users
20784| [1004555] Apache Web Server Chunked Encoding Flaw May Let Remote Users Execute Arbitrary Code on the Server
20785| [1004209] Apache 'mod_python' Python Language Interpreter Bug in Publisher Handler May Allow Remote Users to Modify Files on the System
20786| [1003874] Apache Web Server for Windows Has Batch File Processing Hole That Lets Remote Users Execute Commands on the System
20787| [1003767] 'mod_frontpage' Module for Apache Web Server Has Buffer Overlow in 'fpexec.c' That Allows Remote Users to Execute Arbitrary Code on the System with Root Privileges
20788| [1003723] Apache-SSL for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
20789| [1003664] 'mod_ssl' Security Package for Apache Web Server Has Buffer Overflow That Can Be Triggered By Remote Users
20790| [1003602] GNUJSP Java Server Pages Implementation Discloses Web Files and Source Code to Remote Users and Bypasses Apache Access Control Restrictions
20791| [1003465] PHP for Apache Web Server May Disclose Installation Path Information to Remote Users Making 'OPTIONS' Requests
20792| [1003451] Oracle Application Server PL/SQL Module for Apache Has Buffer Overflows That Allow Remote Users to Execute Arbitrary Code and Gain Access to the Server
20793| [1003131] Apache Web Server in Virtual Hosting Mode Can Be Crashed By a Local User Removing a Log Directory
20794| [1003104] PHP.EXE Windows CGI for Apache Web Server May Let Remote Users View Files on the Server Due to Configuration Error
20795| [1003008] Apache 'mod_bf' Module Lets Remote Users Execute Arbitrary Code
20796| [1002629] Apache suEXEC Wrapper Fails to Observe Minimum Group ID Security Settings in Certain Situations
20797| [1002542] Apache Web Server Virtual Hosting Split-Logfile Function Lets Remote Users Write Log Entries to Arbitrary Files on the System
20798| [1002400] Apache mod_gzip Module Has Buffer Overflow That Can Be Exploited By Local Users to Gain Elevated Privileges
20799| [1002303] Several 3rd Party Apache Authentication Modules Allow Remote Users to Execute Arbitrary Code to Gain Access to the System or Execute Stored Procedures to Obtain Arbitrary Database Information
20800| [1002188] Apache Web Server Discloses Internal IP Addresses to Remote Users in Certain Configurations
20801| [1001989] Apache Web Server May Disclose Directory Contents Even If an Index.html File is Present in the Directory
20802| [1001719] Apache Web Server on Mac OS X Client Fails to Enforce File and Directory Access Protections, Giving Remote Users Access to Restricted Pages
20803| [1001572] Apache Web Server on Microsoft Windows Platforms Allows Remote Users to Crash the Web Server
20804| [1001304] Apache Web Server for Windows Lets Remote Users Crash the Web Server Application
20805| [1001083] Apache Web Server May Display Directory Index Listings Even if Directory Listings Are Disabled
20806|
20807| OSVDB - http://www.osvdb.org:
20808| [96078] Apache CloudStack Infrastructure Menu Setup Network Multiple Field XSS
20809| [96077] Apache CloudStack Global Settings Multiple Field XSS
20810| [96076] Apache CloudStack Instances Menu Display Name Field XSS
20811| [96075] Apache CloudStack Instances Menu Add Instances Network Name Field XSS
20812| [96074] Apache CloudStack Instances Menu Add Instances Review Step Multiple Field XSS
20813| [96031] Apache HTTP Server suEXEC Symlink Arbitrary File Access
20814| [95888] Apache Archiva Single / Double Quote Character Handling XSS Weakness
20815| [95885] Apache Subversion mod_dav_svn Module Crafted HTTP Request Handling Remote DoS
20816| [95706] Apache OpenOffice.org (OOo) OOXML Document File XML Element Handling Memory Corruption
20817| [95704] Apache OpenOffice.org (OOo) DOC File PLCF Data Handling Memory Corruption
20818| [95603] Apache Continuum web/util/GenerateRecipentNotifier.java recipient Parameter XSS
20819| [95602] Apache Continuum web/action/notifier/JabberProjectNotifierEditAction-jabberProjectNotifierSave-validation.xml Multiple Parameter XSS
20820| [95601] Apache Continuum web/action/notifier/JabberGroupNotifierEditAction-jabberProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
20821| [95600] Apache Continuum web/action/ScheduleAction-saveSchedule-validation.xml Multiple Parameter XSS
20822| [95599] Apache Continuumweb/action/BuildDefinitionAction-saveBuildDefinition-validation.xml Multiple Parameter XSS
20823| [95598] Apache Continuum web/action/AddProjectAction-addProject-validation.xml Multiple Parameter XSS
20824| [95597] Apache Continuum web/action/ProjectEditAction-projectSave-validation.xml Multiple Parameter XSS
20825| [95596] Apache Continuum web/action/notifier/IrcGroupNotifierEditAction-ircProjectGroupNotifierSave-validation.xml Multiple Parameter XSS
20826| [95595] Apache Continuum web/action/notifier/IrcProjectNotifierEditAction-ircProjectNotifierSave-validation.xml Multiple Parameter XSS
20827| [95594] Apache Continuum web/action/ProjectGroupAction.java Multiple Parameter XSS
20828| [95593] Apache Continuum web/action/AddProjectGroupAction.java Multiple Parameter XSS
20829| [95592] Apache Continuum web/action/AddProjectAction.java Multiple Parameter XSS
20830| [95523] Apache OFBiz Webtools Application View Log Screen Unspecified XSS
20831| [95522] Apache OFBiz Nested Expression Evaluation Arbitrary UEL Function Execution
20832| [95521] Apache HTTP Server mod_session_dbd Session Saving Unspecified Issue
20833| [95498] Apache HTTP Server mod_dav.c Crafted MERGE Request Remote DoS
20834| [95406] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Arbitrary Site Redirect
20835| [95405] Apache Struts DefaultActionMapper Multiple Prefixing Parameters Remote Code Execution
20836| [95011] Apache CXF XML Parser SOAP Message Handling CPU Resource Exhaustion Remote DoS
20837| [94705] Apache Geronimo RMI Classloader Exposure Serialized Object Handling Remote Code Execution
20838| [94651] Apache Santuario (XML Security for C++) XML Signature CanonicalizationMethod Parameter Spoofing Weakness
20839| [94636] Apache Continuum workingCopy.action userDirectory Traversal Arbitrary File Access
20840| [94635] Apache Maven SCM SvnCommandlineUtils Process Listing Local Password Disclosure
20841| [94632] Apache Maven Wagon SSH (wagon-ssh) Host Verification Failure MitM Weakness
20842| [94625] Apache Santuario (XML Security for C++) XML Signature Reference Crafted XPointer Expression Handling Heap Buffer Overflow
20843| [94618] Apache Archiva /archiva/security/useredit.action username Parameter XSS
20844| [94617] Apache Archiva /archiva/security/roleedit.action name Parameter XSS
20845| [94616] Apache Archiva /archiva/security/userlist!show.action roleName Parameter XSS
20846| [94615] Apache Archiva /archiva/deleteArtifact!doDelete.action groupId Parameter XSS
20847| [94614] Apache Archiva /archiva/admin/addLegacyArtifactPath!commit.action legacyArtifactPath.path Parameter XSS
20848| [94613] Apache Archiva /archiva/admin/addRepository.action Multiple Parameter XSS
20849| [94612] Apache Archiva /archiva/admin/editAppearance.action Multiple Parameter XSS
20850| [94611] Apache Archiva /archiva/admin/addLegacyArtifactPath.action Multiple Parameter XSS
20851| [94610] Apache Archiva /archiva/admin/addNetworkProxy.action Multiple Parameter XSS
20852| [94403] Apache Santuario (XML Security for C++) InclusiveNamespace PrefixList Processing Heap Overflow
20853| [94402] Apache Santuario (XML Security for C++) HMAC-based XML Signature Processing DoS
20854| [94401] Apache Santuario (XML Security for C++) XPointer Evaluation Stack Overflow
20855| [94400] Apache Santuario (XML Security for C++) HMAC-Based XML Signature Reference Element Validation Spoofing Weakness
20856| [94279] Apache Qpid CA Certificate Validation Bypass
20857| [94275] Apache Solr JettySolrRunner.java Can Not Find Error Message XSS
20858| [94233] Apache OpenJPA Object Deserialization Arbitrary Executable Creation
20859| [94042] Apache Axis JAX-WS Java Unspecified Exposure
20860| [93969] Apache Struts OGNL Expression Handling Double Evaluation Error Remote Command Execution
20861| [93796] Apache Subversion Filename Handling FSFS Repository Corruption Remote DoS
20862| [93795] Apache Subversion svnserve Server Aborted Connection Message Handling Remote DoS
20863| [93794] Apache Subversion contrib/hook-scripts/check-mime-type.pl svnlook Hyphenated argv Argument Handling Remote DoS
20864| [93793] Apache Subversion contrib/hook-scripts/svn-keyword-check.pl Filename Handling Remote Command Execution
20865| [93646] Apache Struts Crafted Parameter Arbitrary OGNL Code Execution
20866| [93645] Apache Struts URL / Anchor Tag includeParams Attribute Remote Command Execution
20867| [93636] Apache Pig Multiple Physical Operator Memory Exhaustion Remote Remote DoS
20868| [93635] Apache Wink DTD (Document Type Definition) Expansion Data Parsing Information Disclosure
20869| [93605] RT Apache::Session::File Session Replay Reuse Information Disclosure
20870| [93599] Apache Derby SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY Boot Password Manipulation Re-encryption Failure Password Corruption
20871| [93555] Apache Commons Codec Invalid Base32 String Information Tunneling Weakness
20872| [93554] Apache HBase bulkLoadHFiles() Method ACL Bypass
20873| [93543] JBoss Enterprise Application Platform org.apache.catalina.connector.Response.encodeURL() Method MitM jsessionid Disclosure
20874| [93542] Apache ManifoldCF (Connectors Framework) org.apache.manifoldcf.crawler.ExportConfiguration Class Configuration Export Password Disclosure
20875| [93541] Apache Solr json.wrf Callback XSS
20876| [93524] Apache Hadoop GetSecurityDescriptorControl() Function Absolute Security Descriptor Handling NULL Descriptor Weakness
20877| [93521] Apache jUDDI Security API Token Session Persistence Weakness
20878| [93520] Apache CloudStack Default SSL Key Weakness
20879| [93519] Apache Shindig /ifr Cross-site Arbitrary Gadget Invocation
20880| [93518] Apache Solr /admin/analysis.jsp name Parameter XSS
20881| [93517] Apache CloudStack setup-cloud-management /etc/sudoers Modification Local Privilege Escalation
20882| [93516] Apache CXF UsernameTokenInterceptor Nonce Caching Replay Weakness
20883| [93515] Apache HBase table.jsp name Parameter XSS
20884| [93514] Apache CloudStack Management Server Unauthenticated Remote JMX Connection Default Setting Weakness
20885| [93463] Apache Struts EL / OGNL Interpretation Unspecified Remote Code Execution
20886| [93462] Apache CXF WS-SecurityPolicy AlgorithmSuite Arbitrary Ciphertext Decryption Weakness
20887| [93401] Apache Hadoop core-site.xml Permission Weakness Local Alfredo Secret Disclosure
20888| [93400] Apache Hadoop Map/Reduce Job Log Directory Symlink Arbitrary File Mode Manipulation
20889| [93397] Apache Wicket Referrer HTTP Header Session ID Disclosure
20890| [93366] Apache HTTP Server modules/mappers/mod_rewrite.c do_rewritelog() Function Log File Terminal Escape Sequence Filtering Remote Command Execution
20891| [93254] Apache Tomcat AsyncListener Method Cross-session Information Disclosure
20892| [93253] Apache Tomcat Chunked Transfer Encoding Data Saturation Remote DoS
20893| [93252] Apache Tomcat FORM Authenticator Session Fixation
20894| [93172] Apache Camel camel/endpoints/ Endpoint XSS
20895| [93171] Apache Sling HtmlResponse Error Message XSS
20896| [93170] Apache Directory DelegatingAuthenticator MitM Spoofing Weakness
20897| [93169] Apache Wave AuthenticationServlet.java Session Fixation Weakness
20898| [93168] Apache Click ErrorReport.java id Parameter XSS
20899| [93167] Apache ActiveMQ JMSXUserId Spoofing Weakness
20900| [93166] Apache CXF Crafted Message Element Count Handling System Resource Exhaustion Remote DoS
20901| [93165] Apache CXF Crafted Message Element Level Handling System Resource Exhaustion Remote DoS
20902| [93164] Apache Harmony DatagramSocket Class connect Method CheckAccept() IP Blacklist Bypass
20903| [93163] Apache Hadoop Map/Reduce Daemon Symlink Arbitrary File Overwrite
20904| [93162] Apache VelocityStruts struts/ErrorsTool.getMsgs Error Message XSS
20905| [93161] Apache CouchDB Rewriter VM Atom Table Memory Exhaustion Remote DoS
20906| [93158] Apache Wicket BookmarkablePageLink Feature XSS CSRF
20907| [93157] Apache Struts UrlHelper.java s:url includeParams Functionality XSS
20908| [93156] Apache Tapestry Calendar Component datefield.js datefield Parameter XSS
20909| [93155] Apache Struts fielderror.ftl fielderror Parameter Error Message XSS
20910| [93154] Apache JSPWiki Edit.jsp createPages WikiPermission Bypass
20911| [93153] Apache PDFBox PDFXrefStreamParser Missing Element Handling PDF Parsing DoS
20912| [93152] Apache Hadoop HttpServer.java Multiple Function XSS
20913| [93151] Apache Shiro Search Filter userName Parameter LDAP Code Injection Weakness
20914| [93150] Apache Harmony java.net.SocketPermission Class boolean equals Function checkConnect() Weakness Host Name Retrieval
20915| [93149] Apache Harmony java.security.Provider Class void load Function checkSecurityAccess() Weakness
20916| [93148] Apache Harmony java.security.ProtectionDomain Class java.lang.String.toString() Function checkPermission() Weakness
20917| [93147] Apache Harmony java.net.URLConnection openConnection Function checkConnect Weakness Proxy Connection Permission Bypass
20918| [93146] Apache Harmony java.net.ServerSocket Class void implAccept Function checkAccept() Weakness SerSocket Subclass Creation
20919| [93145] Apache Qpid JMS Client Detached Session Frame Handling NULL Pointer Dereference Remote DoS
20920| [93144] Apache Solr Admin Command Execution CSRF
20921| [93009] Apache VCL XMLRPC API Unspecified Function Remote Privilege Escalation
20922| [93008] Apache VCL Web GUI Unspecified Remote Privilege Escalation
20923| [92997] Apache Commons Codec org.apache.commons.codec.net.URLCodec Fields Missing 'final' Thread-safety Unspecified Issue
20924| [92976] Apache ActiveMQ scheduled.jsp crontab Command XSS
20925| [92947] Apache Commons Codec org.apache.commons.codec.language.Soundex.US_ENGLISH_MAPPING Missing MS_PKGPROTECT Field Manipulation Unspecified Issue
20926| [92749] Apache CloudStack Predictable Hash Virtual Machine Console Console Access URL Generation
