Apache

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-8743 4Apache DebianNetapp+1 more 11Clustered Data Ontap Debian LinuxEnterprise Linux Desktop+8 more May 13, 2026 Jul 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security conc...Show more Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.Show less
CVE-2016-2161 1Apache 1Http Server May 13, 2026 Jul 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
CVE-2016-0736 1Apache 1Http Server May 13, 2026 Jul 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectab...Show more In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.Show less
CVE-2017-7659 1Apache 1Http Server May 13, 2026 Jul 26, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.
CVE-2016-6798 1Apache 1Sling May 13, 2026 Jul 19, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to...Show more In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.Show less
CVE-2016-5394 1Apache 1Sling May 13, 2026 Jul 19, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencode...Show more In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.Show less
CVE-2017-7688 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache OpenMeetings 1.0.0 updates user password in insecure manner.
CVE-2017-7685 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.
CVE-2017-7684 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.
CVE-2017-7683 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.
CVE-2017-7682 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 8.2 HIGH· v3 6.4 MEDIUM· v2 Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.
CVE-2017-7681 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-en...Show more Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.Show less
CVE-2017-7680 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.
CVE-2017-7673 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
CVE-2017-7666 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.
CVE-2017-7664 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 10.0 CRITICAL· v3 7.5 HIGH· v2 Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.
CVE-2017-7663 1Apache 1Openmeetings May 13, 2026 Jul 17, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.
CVE-2016-6793 1Apache 1Wicket May 13, 2026 Jul 17, 2017 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFile...Show more The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.Show less
CVE-2015-0249 1Apache 1Roller May 13, 2026 Jul 17, 2017 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL).
CVE-2017-9789 1Apache 1Http Server May 13, 2026 Jul 13, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.

Previous 1...132133134...175 Next