20927| [92748] Apache CloudStack VM Console Access Restriction Bypass
20928| [92709] Apache ActiveMQ Web Console Unauthenticated Remote Access
20929| [92708] Apache ActiveMQ Sample Web Application Broker Resource Consumption Remote DoS
20930| [92707] Apache ActiveMQ webapp/websocket/chat.js Subscribe Message XSS
20931| [92706] Apache ActiveMQ Debug Log Rendering XSS
20932| [92705] Apache ActiveMQ PortfolioPublishServlet.java refresh Parameter XSS
20933| [92270] Apache Tomcat Unspecified CSRF
20934| [92094] Apache Subversion mod_dav_svn Module Nonexistent URL Lock Request Handling NULL Pointer Dereference Remote DoS
20935| [92093] Apache Subversion mod_dav_svn Module Activity URL PROPFIND Request Handling NULL Pointer Dereference Remote DoS
20936| [92092] Apache Subversion mod_dav_svn Module Log REPORT Request Handling NULL Pointer Dereference Remote DoS
20937| [92091] Apache Subversion mod_dav_svn Module Node Property Handling Resource Exhaustion Remote DoS
20938| [92090] Apache Subversion mod_dav_svn Module Activity URL Lock Request Handling NULL Pointer Dereference Remote DoS
20939| [91774] Apache Commons Codec Unspecified Non-private Field Manipulation Weakness
20940| [91628] mod_ruid2 for Apache HTTP Server fchdir() Inherited File Descriptor chroot Restriction Bypass
20941| [91328] Apache Wicket $up$ Traversal Arbitrary File Access
20942| [91295] Apple Mac OS X Apache Unicode Character URI Handling Authentication Bypass
20943| [91235] Apache Rave /app/api/rpc/users/get User Object Hashed Password Remote Disclosure
20944| [91185] Munin Default Apache Configuration Permission Weakness Remote Information Disclosure
20945| [91173] Apache Wicket WebApplicationPath Constructor Bypass /WEB-INF/ Directory File Access
20946| [91172] Apache Wicket PackageResourceGuard File Extension Filter Bypass
20947| [91025] Apache Qpid qpid::framing::Buffer Class Multiple Method Out-of-bounds Access Remote DoS
20948| [91024] Apache Qpid federation_tag Attribute Handling Federated Interbroker Link Access Restriction Bypass
20949| [91023] Apache Qpid AMQP Type Decoder Exposure Array Size Value Handling Memory Consumption Remote DoS
20950| [91022] Apache Qpid qpid/cpp/include/qpid/framing/Buffer.h qpid::framing::Buffer::checkAvailable() Function Integer Overflow
20951| [90986] Apache Jena ARQ INSERT DATA Request Handling Overflow
20952| [90907] Apache Subversion mod_dav_svn / libsvn_fs svn_fs_file_length() Function MKACTIVITY / PROPFIND Option Request Handling Remote DoS
20953| [90906] Apache Commons FileUpload /tmp Storage Symlink Arbitrary File Overwrite
20954| [90864] Apache Batik 1xx Redirect Script Origin Restriction Bypass
20955| [90858] Apache Ant Malformed TAR File Handling Infinite Loop DoS
20956| [90852] Apache HTTP Server for Debian apachectl /var/lock Permission Weakness Symlink Directory Permission Manipulation
20957| [90804] Apache Commons CLI Path Subversion Local Privilege Escalation
20958| [90802] Apache Avro Recursive Schema Handling Infinite Recursion DoS
20959| [90592] Apache Batik ApplicationSecurityEnforcer.java Multiple Method Security Restriction Bypass
20960| [90591] Apache Batik XML External Entity (XXE) Data Parsing Arbitrary File Disclosure
20961| [90565] Apache Tomcat Log Directory Permission Weakness Local Information Disclosure
20962| [90564] Apache Maven / Maven Wagon SSL Certificate Validation MitM Spoofing Weakness
20963| [90557] Apache HTTP Server mod_proxy_balancer balancer-manager Interface Multiple Parameter XSS
20964| [90556] Apache HTTP Server Multiple Module Multiple Parameter XSS
20965| [90276] Apache Axis2 axis2.xml Plaintext Password Local Disclosure
20966| [90249] Apache Axiom ClassLoader XMLInputFactory / XMLOutputFactory Construction Unspecified Issue
20967| [90235] Apache Commons HttpClient Certificate Wildcard Matching Weakness
20968| [90079] Apache CXF WSS4JInInterceptor URIMappingInterceptor WS-Security SOAP Service Access Restriction Bypass
20969| [90078] Apache CXF WS-SecurityPolicy Enabled Plaintext UsernameTokens Handling Authentication Bypass
20970| [89453] Apache Open For Business Project (OFBiz) Screenlet.title Widget Attribute XSS
20971| [89452] Apache Open For Business Project (OFBiz) Image.alt Widget Attribute XSS
20972| [89294] Apache CouchDB Futon UI Browser-based Test Suite Query Parameter XSS
20973| [89293] Apache CouchDB Unspecified Traversal Arbitrary File Access
20974| [89275] Apache HTTP Server mod_proxy_ajp Module Expensive Request Parsing Remote DoS
20975| [89267] Apache CouchDB JSONP Callback Handling Unspecified XSS
20976| [89146] Apache CloudStack Master Server log4j.conf SSH Private Key / Plaintext Password Disclosure
20977| [88603] Apache OpenOffice.org (OOo) Unspecified Information Disclosure
20978| [88602] Apache OpenOffice.org (OOo) Unspecified Manifest-processing Issue
20979| [88601] Apache OpenOffice.org (OOo) Unspecified PowerPoint File Handling Issue
20980| [88285] Apache Tomcat Partial HTTP Request Saturation Remote DoS
20981| [88095] Apache Tomcat NIO Connector Terminated Connection Infinte Loop DoS
20982| [88094] Apache Tomcat FORM Authentication Crafted j_security_check Request Security Constraint Bypass
20983| [88093] Apache Tomcat Null Session Requst CSRF Prevention Filter Bypass
20984| [88043] IBM Tivoli Netcool/Reporter Apache CGI Unspecified Remote Command Execution
20985| [87580] Apache Tomcat DIGEST Authentication Session State Caching Authentication Bypass Weakness
20986| [87579] Apache Tomcat DIGEST Authentication Stale Nonce Verification Authentication Bypass Weakness
20987| [87477] Apache Tomcat Project Woodstock Service Error Page UTF-7 XSS Weakness
20988| [87227] Apache Tomcat InternalNioInputBuffer.java parseHeaders() Function Request Header Size Parsing Remote DoS
20989| [87223] Apache Tomcat DIGEST Authentication replay-countermeasure Functionality cnonce / cn Verification Authentication Bypass Weakness
20990| [87160] Apache Commons HttpClient X.509 Certificate Domain Name Matching MiTM Weakness
20991| [87159] Apache CXF X.509 Certificate Domain Name Matching MiTM Weakness
20992| [87150] Apache Axis / Axis2 X.509 Certificate Domain Name Matching MiTM Weakness
20993| [86902] Apache HTTP Server 3xx Redirect Internal IP Address Remote Disclosure
20994| [86901] Apache Tomcat Error Message Path Disclosure
20995| [86684] Apache CloudStack Unauthorized Arbitrary API Call Invocation
20996| [86556] Apache Open For Business Project (OFBiz) Unspecified Issue
20997| [86503] Visual Tools VS home/apache/DiskManager/cron/init_diskmgr Local Command Execution
20998| [86401] Apache ActiveMQ ResourceHandler Traversal Arbitrary File Access
20999| [86225] Apache Axis2 XML Signature Wrapping (XSW) Authentication Bypass
21000| [86206] Apache Axis2 Crafted SAML Assertion Signature Exclusion Attack Authentication Bypass
21001| [85722] Apache CXF SOAP Request Parsing Access Restriction Bypass
21002| [85704] Apache Qpid Incoming Client Connection Saturation Remote DoS
21003| [85474] Eucalyptus Apache Santuario (XML Security for Java) Library XML Signature Transform Handling DoS
21004| [85430] Apache mod_pagespeed Module Unspecified XSS
21005| [85429] Apache mod_pagespeed Module Hostname Verification Cross-host Resource Disclosure
21006| [85249] Apache Wicket Unspecified XSS
21007| [85236] Apache Hadoop conf/hadoop-env.sh Temporary File Symlink Arbitrary File Manipulation
21008| [85090] Apache HTTP Server mod_proxy_ajp.c mod_proxy_ajp Module Proxy Functionality Cross-client Information Disclosure
21009| [85089] Apache HTTP Server mod_proxy_http.c mod_proxy_http Module Cross-client Information Disclosure
21010| [85062] Apache Solr Autocomplete Module for Drupal Autocomplete Results XSS
21011| [85010] Apache Struts Token Handling Mechanism Token Name Configuration Parameter CSRF Weakness
21012| [85009] Apache Struts Request Parameter OGNL Expression Parsing Remote DoS
21013| [84911] libapache2-mod-rpaf X-Forward-For HTTP Header Parsing Remote DoS
21014| [84823] Apache HTTP Server Multiple Module Back End Server Error Handling HTTP Request Parsing Remote Information Disclosure
21015| [84818] Apache HTTP Server mod_negotiation Module mod_negotiation.c make_variant_list Function XSS
21016| [84562] Apache Qpid Broker Authentication Mechanism AMQP Client Shadow Connection NullAuthenticator Request Parsing Authentication Bypass
21017| [84458] Apache Libcloud SSL Certificate Validation MitM Spoofing Weakness
21018| [84279] PHP on Apache php_default_post_reader POST Request Handling Overflow DoS
21019| [84278] PHP w/ Apache PDO::ATTR_DEFAULT_FETCH_MODE / PDO::FETCH_CLASS DoS
21020| [84231] Apache Hadoop DataNodes Client BlockTokens Arbitrary Block Access
21021| [83943] Oracle Solaris Cluster Apache Tomcat Agent Subcomponent Unspecified Local Privilege Escalation
21022| [83939] Oracle Solaris Apache HTTP Server Subcomponent Unspecified Remote Information Disclosure
21023| [83685] svnauthcheck Apache HTTP Configuration File Permission Revocation Weakness
21024| [83682] Apache Sling POST Servlet @CopyFrom Operation HTTP Request Parsing Infinite Loop Remote DoS
21025| [83339] Apache Roller Blogger Roll Unspecified XSS
21026| [83270] Apache Roller Unspecified Admin Action CSRF
21027| [82782] Apache CXF WS-SecurityPolicy 1.1 SupportingToken Policy Bypass
21028| [82781] Apache CXF WS-SecurityPolicy Supporting Token Children Specification Token Signing Verification Weakness
21029| [82611] cPanel Apache Piped Log Configuration Log Message Formatting Traversal Arbitrary File Creation
21030| [82436] MapServer for Windows Bundled Apache / PHP Configuration Local File Inclusion
21031| [82215] PHP sapi/cgi/cgi_main.c apache_request_headers Function HTTP Header Handling Remote Overflow
21032| [82161] Apache Commons Compress bzip2 File Compression BZip2CompressorOutputStream Class File Handling Remote DoS
21033| [81965] Apache Batik Squiggle SVG Browser JAR File Arbitrary Code Execution
21034| [81790] Apache POI src/org/apache/poi/hwpf/model/UnhandledDataStructure.java UnhandledDataStructure() constructor Length Attribute CDF / CFBF File Handling Remote DoS
21035| [81660] Apache Qpid Credential Checking Cluster Authentication Bypass
21036| [81511] Apache for Debian /usr/share/doc HTTP Request Parsing Local Script Execution
21037| [81359] Apache HTTP Server LD_LIBRARY_PATH Variable Local Privilege Escalation
21038| [81349] Apache Open For Business Project (OFBiz) Webslinger Component Unspecified XSS
21039| [81348] Apache Open For Business Project (OFBiz) Content IDs / Map-Keys Unspecified XSS
21040| [81347] Apache Open For Business Project (OFBiz) Parameter Arrays Unspecified XSS
21041| [81346] Apache Open For Business Project (OFBiz) checkoutProcess.js getServerError() Function Unspecified XSS
21042| [81196] Apache Open For Business Project (OFBiz) FlexibleStringExpander Nested Script String Parsing Remote Code Execution
21043| [80981] Apache Hadoop Kerberos/MapReduce Security Feature User Impersonation Weakness
21044| [80571] Apache Traffic Server Host HTTP Header Parsing Remote Overflow
21045| [80547] Apache Struts XSLTResult.java File Upload Arbitrary Command Execution
21046| [80360] AskApache Password Protector Plugin for WordPress Error Page $_SERVER Superglobal XSS
21047| [80349] Apache HTTP Server mod_fcgid Module fcgid_spawn_ctl.c FcgidMaxProcessesPerClass Virtual Host Directive HTTP Request Parsing Remote DoS
21048| [80301] Apache Wicket /resources/ Absolute Path Arbitrary File Access
21049| [80300] Apache Wicket wicket:pageMapName Parameter XSS
21050| [79478] Apache Solr Extension for TYPO3 Unspecified XSS
21051| [79002] Apache MyFaces javax.faces.resource In Parameter Traversal Arbitrary File Access
21052| [78994] Apache Struts struts-examples/upload/upload-submit.do name Parameter XSS
21053| [78993] Apache Struts struts-cookbook/processDyna.do message Parameter XSS
21054| [78992] Apache Struts struts-cookbook/processSimple.do message Parameter XSS
21055| [78991] Apache Struts struts2-rest-showcase/orders clientName Parameter XSS
21056| [78990] Apache Struts struts2-showcase/person/editPerson.action Multiple Parameter XSS
21057| [78932] Apache APR Hash Collision Form Parameter Parsing Remote DoS
21058| [78903] Apache CXF SOAP Request Parsing WS-Security UsernameToken Policy Bypass
21059| [78600] Apache Tomcat HTTP DIGEST Authentication DigestAuthenticator.java Catalina Weakness Security Bypass
21060| [78599] Apache Tomcat HTTP DIGEST Authentication Realm Value Parsing Security Bypass
21061| [78598] Apache Tomcat HTTP DIGEST Authentication qop Value Parsing Security Bypass
21062| [78573] Apache Tomcat Parameter Saturation CPU Consumption Remote DoS
21063| [78556] Apache HTTP Server Status Code 400 Default Error Response httpOnly Cookie Disclosure
21064| [78555] Apache HTTP Server Threaded MPM %{cookiename}C Log Format String Cookie Handling Remote DoS
21065| [78501] Apache Struts ParameterInterceptor Class OGNL Expression Parsing Remote Command Execution
21066| [78331] Apache Tomcat Request Object Recycling Information Disclosure
21067| [78293] Apache HTTP Server Scoreboard Invalid Free Operation Local Security Bypass
21068| [78277] Apache Struts ExceptionDelegator Component Parameter Parsing Remote Code Execution
21069| [78276] Apache Struts DebuggingInterceptor Component Developer Mode Unspecified Remote Command Execution
21070| [78113] Apache Tomcat Hash Collision Form Parameter Parsing Remote DoS
21071| [78112] Apache Geronimo Hash Collision Form Parameter Parsing Remote DoS
21072| [78109] Apache Struts ParameterInterceptor Traversal Arbitrary File Overwrite
21073| [78108] Apache Struts CookieInterceptor Cookie Name Handling Remote Command Execution
21074| [77593] Apache Struts Conversion Error OGNL Expression Injection
21075| [77496] Apache ActiveMQ Failover Mechanism Openwire Request Parsing Remote DoS
21076| [77444] Apache HTTP Server mod_proxy Mdule Web Request HTTP/0.9 Protocol URL Parsing Proxy Remote Security Bypass
21077| [77374] Apache MyFaces Java Bean includeViewParameters Parsing EL Expression Security Weakness
21078| [77310] Apache HTTP Server mod_proxy Reverse Proxy Mode Security Bypass Weakness (2011-4317)
21079| [77234] Apache HTTP Server on cygwin Encoded Traversal Arbitrary File Access
21080| [77012] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Memory Consumption DoS
21081| [76944] Apache Tomcat Manager Application Servlets Access Restriction Bypass
21082| [76744] Apache HTTP Server server/utils.c ap_pregsub() Function htaccess File Handling Local Overflow
21083| [76189] Apache Tomcat HTTP DIGEST Authentication Weakness
21084| [76079] Apache HTTP Server mod_proxy Mdule Web Request URL Parsing Proxy Remote Security Bypass (2011-3368)
21085| [76072] Apache JServ jserv.conf jserv-status Handler jserv/ URI Request Parsing Local Information Disclosure
21086| [75807] Apache HTTP Server Incomplete Header Connection Saturation Remote DoS
21087| [75647] Apache HTTP Server mod_proxy_ajp Module mod_proxy_balancer HTTP Request Remote DoS
21088| [75376] Apache Libcloud SSL Certificate Validation MitM Server Spoofing Weakness
21089| [74853] Domain Technologie Control /etc/apache2/apache2.conf File Permissions Weakness dtcdaemons User Password Disclosure
21090| [74818] Apache Tomcat AJP Message Injection Authentication Bypass
21091| [74725] Apache Wicket Multi Window Support Unspecified XSS
21092| [74721] Apache HTTP Server ByteRange Filter Memory Exhaustion Remote DoS
21093| [74541] Apache Commons Daemon Jsvc Permissions Weakness Arbitrary File Access
21094| [74535] Apache Tomcat XML Parser Cross-application Multiple File Manipulation
21095| [74447] Apache Struts XWork Nonexistent Method s:submit Element Internal Java Class Remote Path Disclosure
21096| [74262] Apache HTTP Server Multi-Processing Module itk.c Configuration Merger mpm-itk root UID / GID Remote Privilege Escalation
21097| [74120] Apache HTTP Server mod_authnz_external mysql/mysql-auth.pl user Field SQL Injection
21098| [73920] Oracle Secure Backup /apache/htdocts/php/common.php username Parameter Remote Code Execution
21099| [73798] Apache Tomcat sendfile Request Start / Endpoint Parsing Local DoS
21100| [73797] Apache Tomcat sendfile Request Attribute Validation Weakness Local Access Restriction Bypass
21101| [73776] Apache Tomcat HTTP BIO Connector HTTP Pipelining Cross-user Remote Response Access
21102| [73644] Apache XML Security Signature Key Parsing Overflow DoS
21103| [73600] Apache Struts javatemplates Plugin Component Handlers .action URI Multiple Parameter XSS
21104| [73462] Apache Rampart/C util/rampart_timestamp_token.c rampart_timestamp_token_validate Function Expired Token Remote Access Restriction Bypass
21105| [73429] Apache Tomcat JMX MemoryUserDatabase Local Password Disclosure
21106| [73384] Apache HTTP Server mod_rewrite PCRE Resource Exhaustion DoS
21107| [73383] Apache HTTP Server Portable Runtime (APR) Library apr_fnmatch() Infinite Loop Remote DoS
21108| [73378] IBM WebSphere Application Server (WAS) JavaServer Pages org.apache.jasper.runtime.JspWriterImpl.response JSP Page Application Restart Remote DoS
21109| [73247] Apache Subversion mod_dav_svn File Permission Weakness Information Disclosure
21110| [73246] Apache Subversion mod_dav_svn Path-based Access Control Rule Handling Remote DoS
21111| [73245] Apache Subversion mod_dav_svn Baselined Resource Request Handling Remote DoS
21112| [73154] Apache Archiva Multiple Unspecified CSRF
21113| [73153] Apache Archiva /archiva/admin/deleteNetworkProxy!confirm.action proxyid Parameter XSS
21114| [72407] Apache Tomcat @ServletSecurity Initial Load Annotation Security Constraint Bypass Information Disclosure
21115| [72238] Apache Struts Action / Method Names <
21116| [71647] Apache HttpComponents HttpClient Proxy-Authorization Credentials Remote Disclosure
21117| [71558] Apache Tomcat SecurityManager ServletContext Attribute Traversal Arbitrary File Manipulation
21118| [71557] Apache Tomcat HTML Manager Multiple XSS
21119| [71075] Apache Archiva User Management Page XSS
21120| [71027] Apache Tomcat @ServletSecurity Annotation Security Constraint Bypass Information Disclosure
21121| [70925] Apache Continuum Project Pages Unspecified XSS (2011-0533)
21122| [70924] Apache Continuum Multiple Admin Function CSRF
21123| [70809] Apache Tomcat NIO HTTP Connector Request Line Processing DoS
21124| [70734] Apache CouchDB Request / Cookie Handling Unspecified XSS
21125| [70585] Oracle Fusion Middleware Oracle HTTP Server Apache Plugin Unspecified Remote Issue
21126| [70333] Apache Subversion rev_hunt.c blame Command Multiple Memory Leak Remote DoS
21127| [70332] Apache Subversion Apache HTTP Server mod_dav_svn repos.c walk FunctionSVNParentPath Collection Remote DoS
21128| [69659] Apache Archiva Admin Authentication Weakness Privilege Escalation
21129| [69520] Apache Archiva Administrator Credential Manipulation CSRF
21130| [69512] Apache Tomcat Set-Cookie Header HTTPOnly Flag Session Hijacking Weakness
21131| [69456] Apache Tomcat Manager manager/html/sessions Multiple Parameter XSS
21132| [69275] Apache mod_fcgid Module fcgid_bucket.c fcgid_header_bucket_read() Function Remote Overflow
21133| [69067] Apache Shiro URI Path Security Traversal Information Disclosure
21134| [68815] Apache MyFaces shared/util/StateUtils.java View State MAC Weakness Cryptographic Padding Remote View State Modification
21135| [68670] Apache Qpid C++ Broker Component broker/SessionAdapter.cpp SessionAdapter::ExchangeHandlerImpl::checkAlternate Function Exchange Alternate Remote DoS
21136| [68669] Apache Qpid cluster/Cluster.cpp Cluster::deliveredEvent Function Invalid AMQP Data Remote DoS
21137| [68662] Apache Axis2 dswsbobje.war Module Admin Account Default Password
21138| [68531] Apache Qpid qpidd sys/ssl/SslSocket.cpp Incomplete SSL Handshake Remote DoS
21139| [68327] Apache APR-util buckets/apr_brigade.c apr_brigade_split_line() Function Memory Consumption DoS
21140| [68314] Apache XML-RPC SAX Parser External Entity Information Disclosure
21141| [67964] Apache Traffic Server Transaction ID / Source Port Randomization Weakness DNS Cache Poisoning
21142| [67846] SUSE Lifecycle Management Server on SUSE Linux Enterprise apache2-slms Parameter Quoting CSRF
21143| [67294] Apache CXF XML SOAP Message Crafted Document Type Declaration Remote DoS
21144| [67240] Apache CouchDB Installation Page Direct Request Arbitrary JavaScript Code Execution CSRF
21145| [67205] Apache Derby BUILTIN Authentication Password Hash Generation Algorithm SHA-1 Transformation Password Substitution
21146| [66745] Apache HTTP Server Multiple Modules Pathless Request Remote DoS
21147| [66319] Apache Tomcat Crafted Transfer-Encoding Header Handling Buffer Recycling Remote DoS
21148| [66280] Apache Struts XWork ParameterInterceptor Server-Side Object Remote Code Execution
21149| [66226] Apache Axis2 Admin Interface Cookie Session Fixation
21150| [65697] Apache Axis2 / Java SOAP Message DTD Rejection Weakness Arbitrary File Access
21151| [65654] Apache HTTP Server mod_proxy_http mod_proxy_http.c Timeout Detection Weakness HTTP Request Response Disclosure
21152| [65429] Apache MyFaces Unencrypted ViewState Serialized View Object Manipulation Arbitrary Expression Language (EL) Statement Execution
21153| [65054] Apache ActiveMQ Jetty Error Handler XSS
21154| [64844] Apache Axis2/Java axis2/axis2-admin/engagingglobally modules Parameter XSS
21155| [64522] Apache Open For Business Project (OFBiz) ecommerce/control/contactus Multiple Parameter XSS
21156| [64521] Apache Open For Business Project (OFBiz) Web Tools Section entityName Parameter XSS
21157| [64520] Apache Open For Business Project (OFBiz) ecommerce/control/ViewBlogArticle contentId Parameter XSS
21158| [64519] Apache Open For Business Project (OFBiz) Control Servlet URI XSS
21159| [64518] Apache Open For Business Project (OFBiz) Show Portal Page Section start Parameter XSS
21160| [64517] Apache Open For Business Project (OFBiz) View Profile Section partyId Parameter XSS
21161| [64516] Apache Open For Business Project (OFBiz) Export Product Listing Section productStoreId Parameter XSS
21162| [64307] Apache Tomcat Web Application Manager/Host Manager CSRF
21163| [64056] mod_auth_shadow for Apache HTTP Server wait() Function Authentication Bypass
21164| [64023] Apache Tomcat WWW-Authenticate Header Local Host Information Disclosure
21165| [64020] Apache ActiveMQ Jetty ResourceHandler Crafted Request JSP File Source Disclosure
21166| [63895] Apache HTTP Server mod_headers Unspecified Issue
21167| [63368] Apache ActiveMQ createDestination.action JMSDestination Parameter CSRF
21168| [63367] Apache ActiveMQ createDestination.action JMSDestination Parameter XSS
21169| [63350] Apache CouchDB Hash Verification Algorithm Predictable Execution Time Weakness
21170| [63140] Apache Thrift Service Malformed Data Remote DoS
21171| [62676] Apache HTTP Server mod_proxy_ajp Module Crafted Request Remote DoS
21172| [62675] Apache HTTP Server Multi-Processing Module (MPM) Subrequest Header Handling Cross-thread Information Disclosure
21173| [62674] Apache HTTP Server mod_isapi Module Unloading Crafted Request Remote DoS
21174| [62231] Apache HTTP Server Logging Format Weakness Crafted DNS Response IP Address Spoofing
21175| [62230] Apache HTTP Server Crafted DNS Response Inverse Lookup Log Corruption XSS
21176| [62054] Apache Tomcat WAR Filename Traversal Work-directory File Deletion
21177| [62053] Apache Tomcat Autodeployment Process appBase File HTTP Request Authentication Bypass
21178| [62052] Apache Tomcat WAR File Traversal Arbitrary File Overwrite
21179| [62009] Apache HTTP Server src/modules/proxy/proxy_util.c mod_proxy ap_proxy_send_fb() Function Overflow
21180| [61379] Apache River Outrigger Entry Storage Saturation Memory Exhaustion DoS
21181| [61378] Apache Hadoop Map/Reduce JobTracker Memory Consumption DoS
21182| [61377] Apache Commons Modeler Multiple Mutable Static Fields Weakness
21183| [61376] Apache Rampart wsse:security Tag Signature Value Checking Weakness
21184| [60687] Apache C++ Standard Library (STDCXX) strxfrm() Function Overflow
21185| [60680] Apache Hadoop JobHistory Job Name Manipulation Weakness
21186| [60679] Apache ODE DeploymentWebService OMElement zipPart CRLF Injection
21187| [60678] Apache Roller Comment Email Notification Manipulation DoS
21188| [60677] Apache CouchDB Unspecified Document Handling Remote DoS
21189| [60428] Sun Java Plug-in org.apache.crimson.tree.XmlDocument Class reateXmlDocument Method Floppy Drive Access Bypass
21190| [60413] mod_throttle for Apache Shared Memory File Manipulation Local Privilege Escalation
21191| [60412] Sun Java Plug-in org.apache.xalan.processor.XSLProcessorVersion Class Unsigned Applet Variable Sharing Privilege Escalation
21192| [60396] Apache HTTP Server on OpenBSD Multipart MIME Boundary Remote Information Disclosure
21193| [60395] Apache HTTP Server on OpenBSD ETag HTTP Header Remote Information Disclosure
21194| [60232] PHP on Apache php.exe Direct Request Remote DoS
21195| [60176] Apache Tomcat Windows Installer Admin Default Password
21196| [60016] Apache HTTP Server on HP Secure OS for Linux HTTP Request Handling Unspecified Issue
21197| [59979] Apache HTTP Server on Apple Mac OS X HTTP TRACE Method Unspecified Client XSS
21198| [59969] Apache HTTP Server mod_ssl SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection
21199| [59944] Apache Hadoop jobhistory.jsp XSS
21200| [59374] Apache Solr Search Extension for TYPO3 Unspecified XSS
21201| [59022] Apache Shindig ConcatProxyServlet HTTP Header Response Splitting
21202| [59021] Apache Cocoon X-Cocoon-Version Header Remote Information Disclosure
21203| [59020] Apache Tapestry HTTPS Session Cookie Secure Flag Weakness
21204| [59019] Apache mod_python Cookie Salting Weakness
21205| [59018] Apache Harmony Error Message Handling Overflow
21206| [59013] Apache Derby SYSCS_EXPORT_TABLE Arbitrary File Overwrite
21207| [59012] Apache Derby Driver Auto-loading Non-deterministic Startup Weakness
21208| [59011] Apache JSPWiki Page Attachment Change Note Function XSS
21209| [59010] Apache Solr get-file.jsp XSS
21210| [59009] Apache Solr action.jsp XSS
21211| [59008] Apache Solr analysis.jsp XSS
21212| [59007] Apache Solr schema.jsp Multiple Parameter XSS
21213| [59006] Apache Beehive select / checkbox Tag XSS
21214| [59005] Apache Beehive jpfScopeID Global Parameter XSS
21215| [59004] Apache Beehive Error Message XSS
21216| [59003] Apache HttpClient POST Request Handling Memory Consumption DoS
21217| [59002] Apache Jetspeed default-page.psml URI XSS
21218| [59001] Apache Axis2 xsd Parameter Traversal Arbitrary File Disclosure
21219| [59000] Apache CXF Unsigned Message Policy Bypass
21220| [58999] Apache WSS4J CallbackHandler Plaintext Password Validation Weakness
21221| [58998] Apache OpenJPA persistence.xml Cleartext Password Local Disclosure
21222| [58997] Apache OpenEJB openejb.xml Cleartext Password Local Disclosure
21223| [58996] Apache Hadoop Map/Reduce LinuxTaskController File Group Ownership Weakness
21224| [58995] Apache Hadoop Map/Reduce Task Ownership Weakness
21225| [58994] Apache Hadoop Map/Reduce DistributedCache Localized File Permission Weakness
21226| [58993] Apache Hadoop browseBlock.jsp XSS
21227| [58991] Apache Hadoop browseDirectory.jsp XSS
21228| [58990] Apache Hadoop Map/Reduce HTTP TaskTrackers User Data Remote Disclosure
21229| [58989] Apache Hadoop Sqoop Process Listing Local Cleartext Password Disclosure
21230| [58988] Apache Hadoop Chukwa HICC Portal Unspecified XSS
21231| [58987] Apache Hadoop Map/Reduce TaskTracker User File Permission Weakness
21232| [58986] Apache Qpid Encrypted Message Handling Remote Overflow DoS
21233| [58985] Apache Qpid Process Listing Local Cleartext Password Disclosure
21234| [58984] Apache Jackrabbit Content Repository (JCR) Default Account Privilege Access Weakness
21235| [58983] Apache Jackrabbit Content Repository (JCR) NamespaceRegistry API Registration Method Race Condition
21236| [58982] Apache Synapse Proxy Service Security Policy Mismatch Weakness
21237| [58981] Apache Geronimo TomcatGeronimoRealm Security Context Persistence Weakness
21238| [58980] Apache Geronimo LDAP Realm Configuration Restart Reversion Weakness
21239| [58979] Apache MyFaces Tomahawk ExtensionsPhaseListener HTML Injection Information Disclosure
21240| [58978] Apache MyFaces Trinidad LocaleInfoScriptlet XSS
21241| [58977] Apache Open For Business Project (OFBiz) Multiple Default Accounts
21242| [58976] Apache Open For Business Project (OFBiz) URI passThru Parameter XSS
21243| [58975] Apache Open For Business Project (OFBiz) PARTYMGR_CREATE/UPDATE Permission Arbitrary User Password Modification
21244| [58974] Apache Sling /apps Script User Session Management Access Weakness
21245| [58973] Apache Tuscany Crafted SOAP Request Access Restriction Bypass
21246| [58931] Apache Geronimo Cookie Parameters Validation Weakness
21247| [58930] Apache Xalan-C++ XPath Handling Remote DoS
21248| [58879] Apache Portable Runtime (APR-util) poll/unix/port.c Event Port Backend Pollset Feature Remote DoS
21249| [58837] Apache Commons Net FTPSClient CipherSuites / Protocols Mutable Object Unspecified Data Security Issue
21250| [58813] Apache MyFaces Trinidad tr:table / HTML Comment Handling DoS
21251| [58812] Apache Open For Business Project (OFBiz) JSESSIONID Session Hijacking Weakness
21252| [58811] Apache Open For Business Project (OFBiz) /catalog/control/EditProductConfigItem configItemId Parameter XSS
21253| [58810] Apache Open For Business Project (OFBiz) /catalog/control/EditProdCatalo prodCatalogId Parameter XSS
21254| [58809] Apache Open For Business Project (OFBiz) /partymgr/control/viewprofile partyId Parameter XSS
21255| [58808] Apache Open For Business Project (OFBiz) /catalog/control/createProduct internalName Parameter XSS
21256| [58807] Apache Open For Business Project (OFBiz) Multiple Unspecified CSRF
21257| [58806] Apache FtpServer MINA Logging Filter Cleartext Credential Local Disclosure
21258| [58805] Apache Derby Unauthenticated Database / Admin Access
21259| [58804] Apache Wicket Header Contribution Unspecified Issue
21260| [58803] Apache Wicket Session Fixation
21261| [58802] Apache Directory Server (ApacheDS) userPassword Attribute Search Password Disclosure
21262| [58801] Apache ActiveMQ Stomp Client Credential Validation Bypass
21263| [58800] Apache Tapestry (context)/servicestatus Internal Service Information Disclosure
21264| [58799] Apache Tapestry Logging Cleartext Password Disclosure
21265| [58798] Apache Jetspeed pipeline Parameter pipeline-map Policy Bypass
21266| [58797] Apache Jetspeed Password Policy Multiple Weaknesses
21267| [58796] Apache Jetspeed Unsalted Password Storage Weakness
21268| [58795] Apache Rampart Crafted SOAP Header Authentication Bypass
21269| [58794] Apache Roller Admin Protocol (RAP) Malformed Header Authentication Bypass
21270| [58793] Apache Hadoop Map/Reduce mapred.system.dir Permission Weakness Job Manipulation
21271| [58792] Apache Shindig gadgets.rpc iframe RPC Call Validation Weakness
21272| [58791] Apache Synapse synapse.properties Cleartext Credential Local Disclosure
21273| [58790] Apache WSS4J SOAP Message UsernameToken Remote Password Disclosure
21274| [58789] Apache WSS4J SOAP Header Malformed UsernameToken Authentication Bypass
21275| [58776] Apache JSPWiki PreviewContent.jsp Edited Text XSS
21276| [58775] Apache JSPWiki preview.jsp action Parameter XSS
21277| [58774] Apache JSPWiki Edit.jsp Multiple Parameter XSS
21278| [58773] Apache JSPWiki Accept-Language Header Multiple Script language Parameter XSS
21279| [58772] Apache JSPWiki EditorManager.java editor Parameter XSS
21280| [58771] Apache JSPWiki GroupContent.jsp Multiple Parameter XSS
21281| [58770] Apache JSPWiki Group.jsp group Parameter XSS
21282| [58769] Apache JSPWiki Database Connection Termination DoS Weakness
21283| [58768] Apache JSPWiki Attachment Servlet nextpage Parameter Arbitrary Site Redirect
21284| [58766] Apache JSPWiki /admin/SecurityConfig.jsp Direct Request Information Disclosure
21285| [58765] Apache JSPWiki Spam Filter UniqueID RNG Weakness
21286| [58764] Apache JSPWiki Edit.jsp Multiple Parameter XSS
21287| [58763] Apache JSPWiki Include Tag Multiple Script XSS
21288| [58762] Apache JSPWiki Multiple .java Tags pageContext Parameter XSS
21289| [58761] Apache JSPWiki Wiki.jsp skin Parameter XSS
21290| [58760] Apache Commons VFS Exception Error Message Cleartext Credential Disclosure
21291| [58759] Apache Jackrabbit Content Repository (JCR) UUID System.currentTimeMillis() RNG Weakness
21292| [58758] Apache River GrantPermission Policy Manipulation Privilege Escalation
21293| [58757] Apache WS-Commons Java2 StaXUtils Multiple Unspecified Minor Issues
21294| [58756] Apache WSS4J WSHandler Client Certificate Signature Validation Weakness
21295| [58755] Apache Harmony DRLVM Non-public Class Member Access
21296| [58754] Apache Harmony File.createTempFile() Temporary File Creation Prediction Weakness
21297| [58751] Apache Geronimo GeronimoIdentityResolver Subject Handling Multiple Issues
21298| [58750] Apache MyFaces Trinidad Generated HTML Information Disclosure
21299| [58749] Apache MyFaces Trinidad Database Access Error Message Information Disclosure
21300| [58748] Apache MyFaces Trinidad Image Resource Loader Traversal Arbitrary Image Access
21301| [58747] Apache MyFaces Trinidad Error Message User Entered Data Disclosure Weakness
21302| [58746] Apache Axis2 JAX-WS Java2 WSDL4J Unspecified Issue
21303| [58744] Apache Wicket Crafted File Upload Disk Space Exhaustion DoS
21304| [58743] Apache Wicket wicket.util.crypt.SunJceCrypt Encryption Reversion Weakness
21305| [58742] Apache Rampart PolicyBasedValiadtor HttpsToken Endpoint Connection Weakness
21306| [58741] Apache Rampart WSSecSignature / WSSecEncryptedKey KeyIdentifierType Validation Weakness
21307| [58740] Apache Rampart TransportBinding Message Payload Cleartext Disclosure
21308| [58739] Apache Open For Business Project (OFBiz) Unsalted Password Storage Weakness
21309| [58738] Apache Open For Business Project (OFBiz) orderId Parameter Arbitrary Order Access
21310| [58737] Apache mod_python w/ mod_python.publisher index.py Underscore Prefixed Variable Disclosure
21311| [58735] Apache Open For Business Project (OFBiz) /ecommerce/control/keywordsearch SEARCH_STRING Parameter XSS
21312| [58734] Apache Torque Log File Cleartext Credential Local Disclosure
21313| [58733] Apache Axis2 doGet Implementation Authentication Bypass Service State Manipulation
21314| [58732] Apache MyFaces UIInput.validate() Null Value Validation Bypass Weakness
21315| [58731] Apache MyFaces /faces/* Prefix Mapping Authentication Bypass
21316| [58725] Apache Tapestry Basic String ACL Bypass Weakness
21317| [58724] Apache Roller Logout Functionality Failure Session Persistence
21318| [58723] Apache Roller User Profile / Admin Page Cleartext Password Disclosure
21319| [58722] Apache Derby Connection URL Encryption Method Reversion Weakness
21320| [58721] Apache Geronimo on Tomcat Security-constraint Resource ACL Bypass
21321| [58720] Apache Geronimo Explicit Servlet Mapping Access Bypass Weakness
21322| [58719] Apache Geronimo Keystore Unprivileged Service Disable DoS
21323| [58718] Apache Geronimo Deployment Plans Remote Password Disclosure
21324| [58717] Apache Jetspeed Portlet Application Edit Access Restriction Bypass
21325| [58716] Apache Jetspeed PSML Management Cached Constraint Authentication Weakness
21326| [58707] Apache WSS4J Crafted PasswordDigest Request Authentication Bypass
21327| [58706] Apache HttpClient Pre-emptive Authorization Remote Credential Disclosure
21328| [58705] Apache Directory Server (ApacheDS) User Passwords Cleartext Disclosure
21329| [58704] Apache Directory Server (ApacheDS) Non-existent User LDAP Bind Remote DoS
21330| [58703] Apache Geronimo Debug Console Unauthenticated Remote Information Disclosure
21331| [58702] Apache Directory Server (ApacheDS) Persistent LDAP Anonymous Bind Weakness
21332| [58701] Apache Jetspeed User Admin Portlet Unpassworded Account Creation Weakness
21333| [58700] Apache MyFaces /faces/* Path Handling Remote Overflow DoS
21334| [58699] Apache MyFaces Disable Property Client Side Manipulation Privilege Escalation
21335| [58698] Apache Roller Remember Me Functionality Cleartext Password Disclosure
21336| [58697] Apache XalanJ2 org.apache.xalan.xsltc.runtime.CallFunction Class Unspecified Issue
21337| [58696] Apache Tapestry Encoded Traversal Arbitrary File Access
21338| [58695] Apache Jetspeed Unauthenticated PSML Tags / Admin Folder Access
21339| [58694] Apache Geronimo Deploy Tool Process List Local Credential Disclosure
21340| [58693] Apache Derby service.properties File Encryption Key Information Disclosure
21341| [58692] Apache Geronimo Default Security Realm Login Brute Force Weakness
21342| [58689] Apache Roller Retrieve Last 5 Post Feature Unauthorized Blog Post Manipulation
21343| [58688] Apache Xalan-Java (XalanJ2) Static Variables Multiple Unspecified Issues
21344| [58687] Apache Axis Invalid wsdl Request XSS
21345| [58686] Apache Cocoon Temporary File Creation Unspecified Race Condition
21346| [58685] Apache Velocity Template Designer Privileged Code Execution
21347| [58684] Apache Jetspeed controls.Customize Action Security Check Bypass
21348| [58675] Apache Open For Business Project (OFBiz) eCommerce/ordermgr Multiple Field XSS
21349| [58674] Apache Open For Business Project (OFBiz) ecommerce/control/login Multiple Field XSS
21350| [58673] Apache Open For Business Project (OFBiz) ecommerce/control/viewprofile Multiple Field XSS
21351| [58672] Apache Open For Business Project (OFBiz) POS Input Panel Cleartext Password Disclosure
21352| [58671] Apache Axis2 JMS Signed Message Crafted WS-Security Header Security Bypass
21353| [58670] Apache Jetspeed JetspeedTool.getPortletFromRegistry Portlet Security Validation Failure
21354| [58669] Apache Jetspeed LDAP Cleartext Passwords Disclosure
21355| [58668] Apache Axis External Entity (XXE) Data Parsing Privilege Escalation
21356| [58667] Apache Roller Database Cleartext Passwords Disclosure
21357| [58666] Apache Xerces-C++ UTF-8 Transcoder Overlong Code Handling Unspecified Issue
21358| [58665] Apache Jetspeed Turbine: Cross-user Privileged Action Execution
21359| [58664] Apache Jetspeed EditAccount.vm Password Modification Weakness
21360| [58663] Apache Jetspeed Role Parameter Arbitrary Portlet Disclosure
21361| [58662] Apache Axis JWS Page Generated .class File Direct Request Information Disclosure
21362| [58661] Apache Jetspeed user-form.vm Password Reset Cleartext Disclosure
21363| [58660] Apache WSS4J checkReceiverResults Function Crafted SOAP Request Authentication Bypass
21364| [58658] Apache Rampart Crafted SOAP Request Security Verification Bypass
21365| [57882] Apache HTTP Server mod_proxy_ftp Authorization HTTP Header Arbitrary FTP Command Injection
21366| [57851] Apache HTTP Server mod_proxy_ftp EPSV Command NULL Dereference Remote DoS
21367| [56984] Apache Xerces2 Java Malformed XML Input DoS
21368| [56903] Apache ODE (Orchestration Director Engine) Process Deployment Web Service Traversal Arbitrary File Manipulation
21369| [56859] Apache Xerces-C++ Multiple Sub-project XML Nested DTD Structures Parsing Recursion Error DoS
21370| [56766] Apache Portable Runtime (APR-util) memory/unix/apr_pools.c Relocatable Memory Block Aligning Overflow
21371| [56765] Apache Portable Runtime (APR-util) misc/apr_rmm.c Multiple Function Overflows
21372| [56517] Apache HTTP Server File Descriptor Leak Arbitrary Local File Append
21373| [56443] PTK Unspecified Apache Sub-process Arbitrary Command Execution
21374| [56414] Apache Tiles Duplicate Expression Language (EL) Expression Evaluation XSS
21375| [55814] mod_NTLM for Apache HTTP Server ap_log_rerror() Function Remote Format String
21376| [55813] mod_NTLM for Apache HTTP Server log() Function Remote Overflow
21377| [55782] Apache HTTP Server mod_deflate Module Aborted Connection DoS
21378| [55553] Apache HTTP Server mod_proxy Module mod_proxy_http.c stream_reqbody_cl Function CPU Consumption DoS
21379| [55059] Apache APR-util strmatch/apr_strmatch.c apr_strmatch_precompile Function Crafted Input Remote DoS
21380| [55058] Apache APR-util apr_brigade_vprintf Function Crafted Input Off-by-one Remote DoS
21381| [55057] Apache APR-util xml/apr_xml.c apr_xml_* Interface Expat XML Parser Crafted XML Document Remote DoS
21382| [55056] Apache Tomcat Cross-application TLD File Manipulation
21383| [55055] Apache Tomcat Illegal URL Encoded Password Request Username Enumeration
21384| [55054] Apache Tomcat Java AJP Connector mod_jk Load Balancing Worker Malformed Header Remote DoS
21385| [55053] Apache Tomcat Crafted Request Security Restraint Bypass Arbitrary Content Access
21386| [54733] Apache HTTP Server AllowOverride Directive .htaccess Options Bypass
21387| [54713] razorCMS Security Manager apache User Account Unspecified File Permission Weakness Issue
21388| [54589] Apache Jserv Nonexistent JSP Request XSS
21389| [54122] Apache Struts s:a / s:url Tag href Element XSS
21390| [54093] Apache ActiveMQ Web Console JMS Message XSS
21391| [53932] Apache Geronimo Multiple Admin Function CSRF
21392| [53931] Apache Geronimo /console/portal/Server/Monitoring Multiple Parameter XSS
21393| [53930] Apache Geronimo /console/portal/ URI XSS
21394| [53929] Apache Geronimo on Windows Security/Keystores Portlet Traversal Arbitrary File Upload
21395| [53928] Apache Geronimo on Windows Embedded DB/DB Manager Portlet Traversal Arbitrary File Upload
21396| [53927] Apache Geronimo on Windows Services/Repository Portlet Traversal Arbitrary File Upload
21397| [53921] Apache HTTP Server mod_proxy_ajp Cross Thread/Session Information Disclosure
21398| [53766] Oracle BEA WebLogic Server Plug-ins for Apache Certificate Handling Remote Overflow
21399| [53574] PHP on Apache .htaccess mbstring.func_overload Setting Cross Hosted Site Behavior Modification
21400| [53381] Apache Tomcat JK Connector Content-Length Header Cross-user Information Disclosure
21401| [53380] Apache Struts Unspecified XSS
21402| [53289] Apache mod_perl Apache::Status /perl-status Unspecified XSS
21403| [53186] Apache HTTP Server htpasswd Predictable Salt Weakness
21404| [52899] Apache Tomcat Examples Web Application Calendar Application jsp/cal/cal2.jsp time Parameter XSS
21405| [52407] Apache Tomcat doRead Method POST Content Information Disclosure
21406| [51923] Apache HTTP Server mod-auth-mysql Module mod_auth_mysql.c Multibyte Character Encoding SQL Injection
21407| [51613] Apache HTTP Server Third-party Module Child Process File Descriptor Leak
21408| [51612] Apache HTTP Server Internal Redirect Handling Infinite Loop DoS
21409| [51468] Apache Jackrabbit Content Repository (JCR) swr.jsp q Parameter XSS
21410| [51467] Apache Jackrabbit Content Repository (JCR) search.jsp q Parameter XSS
21411| [51151] Apache Roller Search Function q Parameter XSS
21412| [50482] PHP with Apache php_value Order Unspecified Issue
21413| [50475] Novell NetWare ApacheAdmin Console Unauthenticated Access
21414| [49734] Apache Struts DefaultStaticContentLoader Class Traversal Arbitrary File Access
21415| [49733] Apache Struts FilterDispatcher Class Traversal Arbitrary File Access
21416| [49283] Oracle BEA WebLogic Server Plugins for Apache Remote Transfer-Encoding Overflow
21417| [49062] Apache Tomcat Cross-thread Concurrent Request Variable Overwrite Information Disclosure
21418| [48847] ModSecurity (mod_security) Transformation Caching Unspecified Apache DoS
21419| [48788] Apache Xerces-C++ XML Schema maxOccurs Value XML File Handling DoS
21420| [47474] Apache HTTP Server mod_proxy_ftp Directory Component Wildcard Character XSS
21421| [47464] Apache Tomcat allowLinking / UTF-8 Traversal Arbitrary File Access
21422| [47463] Apache Tomcat RequestDispatcher Traversal Arbitrary File Access
21423| [47462] Apache Tomcat HttpServletResponse.sendError Method Message Argument XSS
21424| [47096] Oracle Weblogic Apache Connector POST Request Overflow
21425| [46382] Frontend Filemanager (air_filemanager) Extension for TYPO3 on Apache Unspecified Arbitrary Code Execution
21426| [46285] TYPO3 on Apache Crafted Filename Upload Arbitrary Command Execution
21427| [46085] Apache HTTP Server mod_proxy ap_proxy_http_process_response() Function Interim Response Forwarding Remote DoS
21428| [45905] Apache Tomcat Host Manager host-manager/html/add name Parameter XSS
21429| [45879] Ragnarok Online Control Panel on Apache Crafted Traversal Authentication Bypass
21430| [45742] Apache HTTP Server on Novell Unspecified Request Directive Internal IP Disclosure
21431| [45740] Apache Derby DropSchemaNode Bind Phase Arbitrary Scheme Statement Dropping
21432| [45599] Apache Derby Lock Table Statement Privilege Requirement Bypass Arbitrary Table Lock
21433| [45585] Apache Derby ACCSEC Command RDBNAM Parameter Cleartext Credential Disclosure
21434| [45584] Apache Derby DatabaseMetaData.getURL Function Cleartext Credential Disclosure
21435| [45420] Apache HTTP Server 403 Error Page UTF-7 Encoded XSS
21436| [44728] PHP Toolkit on Gentoo Linux Interpretation Conflict Apache HTTP Server Local DoS
21437| [44618] Oracle JSP Apache/Jserv Path Translation Traversal Arbitrary JSP File Execution
21438| [44159] Apache HTTP Server Remote Virtual Host Name Disclosure
21439| [43997] Apache-SSL ExpandCert() Function Certificate Handling Arbitrary Environment Variables Manipulation
21440| [43994] suPHP for Apache (mod_suphp) Directory Symlink Local Privilege Escalation
21441| [43993] suPHP for Apache (mod_suphp) Owner Mode Race Condition Symlink Local Privilege Escalation
21442| [43663] Apache HTTP Server Mixed Platform AddType Directive Crafted Request PHP Source Disclosure
21443| [43658] AuthCAS Module (AuthCAS.pm) for Apache HTTP Server SESSION_COOKIE_NAME SQL Injection
21444| [43452] Apache Tomcat HTTP Request Smuggling
21445| [43309] Apache Geronimo LoginModule Login Method Bypass
21446| [43290] Apache JSPWiki Entry Page Attachment Unrestricted File Upload
21447| [43259] Apache HTTP Server on Windows mod_proxy_balancer URL Handling Remote Memory Corruption
21448| [43224] Apache Geronimo on SuSE Linux init Script Symlink Unspecified File/Directory Access
21449| [43189] Apache mod_jk2 Host Header Multiple Fields Remote Overflow
21450| [42937] Apache HTTP Server mod_proxy_balancer balancer-manager Unspecified CSRF
21451| [42341] MOD_PLSQL for Apache Unspecified URL SQL Injection
21452| [42340] MOD_PLSQL for Apache CGI Environment Handling Unspecified Overflow
21453| [42214] Apache HTTP Server mod_proxy_ftp UTF-7 Encoded XSS
21454| [42091] Apache Maven Site Plugin Installation Permission Weakness
21455| [42089] Apache Maven .m2/settings.xml Cleartext Password Disclosure
21456| [42088] Apache Maven Defined Repo Process Listing Password Disclosure
21457| [42087] Apache Maven Site Plugin SSH Deployment Permission Setting Weakness
21458| [42036] Apache HTTP Server MS-DOS Device Request Host OS Disclosure
21459| [41891] BEA WebLogic Apache Beehive NetUI Page Flow Unspecified XSS
21460| [41436] Apache Tomcat Native APR Connector Duplicate Request Issue
21461| [41435] Apache Tomcat %5C Cookie Handling Session ID Disclosure
21462| [41434] Apache Tomcat Exception Handling Subsequent Request Information Disclosure
21463| [41400] LimeSurvey save.php Apache Log File PHP Code Injection
21464| [41029] Apache Tomcat Calendar Examples Application cal2.jsp Multiple Parameter CSRF
21465| [41019] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload XSS
21466| [41018] Apache HTTP Server mod_negotiation Module Multi-Line Filename Upload CRLF
21467| [40853] Apache Tomcat SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) JSESSIONIDSSO Cookie Security Weakness
21468| [40264] Apache HTTP Server mod_proxy_balancer balancer_handler Function bb Variable Remote DoS
21469| [40263] Apache HTTP Server mod_proxy_balancer balancer-manager Multiple Parameter XSS
21470| [40262] Apache HTTP Server mod_status refresh XSS
21471| [39833] Apache Tomcat JULI Logging Component catalina.policy Security Bypass
21472| [39251] Coppermine Photo Gallery on Apache Multiple File Extension Upload Arbitrary Code Execution
21473| [39166] Apache Tomcat on Windows caseSensitive Attribute Mixed Case Request JSP Source Disclosure
21474| [39134] Apache mod_imagemap Module Imagemap Unspecified XSS
21475| [39133] Apache mod_imap Module Imagemap File Unspecified XSS
21476| [39035] Apache Tomcat examples/servlet/CookieExample Multiple Parameter XSS
21477| [39003] Apache HTTP Server HTTP Method Header Request Entity Too Large XSS
21478| [39000] Apache Tomcat SendMailServlet sendmail.jsp mailfrom Parameter XSS
21479| [38939] Apache HTTP Server Prefork MPM Module Array Modification Local DoS
21480| [38673] Apache Jakarta Slide WebDAV SYSTEM Request Traversal Arbitrary File Access
21481| [38662] Apache Geronimo SQLLoginModule Nonexistent User Authentication Bypass
21482| [38661] Apache Geronimo MEJB Unspecified Authentication Bypass
21483| [38641] Apache HTTP Server mod_mem_cache recall_headers Function Information Disclosure
21484| [38640] Apache HTTP Server suexec Document Root Unauthorized Operations
21485| [38639] Apache HTTP Server suexec Multiple Symlink Privilege Escalation
21486| [38636] Apache HTTP Server mod_autoindex.c P Variable UTF-7 Charset XSS
21487| [38513] BEA WebLogic Server Proxy Plug-in for Apache Protocol Error Handling Remote DoS
21488| [38187] Apache Geronimo / Tomcat WebDAV XML SYSTEM Tag Arbitrary File Access
21489| [37079] Apache HTTP Server mod_cache cache_util.c Malformed Cache-Control Header DoS
21490| [37071] Apache Tomcat Cookie Handling Session ID Disclosure
21491| [37070] Apache Tomcat Cookie Handling Quote Delimiter Session ID Disclosure
21492| [37052] Apache HTTP Server mod_status mod_status.c Unspecified XSS
21493| [37051] Apache HTTP Server mod_proxy modules/proxy/proxy_util.c Crafted Header Remote DoS
21494| [37050] Apache HTTP Server Prefork MPM Module Crafted Code Sequence Local DoS
21495| [36417] Apache Tomcat Host Manager Servlet html/add Action aliases Parameter XSS
21496| [36377] Apache MyFaces Tomahawk JSF Application autoscroll Multiple Script XSS
21497| [36080] Apache Tomcat JSP Examples Crafted URI XSS
21498| [36079] Apache Tomcat Manager Uploaded Filename XSS
21499| [34888] Apache Tomcat Example Calendar Application cal2.jsp time Parameter XSS
21500| [34887] Apache Tomcat implicit-objects.jsp Crafted Header XSS
21501| [34885] Apache Tomcat on IIS Servlet Engine MS-DOS Device Request DoS
21502| [34884] Apache Tomcat on Windows Nonexistent Resource Request Path Disclosure
21503| [34883] Apache Tomcat Crafted JSP File Request Path Disclosure
21504| [34882] Apache Tomcat Default SSL Ciphersuite Configuration Weakness
21505| [34881] Apache Tomcat Malformed Accept-Language Header XSS
21506| [34880] Apache Tomcat HTTP/1.1 Connector NULL Byte Request JSP Source Disclosure
21507| [34879] Apache Tomcat examples/jsp2/jspx/textRotate.jspx XSS
21508| [34878] Apache Tomcat examples/jsp2/el/implicit-objects.jsp XSS
21509| [34877] Apache Tomcat JK Web Server Connector (mod_jk) Double Encoded Traversal Arbitrary File Access
21510| [34876] Apache HTTP Server ScriptAlias CGI Source Disclosure
21511| [34875] Apache Tomcat appdev/sample/web/hello.jsp Multiple Parameter XSS
21512| [34874] Apache Tomcat AJP Connector mod_jk ajp_process_callback Remote Memory Disclosure
21513| [34873] Apache Stats Variable Extraction _REQUEST Ssuperglobal Array Overwrite
21514| [34872] Apache HTTP Server suexec User/Group Combination Weakness Local Privilege Escalation
21515| [34769] Apache Tomcat w/ Proxy Module Double Encoded Traversal Arbitrary File Access
21516| [34541] mod_perl for Apache HTTP Server RegistryCooker.pm PATH_INFO Crafted URI Remote DoS
21517| [34540] mod_perl for Apache HTTP Server PerlRun.pm PATH_INFO Crafted URI Remote DoS
21518| [34398] Apache Tomcat mod_jk Invalid Chunked Encoded Body Information Disclosure
21519| [34154] Apache Axis Nonexistent Java Web Service Path Disclosure
21520| [33855] Apache Tomcat JK Web Server Connector mod_jk.so Long URI Worker Map Remote Overflow
21521| [33816] Apache HTTP Server on Debian Linux TTY Local Privilege Escalation
21522| [33456] Apache HTTP Server Crafted TCP Connection Range Header DoS
21523| [33346] Avaya Multiple Products Apache Tomcat Port Weakness
21524| [32979] Apache Java Mail Enterprise Server (JAMES) Phoenix/MX4J Interface Arbitrary User Creation
21525| [32978] Apache Java Mail Enterprise Server (JAMES) POP3Server Log File Plaintext Password Disclosure
21526| [32724] Apache mod_python _filter_read Freed Memory Disclosure
21527| [32723] Apache Tomcat semicolon Crafted Filename Request Forced Directory Listing
21528| [32396] Apache Open For Business Project (OFBiz) Ecommerce Component Forum Implementation Message Body XSS
21529| [32395] Apache Open For Business Project (OFBiz) Ecommerce Component Form Field Manipulation Privilege Escalation
21530| [30354] Linux Subversion libapache2-svn Search Path Subversion Local Privilege Escalation
21531| [29603] PHP ini_restore() Apache httpd.conf Options Bypass
21532| [29536] Apache Tcl mod_tcl set_var Function Remote Format String
21533| [28919] Apache Roller Weblogger Blog Comment Multiple Field XSS
21534| [28130] PHP with Apache Mixed Case Method Limit Directive Bypass
21535| [27913] Apache HTTP Server on Windows mod_alias URL Validation Canonicalization CGI Source Disclosure
21536| [27588] Apache HTTP Server mod_rewrite LDAP Protocol URL Handling Overflow
21537| [27487] Apache HTTP Server Crafted Expect Header Cross Domain HTML Injection
21538| [26935] FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
21539| [26572] Apache Java Mail Enterprise Server (JAMES) MAIL Command Overflow DoS
21540| [25909] Drupal on Apache files Directory File Upload Arbitrary Code Execution
21541| [24825] Oracle ModPL/SQL for Apache Unspecified Remote HTTP Issue
21542| [24365] Apache Struts Multiple Function Error Message XSS
21543| [24364] Apache Struts getMultipartRequestHandler() Function Crafted Request DoS
21544| [24363] Apache Struts org.apache.struts.taglib.html.Constants.CANCEL Validation Bypass
21545| [24103] Pubcookie Apache mod_pubcookie Unspecified XSS
21546| [23906] Apache mod_python for Apache HTTP Server FileSession Privileged Local Command Execution
21547| [23905] Apache Log4net LocalSyslogAppender Format String Memory Corruption DoS
21548| [23198] Apache WSS4J Library SOAP Signature Verification Bypass
21549| [23124] Generic Apache Request Library (libapreq) apreq_parse_* Functions Remote DoS
21550| [22652] mod_php for Apache HTTP Server Crafted import_request_variables Function DoS
21551| [22475] PHP w/ Apache PDO::FETCH_CLASS __set() Function DoS
21552| [22473] PHP w/ Apache2 Crafted PDOStatement DoS
21553| [22459] Apache Geronimo Error Page XSS
21554| [22458] Apache Tomcat / Geronimo Sample Script cal2.jsp time Parameter XSS
21555| [22301] auth_ldap for Apache HTTP Server auth_ldap_log_reason() Function Remote Format String
21556| [22261] Apache HTTP Server mod_ssl ssl_hook_Access Error Handling DoS
21557| [22259] mod_auth_pgsql for Apache HTTP Server Log Function Format String
21558| [21736] Apache Java Mail Enterprise Server (JAMES) Spooler retrieve Function DoS
21559| [21705] Apache HTTP Server mod_imap Image Map Referer XSS
21560| [21021] Apache Struts Error Message XSS
21561| [20897] PHP w/ Apache 2 SAPI virtual() Function Unspecified INI Setting Disclosure
21562| [20491] PHP mod_php apache2handler SAPI Crafted .htaccess DoS
21563| [20462] Apache HTTP Server worker.c MPM Memory Exhaustion DoS
21564| [20439] Apache Tomcat Directory Listing Saturation DoS
21565| [20373] Apache Tomcat on HP Secure OS for Linux Unspecified Servlet Access Issue
21566| [20285] Apache HTTP Server Log File Control Character Injection
21567| [20242] Apache HTTP Server mod_usertrack Predictable Session ID Generation
21568| [20209] Brainf*ck Module (mod_bf) for Apache HTTP Server Local Overflow
21569| [20033] Apache Tomcat MS-DOS Device Request Error Message Path Disclosure
21570| [19883] apachetop atop.debug Symlink Arbitrary File Overwrite
21571| [19863] mod_auth_shadow for Apache HTTP Server require group Authentication Bypass
21572| [19855] Apache HTTP Server ErrorDocument Directive .htaccess Bypass
21573| [19821] Apache Tomcat Malformed Post Request Information Disclosure
21574| [19769] Apache HTTP Server Double-reverse DNS Lookup Spoofing
21575| [19188] Apache HTTP Server mod_ssl SSLVerifyClient Per-location Context Restriction Bypass
21576| [19137] Apache HTTP Server on Red Hat Linux Double Slash GET Request Forced Directory Listing
21577| [19136] Apache on Mandrake Linux Arbitrary Directory Forced Listing
21578| [18977] Apache HTTP Server Crafted HTTP Range Header DoS
21579| [18389] Ragnarok Online Control Panel Apache Authentication Bypass
21580| [18286] Apache HTTP Server mod_ssl ssl_callback_SSLVerify_CRL( ) Function Overflow
21581| [18233] Apache HTTP Server htdigest user Variable Overfow
21582| [17738] Apache HTTP Server HTTP Request Smuggling
21583| [16586] Apache HTTP Server Win32 GET Overflow DoS
21584| [15889] Apache HTTP Server mod_cgid Threaded MPM CGI Output Misdirection
21585| [14896] mod_dav for Apache HTTP Server Remote Null Dereference Child Process Termination
21586| [14879] Apache HTTP Server ap_log_rerror Function Error Message Path Disclosure
21587| [14770] Apache Tomcat AJP12 Protocol Malformed Packet Remote DoS
21588| [14597] Apache Tomcat IntegerOverflow.jsp Test JSP Script Path Disclosure
21589| [14596] Apache Tomcat pageSession.jsp Test JSP Script Path Disclosure
21590| [14595] Apache Tomcat pageLanguage.jsp Test JSP Script Path Disclosure
21591| [14594] Apache Tomcat pageIsThreadSafe.jsp Test JSP Script Path Disclosure
21592| [14593] Apache Tomcat pageIsErrorPage.jsp Test JSP Script Path Disclosure
21593| [14592] Apache Tomcat pageInvalid.jsp Test JSP Script Path Disclosure
21594| [14591] Apache Tomcat pageExtends.jsp Test JSP Script Path Disclosure
21595| [14590] Apache Tomcat pageDouble.jsp Test JSP Script Path Disclosure
21596| [14589] Apache Tomcat pageAutoFlush.jsp Test JSP Script Path Disclosure
21597| [14588] Apache Tomcat extends2.jsp Test JSP Script Path Disclosure
21598| [14587] Apache Tomcat extends1.jsp Test JSP Script Path Disclosure
21599| [14586] Apache Tomcat comments.jsp Test JSP Script Path Disclosure
21600| [14585] Apache Tomcat buffer4.jsp Test JSP Script Path Disclosure
21601| [14584] Apache Tomcat buffer3.jsp Test JSP Script Path Disclosure
21602| [14583] Apache Tomcat buffer2.jsp Test JSP Script Path Disclosure
21603| [14582] Apache Tomcat buffer1.jsp Test JSP Script Path Disclosure
21604| [14581] Apache Tomcat pageImport2.jsp Test JSP Script Path Disclosure
21605| [14580] Apache Tomcat pageInfo.jsp Test JSP Script Path Disclosure
21606| [14410] mod_frontpage for Apache HTTP Server fpexec Remote Overflow
21607| [14044] Apache Batik Squiggle Browser with Rhino Scripting Engine Unspecified File System Access
21608| [13737] mod_access_referer for Apache HTTP Server Malformed Referer DoS
21609| [13711] Apache mod_python publisher.py Traversal Arbitrary Object Information Disclosure
21610| [13640] mod_auth_any for Apache HTTP Server on Red Hat Linux Metacharacter Command Execution
21611| [13304] Apache Tomcat realPath.jsp Path Disclosure
21612| [13303] Apache Tomcat source.jsp Arbitrary Directory Listing
21613| [13087] Apache HTTP Server mod_log_forensic check_forensic Symlink Arbitrary File Creation / Overwrite
21614| [12849] mod_auth_radius for Apache HTTP Server radcpy() Function Overflow DoS
21615| [12848] Apache HTTP Server htdigest realm Variable Overflow
21616| [12721] Apache Tomcat examples/jsp2/el/functions.jsp XSS
21617| [12720] mod_dosevasive for Apache HTTP Server Symlink Arbitrary File Create/Overwrite
21618| [12558] Apache HTTP Server IPv6 FTP Proxy Socket Failure DoS
21619| [12557] Apache HTTP Server prefork MPM accept Error DoS
21620| [12233] Apache Tomcat MS-DOS Device Name Request DoS
21621| [12232] Apache Tomcat with JDK Arbitrary Directory/Source Disclosure
21622| [12231] Apache Tomcat web.xml Arbitrary File Access
21623| [12193] Apache HTTP Server on Mac OS X File Handler Bypass
21624| [12192] Apache HTTP Server on Mac OS X Unauthorized .ht and .DS_Store File Access
21625| [12178] Apache Jakarta Lucene results.jsp XSS
21626| [12176] mod_digest_apple for Apache HTTP Server on Mac OS X Authentication Replay
21627| [11391] Apache HTTP Server Header Parsing Space Saturation DoS
21628| [11003] Apache HTTP Server mod_include get_tag() Function Local Overflow
21629| [10976] mod_mylo for Apache HTTP Server mylo_log Logging Function HTTP GET Overflow
21630| [10637] Apache HTTP Server mod_ssl SSLCipherSuite Access Restriction Bypass
21631| [10546] Macromedia JRun4 mod_jrun Apache Module Remote Overflow
21632| [10471] Apache Xerces-C++ XML Parser DoS
21633| [10218] Apache HTTP Server Satisfy Directive Access Control Bypass
21634| [10068] Apache HTTP Server htpasswd Local Overflow
21635| [10049] mod_cplusplus For Apache HTTP Server Unspecified Overflow
21636| [9994] Apache HTTP Server apr-util IPV6 Parsing DoS
21637| [9991] Apache HTTP Server ap_resolve_env Environment Variable Local Overflow
21638| [9948] mod_dav for Apache HTTP Server LOCK Request DoS
21639| [9742] Apache HTTP Server mod_ssl char_buffer_read Function Reverse Proxy DoS
21640| [9718] Apache HTTP Server Win32 Single Dot Append Arbitrary File Access
21641| [9717] Apache HTTP Server mod_cookies Cookie Overflow
21642| [9716] Apache::Gallery Gallery.pm Inline::C Predictable Filename Code Execution
21643| [9715] Apache HTTP Server rotatelogs Control Characters Over Pipe DoS
21644| [9714] Apache Authentication Module Threaded MPM DoS
21645| [9713] Apache HTTP Server on OS2 filestat.c Device Name Request DoS
21646| [9712] Apache HTTP Server Multiple Linefeed Request Memory Consumption DoS
21647| [9711] Apache HTTP Server Access Log Terminal Escape Sequence Injection
21648| [9710] Apache HTTP Server on Windows Illegal Character Default Script Mapping Bypass
21649| [9709] Apache HTTP Server on Windows MS-DOS Device Name HTTP Post Code Execution
21650| [9708] Apache HTTP Server on Windows MS-DOS Device Name DoS
21651| [9707] Apache HTTP Server Duplicate MIME Header Saturation DoS
21652| [9706] Apache Web Server Multiple MIME Header Saturation Remote DoS
21653| [9705] Apache Tomcat Invoker/Default Servlet Source Disclosure
21654| [9702] Apache HTTP Server CGI/WebDAV HTTP POST Request Source Disclosure
21655| [9701] Apache HTTP Server for Windows Multiple Slash Forced Directory Listing
21656| [9700] Apache HTTP Server mod_autoindex Multiple Slash Request Forced Directory Listing
21657| [9699] Apache HTTP Server mod_dir Multiple Slash Request Forced Directory Listing
21658| [9698] Apache HTTP Server mod_negotiation Multiple Slash Request Forced Directory Listing
21659| [9697] Apache HTTP Server htdigest Local Symlink Arbitrary File Overwrite
21660| [9696] Apache HTTP Server htpasswd Local Symlink Arbitrary File Overwrite
21661| [9695] Apache Tomcat SnoopServlet Servlet Information Disclosure
21662| [9694] PHP3 on Apache HTTP Server Encoded Traversal Arbitrary File Access
21663| [9693] mod_auth_pgsql_sys for Apache HTTP Server User Name SQL Injection
21664| [9692] Apache HTTP Server mod_vhost_alias Mass Virtual Hosting Arbitrary File Access
21665| [9691] Apache HTTP Server mod_rewrite Mass Virtual Hosting Arbitrary File Access
21666| [9690] Apache HTTP Server mod_vhost_alias CGI Program Source Disclosure
21667| [9689] Trustix httpsd for Apache-SSL Permission Weakness Privilege Escalation
21668| [9688] Apache HTTP Server mod_proxy Malformed FTP Command DoS
21669| [9687] Apache::AuthenSmb smbval SMB Authentication Library Multiple Overflows
21670| [9686] Apache::AuthenSmb smbvalid SMB Authentication Library Multiple Overflows
21671| [9523] Apache HTTP Server mod_ssl Aborted Connection DoS
21672| [9459] Oracle PL/SQL (mod_plsql) Apache Module Help Page Request Remote Overflow
21673| [9208] Apache Tomcat .jsp Encoded Newline XSS
21674| [9204] Apache Tomcat ROOT Application XSS
21675| [9203] Apache Tomcat examples Application XSS
21676| [9068] Apache HTTP Server mod_userdir User Account Information Disclosure
21677| [8773] Apache Tomcat Catalina org.apache.catalina.servlets.DefaultServlet Source Code Disclosure
21678| [8772] Apache Tomcat Catalina org.apache.catalina.connector.http DoS
21679| [7943] Apache HTTP Server mod_ssl sslkeys File Disclosure
21680| [7942] Apache HTTP Server mod_ssl Default Pass Phrase
21681| [7941] Apache HTTP Server mod_ssl Encrypted Private Key File Descriptor Leak
21682| [7935] Apache HTTP Server mod_ssl ssl_gcache Race Conditions
21683| [7934] Apache HTTP Server mod_ssl SSLSessionCache File Content Disclosure
21684| [7933] Apache HTTP Server mod_ssl SSLMutex File Content Disclosure
21685| [7932] Apache HTTP Server mod_ssl mkcert.sh File Creation Permission Weakness
21686| [7931] Apache HTTP Server mod_ssl X.509 Client Certificate Authentication Bypass
21687| [7930] Apache HTTP Server mod_ssl ssl_expr_eval_func_file() Overflow
21688| [7929] Apache HTTP Server mod_ssl ssl_engine_log.c mod_proxy Hook Function Remote Format String
21689| [7611] Apache HTTP Server mod_alias Local Overflow
21690| [7394] Apache Tomcat mod_jk Invalid Transfer-Encoding Chunked Field DoS
21691| [7203] Apache Tomcat source.jsp Traversal Arbitrary File Access
21692| [7039] Apache HTTP Server on Mac OS X HFS+ File System Access Bypass
21693| [6882] Apache mod_python Malformed Query String Variant DoS
21694| [6839] Apache HTTP Server mod_proxy Content-Length Overflow
21695| [6630] Apache Tomcat Java Server Pages (JSP) Engine WPrinterJob() DoS
21696| [6472] Apache HTTP Server mod_ssl ssl_util_uuencode_binary Remote Overflow
21697| [5821] Apache HTTP Server Multiple / GET Remote Overflow DoS
21698| [5580] Apache Tomcat Servlet Malformed URL JSP Source Disclosure
21699| [5552] Apache HTTP Server split-logfile Arbitrary .log File Overwrite
21700| [5526] Apache Tomcat Long .JSP URI Path Disclosure
21701| [5278] Apache Tomcat web.xml Restriction Bypass
21702| [5051] Apache Tomcat Null Character DoS
21703| [4973] Apache Tomcat servlet Mapping XSS
21704| [4650] mod_gzip for Apache HTTP Server Debug Mode Printf Stack Overflow
21705| [4649] mod_gzip for Apache HTTP Server Debug Mode Format String Overflow
21706| [4648] mod_gzip for Apache HTTP Server Debug Mode Race Condition
21707| [4568] mod_survey For Apache ENV Tags SQL Injection
21708| [4553] Apache HTTP Server ApacheBench Overflow DoS
21709| [4552] Apache HTTP Server Shared Memory Scoreboard DoS
21710| [4446] Apache HTTP Server mod_disk_cache Stores Credentials
21711| [4383] Apache HTTP Server Socket Race Condition DoS
21712| [4382] Apache HTTP Server Log Entry Terminal Escape Sequence Injection
21713| [4340] Apache Portable Runtime (APR) apr_psprintf DoS
21714| [4232] Apache Cocoon DatabaseAuthenticatorAction SQL Injection
21715| [4231] Apache Cocoon Error Page Server Path Disclosure
21716| [4182] Apache HTTP Server mod_ssl Plain HTTP Request DoS
21717| [4181] Apache HTTP Server mod_access IP Address Netmask Rule Bypass
21718| [4075] Apache HTTP Sever on Windows .var File Request Path Disclosure
21719| [4037] Apache HTTP Server on Cygwin Encoded GET Request Arbitrary File Access
21720| [3877] Apache-SSL SSLVerifyClient SSLFakeBasicAuth Client Certificate Forgery
21721| [3819] Apache HTTP Server mod_digest Cross Realm Credential Replay
21722| [3322] mod_php for Apache HTTP Server Process Hijack
21723| [3215] mod_php for Apache HTTP Server File Descriptor Leakage
21724| [2885] Apache mod_python Malformed Query String DoS
21725| [2749] Apache Cocoon view-source Sample File Traversal Arbitrary File Access
21726| [2733] Apache HTTP Server mod_rewrite Local Overflow
21727| [2672] Apache HTTP Server mod_ssl SSLCipherSuite Ciphersuite Downgrade Weakness
21728| [2613] Apache HTTP Server mod_cgi stderr Output Handling Local DoS
21729| [2149] Apache::Gallery Privilege Escalation
21730| [2107] Apache HTTP Server mod_ssl Host: Header XSS
21731| [1926] Apache HTTP Server mod_rewrite Crafted URI Rule Bypass
21732| [1833] Apache HTTP Server Multiple Slash GET Request DoS
21733| [1577] Apache HTTP Server mod_rewrite RewriteRule Expansion Arbitrary File Access
21734| [872] Apache Tomcat Multiple Default Accounts
21735| [862] Apache HTTP Server SSI Error Page XSS
21736| [859] Apache HTTP Server Win32 Crafted Traversal Arbitrary File Access
21737| [849] Apache Tomcat TroubleShooter Servlet Information Disclosure
21738| [845] Apache Tomcat MSDOS Device XSS
21739| [844] Apache Tomcat Java Servlet Error Page XSS
21740| [842] Apache HTTP Server mod_ssl ssl_compat_directive Function Overflow
21741| [838] Apache HTTP Server Chunked Encoding Remote Overflow
21742| [827] PHP4 for Apache on Windows php.exe Malformed Request Path Disclosure
21743| [775] Apache mod_python Module Importing Privilege Function Execution
21744| [769] Apache HTTP Server Win32 DOS Batch File Arbitrary Command Execution
21745| [756] Apache HTTP Server mod_ssl i2d_SSL_SESSION Function SSL Client Certificate Overflow
21746| [701] Apache HTTP Server Win32 ScriptAlias php.exe Arbitrary File Access
21747| [674] Apache Tomcat Nonexistent File Error Message Path Disclosure
21748| [637] Apache HTTP Server UserDir Directive Username Enumeration
21749| [623] mod_auth_pgsql for Apache HTTP Server User Name SQL Injection
21750| [582] Apache HTTP Server Multiviews Feature Arbitrary Directory Listing
21751| [562] Apache HTTP Server mod_info /server-info Information Disclosure
21752| [561] Apache Web Servers mod_status /server-status Information Disclosure
21753| [417] Apache HTTP Server on SuSE Linux /doc/packages Remote Information Disclosure
21754| [410] mod_perl for Apache HTTP Server /perl/ Directory Listing
21755| [404] Apache HTTP Server on SuSE Linux WebDAV PROPFIND Arbitrary Directory Listing
21756| [402] Apache HTTP Server on SuSE Linux cgi-bin-sdb Request Script Source Disclosure
21757| [379] Apache ASP module Apache::ASP source.asp Example File Arbitrary File Creation
21758| [377] Apache Tomcat Snoop Servlet Remote Information Disclosure
21759| [376] Apache Tomcat contextAdmin Arbitrary File Access
21760| [342] Apache HTTP Server for Windows Multiple Forward Slash Directory Listing
21761| [222] Apache HTTP Server test-cgi Arbitrary File Access
21762| [143] Apache HTTP Server printenv.pl Multiple Method CGI XSS
21763| [48] Apache HTTP Server on Debian /usr/doc Directory Information Disclosure
21764|_
21765445/tcp closed microsoft-ds conn-refused
21766Device type: general purpose
21767Running (JUST GUESSING): Linux 2.6.X (91%)
21768OS CPE: cpe:/o:linux:linux_kernel:2.6
21769OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
21770Aggressive OS guesses: Linux 2.6.18 - 2.6.22 (91%)
21771No exact OS matches for host (test conditions non-ideal).
21772TCP/IP fingerprint:
21773SCAN(V=7.70%E=4%D=8/3%OT=80%CT=25%CU=%PV=N%G=N%TM=5D4656A3%P=x86_64-pc-linux-gnu)
21774SEQ(SP=103%GCD=1%ISR=106%TI=RI%CI=Z%TS=21)
21775OPS(O1=M44FNW5ST11%O2=M44FNW5ST11%O3=M280NW5NNT11%O4=M44FNW5ST11%O5=M218NW5ST11%O6=M109ST11)
21776WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF)
21777ECN(R=Y%DF=Y%TG=40%W=FFFF%O=M44FNW5SLL%CC=Y%Q=)
21778T1(R=Y%DF=Y%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
21779T2(R=N)
21780T3(R=N)
21781T4(R=N)
21782T5(R=Y%DF=Y%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
21783T6(R=Y%DF=Y%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
21784T7(R=N)
21785U1(R=N)
21786IE(R=N)
21787
21788Uptime guess: 0.000 days (since Sat Aug 3 23:52:45 2019)
21789TCP Sequence Prediction: Difficulty=262 (Good luck!)
21790IP ID Sequence Generation: Random positive increments
21791
21792TRACEROUTE (using proto 1/icmp)
21793HOP RTT ADDRESS
217941 189.41 ms 10.244.200.1
217952 190.77 ms 213.184.122.97
217963 189.51 ms bzq-82-80-246-9.cablep.bezeqint.net (82.80.246.9)
217974 184.06 ms bzq-179-124-185.cust.bezeqint.net (212.179.124.185)
217985 238.01 ms bzq-179-124-190.cust.bezeqint.net (212.179.124.190)
217996 237.48 ms ae8.cr1-fra2.ip4.gtt.net (46.33.89.237)
218007 321.95 ms et-0-0-71.cr3-was1.ip4.gtt.net (89.149.139.90)
218018 324.70 ms 202.232.1.113
218029 383.15 ms sjc002bb12.IIJ.Net (58.138.81.226)
2180310 483.81 ms tky001bb11.IIJ.Net (58.138.88.85)
2180411 479.77 ms tky001ip57.IIJ.Net (58.138.100.22)
2180512 518.94 ms 202.232.9.94
2180613 ... 30
21807
21808NSE: Script Post-scanning.
21809NSE: Starting runlevel 1 (of 2) scan.
21810Initiating NSE at 23:53
21811Completed NSE at 23:53, 0.00s elapsed
21812NSE: Starting runlevel 2 (of 2) scan.
21813Initiating NSE at 23:53
21814Completed NSE at 23:53, 0.00s elapsed
21815Read data files from: /usr/bin/../share/nmap
21816#####################################################################################################################################
21817Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-03 23:53 EDT
21818NSE: Loaded 45 scripts for scanning.
21819NSE: Script Pre-scanning.
21820Initiating NSE at 23:53
21821Completed NSE at 23:53, 0.00s elapsed
21822Initiating NSE at 23:53
21823Completed NSE at 23:53, 0.00s elapsed
21824Initiating Parallel DNS resolution of 1 host. at 23:53
21825Completed Parallel DNS resolution of 1 host. at 23:53, 0.02s elapsed
21826Initiating UDP Scan at 23:53
21827Scanning 150.60.195.62 [14 ports]
21828Completed UDP Scan at 23:53, 2.70s elapsed (14 total ports)
21829Initiating Service scan at 23:53
21830Scanning 12 services on 150.60.195.62
21831Service scan Timing: About 8.33% done; ETC: 00:12 (0:17:47 remaining)
21832Completed Service scan at 23:54, 102.59s elapsed (12 services on 1 host)
21833Initiating OS detection (try #1) against 150.60.195.62
21834Retrying OS detection (try #2) against 150.60.195.62
21835Initiating Traceroute at 23:55
21836Completed Traceroute at 23:55, 7.20s elapsed
21837Initiating Parallel DNS resolution of 1 host. at 23:55
21838Completed Parallel DNS resolution of 1 host. at 23:55, 0.00s elapsed
21839NSE: Script scanning 150.60.195.62.
21840Initiating NSE at 23:55
21841Completed NSE at 23:55, 7.32s elapsed
21842Initiating NSE at 23:55
21843Completed NSE at 23:55, 1.39s elapsed
21844Nmap scan report for 150.60.195.62
21845Host is up (0.19s latency).
21846
21847PORT STATE SERVICE VERSION
2184853/udp open|filtered domain
2184967/udp open|filtered dhcps
2185068/udp open|filtered dhcpc
2185169/udp open|filtered tftp
2185288/udp open|filtered kerberos-sec
21853123/udp open|filtered ntp
21854137/udp filtered netbios-ns
21855138/udp filtered netbios-dgm
21856139/udp open|filtered netbios-ssn
21857161/udp open|filtered snmp
21858162/udp open|filtered snmptrap
21859389/udp open|filtered ldap
21860520/udp open|filtered route
218612049/udp open|filtered nfs
21862Too many fingerprints match this host to give specific OS details
21863
21864TRACEROUTE (using port 137/udp)
21865HOP RTT ADDRESS
218661 183.83 ms 10.244.200.1
218672 ... 3
218684 185.00 ms 10.244.200.1
218695 185.50 ms 10.244.200.1
218706 185.50 ms 10.244.200.1
218717 185.49 ms 10.244.200.1
218728 185.49 ms 10.244.200.1
218739 185.47 ms 10.244.200.1
2187410 185.38 ms 10.244.200.1
2187511 ... 18
2187619 184.78 ms 10.244.200.1
2187720 184.56 ms 10.244.200.1
2187821 ... 28
2187929 184.85 ms 10.244.200.1
2188030 183.73 ms 10.244.200.1
21881
21882NSE: Script Post-scanning.
21883Initiating NSE at 23:55
21884Completed NSE at 23:55, 0.00s elapsed
21885Initiating NSE at 23:55
21886Completed NSE at 23:55, 0.00s elapsed
21887Read data files from: /usr/bin/../share/nmap
21888OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
21889Nmap done: 1 IP address (1 host up) scanned in 128.05 seconds
21890 Raw packets sent: 147 (13.614KB) | Rcvd: 28 (2.846KB)
21891######################################################################################################################################
21892[+] URL: https://www.egw.co.jp/
21893[+] Started: Fri Aug 2 02:02:30 2019
21894
21895Interesting Finding(s):
21896
21897[+] https://www.egw.co.jp/
21898 | Interesting Entries:
21899 | - Server: Apache
21900 | - X-Powered-By: PHP/7.1.23
21901 | Found By: Headers (Passive Detection)
21902 | Confidence: 100%
21903
21904[+] https://www.egw.co.jp/robots.txt
21905 | Interesting Entries:
21906 | - /wp-admin/
21907 | - /wp-admin/admin-ajax.php
21908 | Found By: Robots Txt (Aggressive Detection)
21909 | Confidence: 100%
21910
21911[+] https://www.egw.co.jp/readme.html
21912 | Found By: Direct Access (Aggressive Detection)
21913 | Confidence: 100%
21914
21915[+] https://www.egw.co.jp/wp-cron.php
21916 | Found By: Direct Access (Aggressive Detection)
21917 | Confidence: 60%
21918 | References:
21919 | - https://www.iplocation.net/defend-wordpress-from-ddos
21920 | - https://github.com/wpscanteam/wpscan/issues/1299
21921
21922[+] WordPress version 5.2.2 identified (Latest, released on 2019-06-18).
21923 | Detected By: Rss Generator (Passive Detection)
21924 | - https://www.egw.co.jp/feed/, <generator>https://wordpress.org/?v=5.2.2</generator>
21925 | - https://www.egw.co.jp/comments/feed/, <generator>https://wordpress.org/?v=5.2.2</generator>
21926
21927[+] WordPress theme in use: support_egawa
21928 | Location: https://www.egw.co.jp/wp-content/themes/support_egawa/
21929 | Readme: https://www.egw.co.jp/wp-content/themes/support_egawa/README.md
21930 | Style URL: https://www.egw.co.jp/wp-content/themes/support_egawa/style.css?ver=5.2.2
21931 | Style Name: life_support_egawa
21932 | Description: Description...
21933 |
21934 | Detected By: Css Style (Passive Detection)
21935 |
21936 | Version: 1.0.0 (80% confidence)
21937 | Detected By: Style (Passive Detection)
21938 | - https://www.egw.co.jp/wp-content/themes/support_egawa/style.css?ver=5.2.2, Match: 'Version: 1.0.0'
21939
21940[+] Enumerating All Plugins (via Passive Methods)
21941[+] Checking Plugin Versions (via Passive and Aggressive Methods)
21942
21943[i] Plugin(s) Identified:
21944
21945[+] contact-form-7
21946 | Location: https://www.egw.co.jp/wp-content/plugins/contact-form-7/
21947 | Latest Version: 5.1.3 (up to date)
21948 | Last Updated: 2019-05-19T16:15:00.000Z
21949 |
21950 | Detected By: Urls In Homepage (Passive Detection)
21951 |
21952 | Version: 5.1.3 (100% confidence)
21953 | Detected By: Query Parameter (Passive Detection)
21954 | - https://www.egw.co.jp/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.3
21955 | - https://www.egw.co.jp/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3
21956 | Confirmed By:
21957 | Readme - Stable Tag (Aggressive Detection)
21958 | - https://www.egw.co.jp/wp-content/plugins/contact-form-7/readme.txt
21959 | Readme - ChangeLog Section (Aggressive Detection)
21960 | - https://www.egw.co.jp/wp-content/plugins/contact-form-7/readme.txt
21961
21962[+] contact-form-7-add-confirm
21963 | Location: https://www.egw.co.jp/wp-content/plugins/contact-form-7-add-confirm/
21964 | Latest Version: 5.1 (up to date)
21965 | Last Updated: 2018-02-27T01:32:00.000Z
21966 |
21967 | Detected By: Urls In Homepage (Passive Detection)
21968 |
21969 | Version: 5.1 (80% confidence)
21970 | Detected By: Readme - Stable Tag (Aggressive Detection)
21971 | - https://www.egw.co.jp/wp-content/plugins/contact-form-7-add-confirm/readme.txt
21972
21973[+] Enumerating Config Backups (via Passive and Aggressive Methods)
21974 Checking Config Backups - Time: 00:00:11 <=============> (21 / 21) 100.00% Time: 00:00:11
21975
21976[i] No Config Backups Found.
21977
21978
21979[+] Finished: Fri Aug 2 02:03:51 2019
21980[+] Requests Done: 56
21981[+] Cached Requests: 6
21982[+] Data Sent: 8.593 KB
21983[+] Data Received: 182.72 KB
21984[+] Memory used: 181.055 MB
21985[+] Elapsed time: 00:01:21
21986#####################################################################################################################################
21987[+] URL: https://www.egw.co.jp/
21988[+] Started: Fri Aug 2 02:02:35 2019
21989
21990Interesting Finding(s):
21991
21992[+] https://www.egw.co.jp/
21993 | Interesting Entries:
21994 | - Server: Apache
21995 | - X-Powered-By: PHP/7.1.23
21996 | Found By: Headers (Passive Detection)
21997 | Confidence: 100%
21998
21999[+] https://www.egw.co.jp/robots.txt
22000 | Interesting Entries:
22001 | - /wp-admin/
22002 | - /wp-admin/admin-ajax.php
22003 | Found By: Robots Txt (Aggressive Detection)
22004 | Confidence: 100%
22005
22006[+] https://www.egw.co.jp/readme.html
22007 | Found By: Direct Access (Aggressive Detection)
22008 | Confidence: 100%
22009
22010[+] https://www.egw.co.jp/wp-cron.php
22011 | Found By: Direct Access (Aggressive Detection)
22012 | Confidence: 60%
22013 | References:
22014 | - https://www.iplocation.net/defend-wordpress-from-ddos
22015 | - https://github.com/wpscanteam/wpscan/issues/1299
22016
22017[+] WordPress version 5.2.2 identified (Latest, released on 2019-06-18).
22018 | Detected By: Rss Generator (Passive Detection)
22019 | - https://www.egw.co.jp/feed/, <generator>https://wordpress.org/?v=5.2.2</generator>
22020 | - https://www.egw.co.jp/comments/feed/, <generator>https://wordpress.org/?v=5.2.2</generator>
22021
22022[+] WordPress theme in use: support_egawa
22023 | Location: https://www.egw.co.jp/wp-content/themes/support_egawa/
22024 | Readme: https://www.egw.co.jp/wp-content/themes/support_egawa/README.md
22025 | Style URL: https://www.egw.co.jp/wp-content/themes/support_egawa/style.css?ver=5.2.2
22026 | Style Name: life_support_egawa
22027 | Description: Description...
22028 |
22029 | Detected By: Css Style (Passive Detection)
22030 |
22031 | Version: 1.0.0 (80% confidence)
22032 | Detected By: Style (Passive Detection)
22033 | - https://www.egw.co.jp/wp-content/themes/support_egawa/style.css?ver=5.2.2, Match: 'Version: 1.0.0'
22034
22035[+] Enumerating Users (via Passive and Aggressive Methods)
22036 Brute Forcing Author IDs - Time: 00:00:21 <==> (10 / 10) 100.00% Time: 00:00:21
22037
22038[i] User(s) Identified:
22039
22040[+] LSE
22041 | Detected By: Rss Generator (Passive Detection)
22042 | Confirmed By: Rss Generator (Aggressive Detection)
22043
22044[+] aduser
22045 | Detected By: Wp Json Api (Aggressive Detection)
22046 | - https://www.egw.co.jp/wp-json/wp/v2/users/?per_page=100&page=1
22047 | Confirmed By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
22048
22049[+] lse
22050 | Detected By: Wp Json Api (Aggressive Detection)
22051 | - https://www.egw.co.jp/wp-json/wp/v2/users/?per_page=100&page=1
22052 | Confirmed By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
22053
22054
22055[+] Finished: Fri Aug 2 02:04:08 2019
22056[+] Requests Done: 46
22057[+] Cached Requests: 12
22058[+] Data Sent: 7.519 KB
22059[+] Data Received: 299.302 KB
22060[+] Memory used: 101.328 MB
22061[+] Elapsed time: 00:01:32
22062#####################################################################################################################################
22063[+] URL: https://www.egw.co.jp/
22064[+] Started: Fri Aug 2 02:30:21 2019
22065
22066Interesting Finding(s):
22067
22068[+] https://www.egw.co.jp/
22069 | Interesting Entries:
22070 | - Server: Apache
22071 | - X-Powered-By: PHP/7.1.23
22072 | Found By: Headers (Passive Detection)
22073 | Confidence: 100%
22074
22075[+] https://www.egw.co.jp/robots.txt
22076 | Interesting Entries:
22077 | - /wp-admin/
22078 | - /wp-admin/admin-ajax.php
22079 | Found By: Robots Txt (Aggressive Detection)
22080 | Confidence: 100%
22081
22082[+] https://www.egw.co.jp/readme.html
22083 | Found By: Direct Access (Aggressive Detection)
22084 | Confidence: 100%
22085
22086[+] https://www.egw.co.jp/wp-cron.php
22087 | Found By: Direct Access (Aggressive Detection)
22088 | Confidence: 60%
22089 | References:
22090 | - https://www.iplocation.net/defend-wordpress-from-ddos
22091 | - https://github.com/wpscanteam/wpscan/issues/1299
22092
22093[+] WordPress version 5.2.2 identified (Latest, released on 2019-06-18).
22094 | Detected By: Rss Generator (Passive Detection)
22095 | - https://www.egw.co.jp/feed/, <generator>https://wordpress.org/?v=5.2.2</generator>
22096 | - https://www.egw.co.jp/comments/feed/, <generator>https://wordpress.org/?v=5.2.2</generator>
22097
22098[+] WordPress theme in use: support_egawa
22099 | Location: https://www.egw.co.jp/wp-content/themes/support_egawa/
22100 | Readme: https://www.egw.co.jp/wp-content/themes/support_egawa/README.md
22101 | Style URL: https://www.egw.co.jp/wp-content/themes/support_egawa/style.css?ver=5.2.2
22102 | Style Name: life_support_egawa
22103 | Description: Description...
22104 |
22105 | Detected By: Css Style (Passive Detection)
22106 |
22107 | Version: 1.0.0 (80% confidence)
22108 | Detected By: Style (Passive Detection)
22109 | - https://www.egw.co.jp/wp-content/themes/support_egawa/style.css?ver=5.2.2, Match: 'Version: 1.0.0'
22110
22111[+] Enumerating Users (via Passive and Aggressive Methods)
22112 Brute Forcing Author IDs - Time: 00:00:18 <============> (10 / 10) 100.00% Time: 00:00:18
22113
22114[i] User(s) Identified:
22115
22116[+] LSE
22117 | Detected By: Rss Generator (Passive Detection)
22118 | Confirmed By: Rss Generator (Aggressive Detection)
22119
22120[+] aduser
22121 | Detected By: Wp Json Api (Aggressive Detection)
22122 | - https://www.egw.co.jp/wp-json/wp/v2/users/?per_page=100&page=1
22123 | Confirmed By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
22124
22125[+] lse
22126 | Detected By: Wp Json Api (Aggressive Detection)
22127 | - https://www.egw.co.jp/wp-json/wp/v2/users/?per_page=100&page=1
22128 | Confirmed By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
22129
22130
22131[+] Finished: Fri Aug 2 02:31:55 2019
22132[+] Requests Done: 51
22133[+] Cached Requests: 7
22134[+] Data Sent: 8.189 KB
22135[+] Data Received: 363.998 KB
22136[+] Memory used: 101.145 MB
22137[+] Elapsed time: 00:01:33
22138######################################################################################################################################
22139[-] Date & Time: 02/08/2019 02:03:03
22140[I] Threads: 5
22141[-] Target: https://www.egw.co.jp (150.60.195.62)
22142[I] Server: Apache
22143[I] X-Powered-By: PHP/7.1.23
22144[L] X-Frame-Options: Not Enforced
22145[I] Strict-Transport-Security: Not Enforced
22146[I] X-Content-Security-Policy: Not Enforced
22147[I] X-Content-Type-Options: Not Enforced
22148[L] Robots.txt Found: https://www.egw.co.jp/robots.txt
22149[I] CMS Detection: WordPress
22150[I] Wordpress Version: 5.2.2
22151[I] Wordpress Theme: support_egawa
22152[-] WordPress usernames identified:
22153[M] LSE
22154[M] aduser
22155[M] lse
22156[M] XML-RPC services are enabled
22157[I] Autocomplete Off Not Found: https://www.egw.co.jp/wp-login.php
22158[-] Default WordPress Files:
22159[I] https://www.egw.co.jp/license.txt
22160[I] https://www.egw.co.jp/readme.html
22161[I] https://www.egw.co.jp/wp-content/themes/twentyfifteen/genericons/COPYING.txt
22162[I] https://www.egw.co.jp/wp-content/themes/twentyfifteen/genericons/LICENSE.txt
22163[I] https://www.egw.co.jp/wp-content/themes/twentyfifteen/readme.txt
22164[I] https://www.egw.co.jp/wp-content/themes/twentynineteen/readme.txt
22165[I] https://www.egw.co.jp/wp-content/themes/twentyseventeen/README.txt
22166[I] https://www.egw.co.jp/wp-content/themes/twentysixteen/genericons/COPYING.txt
22167[I] https://www.egw.co.jp/wp-content/themes/twentysixteen/genericons/LICENSE.txt
22168[I] https://www.egw.co.jp/wp-content/themes/twentysixteen/readme.txt
22169[I] https://www.egw.co.jp/wp-includes/ID3/license.commercial.txt
22170[I] https://www.egw.co.jp/wp-includes/ID3/license.txt
22171[I] https://www.egw.co.jp/wp-includes/ID3/readme.txt
22172[I] https://www.egw.co.jp/wp-includes/images/crystal/license.txt
22173[I] https://www.egw.co.jp/wp-includes/js/plupload/license.txt
22174[I] https://www.egw.co.jp/wp-includes/js/swfupload/license.txt
22175[I] https://www.egw.co.jp/wp-includes/js/tinymce/license.txt
22176[-] Searching Wordpress Plugins ...
22177[I] akismet
22178[M] EDB-ID: 37826 "WordPress 3.4.2 - Multiple Path Disclosure Vulnerabilities"
22179[M] EDB-ID: 37902 "WordPress Plugin Akismet - Multiple Cross-Site Scripting Vulnerabilities"
22180[I] contact-form-7 v5.1.3
22181[I] contact-form-7-add-confirm v5.1
22182[I] feed
22183[M] EDB-ID: 38624 "WordPress Plugin WP Feed - 'nid' SQL Injection"
22184[I] Checking for Directory Listing Enabled ...
22185[-] Date & Time: 02/08/2019 02:16:55
22186[-] Completed in: 0:13:51
22187#######################################################################################################################################
22188[*] TARGET: https://www.egw.co.jp/
22189[*] TARGET IP: 150.60.195.62
22190[INFO] NO load balancer detected for www.egw.co.jp...
22191[*] DNS servers: egw.co.jp.
22192[*] TARGET server: Apache
22193[*] CC: JP
22194[*] Country: Japan
22195[*] RegionCode: 13
22196[*] RegionName: Tokyo
22197[*] City: Chiyoda
22198[*] ASN: AS9044
22199[*] BGP_PREFIX: 128.0.0.0/3
22200[*] ISP: SOLNET BSE Software GmbH, CH
22201[INFO] SSL/HTTPS certificate detected
22202[*] Issuer: issuer=C = JP, O = "SECOM Trust Systems CO.,LTD.", CN = KDDI Web Communications Certification Authority 3
22203[*] Subject: subject=CN = www.egw.co.jp
22204[INFO] DNS enumeration:
22205[*] ftp.egw.co.jp egw.co.jp. 150.60.195.62
22206[INFO] Possible abuse mails are:
22207[*] abuse@egw.co.jp
22208[*] abuse@www.egw.co.jp
22209[*] tech@kddi-web.com
22210[INFO] NO PAC (Proxy Auto Configuration) file FOUND
22211[ALERT] robots.txt file FOUND in http://www.egw.co.jp/robots.txt
22212[INFO] Checking for HTTP status codes recursively from http://www.egw.co.jp/robots.txt
22213[INFO] Status code Folders
22214[INFO] Starting FUZZing in http://www.egw.co.jp/FUzZzZzZzZz...
22215[INFO] Status code Folders
22216[*] 200 http://www.egw.co.jp/news
22217[ALERT] Look in the source code. It may contain passwords
22218
22219Recherche 150.60.195.62
22220Connexion HTTP à 150.60.195.62
22221Envoi de la requête HTTP.
22222Requête HTTP envoyée. Attente de réponse.
22223HTTP/1.1 302 Found
22224Transfert de données terminé
22225HTTP/1.1 302 Found
22226Utilisation de https://150.60.195.62/
22227Recherche 150.60.195.62
22228Connexion HTTPS à 150.60.195.62
22229
22230lynx : accès impossible au fichier de départ http://150.60.195.62/
22231[INFO] Links found from https://www.egw.co.jp/ http://150.60.195.62/:
22232[*] https://www.egw.co.jp/
22233[*] https://www.egw.co.jp//
22234[*] https://www.egw.co.jp/2019/01/26/２０１９年幹部会が行われました/
22235[*] https://www.egw.co.jp/2019/03/13/新車納車安全祈願祭を開催-4/
22236[*] https://www.egw.co.jp/2019/03/17/安全意識を再認識、事故撲滅総決起大会が行われ/
22237[*] https://www.egw.co.jp/2019/04/01/入社式を開催！/
22238[*] https://www.egw.co.jp/2019/05/20/ｌｓｅ！チャリティーバザー２０１９を開催しま/
22239[*] https://www.egw.co.jp/case
22240[*] https://www.egw.co.jp/case/
22241[*] https://www.egw.co.jp/comments/feed/
22242[*] https://www.egw.co.jp/company
22243[*] https://www.egw.co.jp/company/
22244[*] https://www.egw.co.jp/contact
22245[*] https://www.egw.co.jp/contact/
22246[*] https://www.egw.co.jp/feed/
22247[*] https://www.egw.co.jp/map
22248[*] https://www.egw.co.jp/map/
22249[*] https://www.egw.co.jp/news
22250[*] https://www.egw.co.jp/#no
22251[*] https://www.egw.co.jp/point
22252[*] https://www.egw.co.jp/point/
22253[*] https://www.egw.co.jp/privacy
22254[*] https://www.egw.co.jp/privacy/
22255[*] https://www.egw.co.jp/recruit
22256[*] https://www.egw.co.jp/recruit/
22257[*] https://www.egw.co.jp/service
22258[*] https://www.egw.co.jp/service/
22259[*] https://www.egw.co.jp/service01
22260[*] https://www.egw.co.jp/service01/
22261[*] https://www.egw.co.jp/service02
22262[*] https://www.egw.co.jp/service02/
22263[*] https://www.egw.co.jp/service03
22264[*] https://www.egw.co.jp/service03/
22265[*] https://www.egw.co.jp/support_egawa/map/
22266[*] https://www.facebook.com/LIFESUPPORTEGAWA/
22267[INFO] GOOGLE has 26,200,000 results (0.20 seconds) about http://www.egw.co.jp/
22268[INFO] Shodan detected the following opened ports on 150.60.195.62:
22269[*] 0
22270[*] 2019
22271[*] 25
22272[*] 443
22273[*] 7
22274[*] 80
22275[*] 9675
22276[INFO] ------VirusTotal SECTION------
22277[INFO] VirusTotal passive DNS only stores address records. The following domains resolved to the given IP address:
22278[INFO] Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset:
22279[INFO] Latest files that are not detected by any antivirus solution and were downloaded by VirusTotal from the IP address provided:
22280[INFO] ------Alexa Rank SECTION------
22281[INFO] Percent of Visitors Rank in Country:
22282[INFO] Percent of Search Traffic:
22283[INFO] Percent of Unique Visits:
22284[INFO] Total Sites Linking In:
22285[*] Total Sites
22286[INFO] Useful links related to www.egw.co.jp - 150.60.195.62:
22287[*] https://www.virustotal.com/pt/ip-address/150.60.195.62/information/
22288[*] https://www.hybrid-analysis.com/search?host=150.60.195.62
22289[*] https://www.shodan.io/host/150.60.195.62
22290[*] https://www.senderbase.org/lookup/?search_string=150.60.195.62
22291[*] https://www.alienvault.com/open-threat-exchange/ip/150.60.195.62
22292[*] http://pastebin.com/search?q=150.60.195.62
22293[*] http://urlquery.net/search.php?q=150.60.195.62
22294[*] http://www.alexa.com/siteinfo/www.egw.co.jp
22295[*] http://www.google.com/safebrowsing/diagnostic?site=www.egw.co.jp
22296[*] https://censys.io/ipv4/150.60.195.62
22297[*] https://www.abuseipdb.com/check/150.60.195.62
22298[*] https://urlscan.io/search/#150.60.195.62
22299[*] https://github.com/search?q=150.60.195.62&type=Code
22300[INFO] Useful links related to AS9044 - 128.0.0.0/3:
22301[*] http://www.google.com/safebrowsing/diagnostic?site=AS:9044
22302[*] https://www.senderbase.org/lookup/?search_string=128.0.0.0/3
22303[*] http://bgp.he.net/AS9044
22304[*] https://stat.ripe.net/AS9044
22305[INFO] Date: 02/08/19 | Time: 02:36:53
22306[INFO] Total time: 2 minute(s) and 54 second(s)
22307#######################################################################################################################################
22308 Anonymous JTSEC #OpWhales Full Recon #24